[kernel/f17] 3.5.5 stable queue and bugfixes
Justin M. Forbes
jforbes at fedoraproject.org
Wed Sep 26 21:11:07 UTC 2012
commit e1089320be716c13a139e4b52f8a31337ba8f17f
Author: Justin M. Forbes <jforbes at redhat.com>
Date: Wed Sep 26 16:08:13 2012 -0500
3.5.5 stable queue and bugfixes
3.5-git-stable.patch | 4108 ---------
af_netlink-credentials-cve-2012-3520.patch | 114 -
drm-radeon-make-64bit-fences-more-robust.patch | 70 +
kernel.spec | 33 +-
linux-3.5.5-stable-queue.patch | 8848 ++++++++++++++++++++
...r-to-limit-number-of-GSO-segments-per-skb.patch | 70 -
...of-TSO-segments-and-minimum-TX-queue-size.patch | 156 -
tcp-Apply-device-TSO-segment-limit-earlier.patch | 137 -
...ciback-restore-pci-config-space-after-FLR.patch | 54 +
9 files changed, 8993 insertions(+), 4597 deletions(-)
---
diff --git a/drm-radeon-make-64bit-fences-more-robust.patch b/drm-radeon-make-64bit-fences-more-robust.patch
new file mode 100644
index 0000000..aec70dc
--- /dev/null
+++ b/drm-radeon-make-64bit-fences-more-robust.patch
@@ -0,0 +1,70 @@
+From: Christian König <deathsimple at vodafone.de>
+
+Only increase the higher 32bits if we really detect a wrap around.
+
+v2: instead of increasing the higher 32bits just use the higher
+ 32bits from the last emitted fence.
+v3: also use last emitted fence value as upper limit.
+
+The intention of this patch is to make fences as robust as
+they where before introducing 64bit fences. This is
+necessary because on older systems it looks like the fence
+value gets corrupted on initialization.
+
+Fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=51344
+
+Should also fix:
+https://bugs.freedesktop.org/show_bug.cgi?id=54129
+https://bugs.freedesktop.org/show_bug.cgi?id=54662
+https://bugzilla.redhat.com/show_bug.cgi?id=846505
+https://bugzilla.redhat.com/show_bug.cgi?id=845639
+
+This is the 3.5 stable version of the patch:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=f492c171a38d77fc13a8998a0721f2da50835224
+3.4 and previous kernels do not need to be patched.
+
+Signed-off-by: Christian König <deathsimple at vodafone.de>
+Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
+---
+ drivers/gpu/drm/radeon/radeon_fence.c | 8 +++++---
+ 1 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
+index 11f5f40..71298ce 100644
+--- a/drivers/gpu/drm/radeon/radeon_fence.c
++++ b/drivers/gpu/drm/radeon/radeon_fence.c
+@@ -75,7 +75,7 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
+
+ void radeon_fence_process(struct radeon_device *rdev, int ring)
+ {
+- uint64_t seq, last_seq;
++ uint64_t seq, last_seq, last_emitted;
+ unsigned count_loop = 0;
+ bool wake = false;
+
+@@ -102,13 +102,15 @@ void radeon_fence_process(struct radeon_device *rdev, int ring)
+ */
+ last_seq = atomic64_read(&rdev->fence_drv[ring].last_seq);
+ do {
++ last_emitted = rdev->fence_drv[ring].seq;
+ seq = radeon_fence_read(rdev, ring);
+ seq |= last_seq & 0xffffffff00000000LL;
+ if (seq < last_seq) {
+- seq += 0x100000000LL;
++ seq &= 0xffffffff;
++ seq |= last_emitted & 0xffffffff00000000LL;
+ }
+
+- if (seq == last_seq) {
++ if (seq <= last_seq || seq > last_emitted) {
+ break;
+ }
+ /* If we loop over we don't want to return without
+--
+1.7.7.5
+
+--
+To unsubscribe from this list: send the line "unsubscribe stable" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/kernel.spec b/kernel.spec
index 53d673c..fadad75 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -755,14 +755,16 @@ Patch22060: CPU-hotplug-cpusets-suspend-Dont-modify-cpusets-during.patch
#rhbz 820039 843554
Patch22061: rds-set-correct-msg_namelen.patch
-#rhbz 845558 844714
-Patch22070: net-Allow-driver-to-limit-number-of-GSO-segments-per-skb.patch
-Patch22071: sfc-Fix-maximum-number-of-TSO-segments-and-minimum-TX-queue-size.patch
-Patch22072: tcp-Apply-device-TSO-segment-limit-earlier.patch
-
Patch23000: fbcon-fix-race-condition-between-console-lock-and-cursor-timer.patch
-Patch24000: af_netlink-credentials-cve-2012-3520.patch
+#rhbz 850350
+Patch24050: xen-pciback-restore-pci-config-space-after-FLR.patch
+
+#rhbz 846505 845639
+Patch24055: drm-radeon-make-64bit-fences-more-robust.patch
+
+#3.5.5 stable queue
+Patch25000: linux-3.5.5-stable-queue.patch
# END OF PATCH DEFINITIONS
@@ -1459,14 +1461,16 @@ ApplyPatch CPU-hotplug-cpusets-suspend-Dont-modify-cpusets-during.patch
#rhbz 820039 843554
ApplyPatch rds-set-correct-msg_namelen.patch
-#rhbz 845558 844714
-ApplyPatch net-Allow-driver-to-limit-number-of-GSO-segments-per-skb.patch
-ApplyPatch sfc-Fix-maximum-number-of-TSO-segments-and-minimum-TX-queue-size.patch
-ApplyPatch tcp-Apply-device-TSO-segment-limit-earlier.patch
-
ApplyPatch fbcon-fix-race-condition-between-console-lock-and-cursor-timer.patch
-ApplyPatch af_netlink-credentials-cve-2012-3520.patch
+#rhbz 850350
+ApplyPatch xen-pciback-restore-pci-config-space-after-FLR.patch
+
+#rhbz 846505 845639
+ApplyPatch drm-radeon-make-64bit-fences-more-robust.patch
+
+# 3.5.5 stable queue
+ApplyPatch linux-3.5.5-stable-queue.patch
# END OF PATCH APPLICATIONS
@@ -2329,6 +2333,11 @@ fi
# '-' | |
# '-'
%changelog
+* Wed Sep 26 2012 Justin M. Forbes <jforbes at redhat.com> 3.5.4-2
+- xen Restore the PCI config space after an FLR (rhbz 850350)
+- drm/radeon make 64bit fences more robust (rhbz 846505 845639)
+- Apply current 3.5.5 stable queue
+
* Fri Sep 21 2012 Josh Boyer <jwboyer at redhat.com> 3.4.11-2
- Add patch to fix radeon regression from Jerome Glisse (rhbz 785375)
diff --git a/linux-3.5.5-stable-queue.patch b/linux-3.5.5-stable-queue.patch
new file mode 100644
index 0000000..910c7c7
--- /dev/null
+++ b/linux-3.5.5-stable-queue.patch
@@ -0,0 +1,8848 @@
+From d4ffa161ab3990735400f1797ec0cd643b5a18e8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet at google.com>
+Date: Sun, 29 Jul 2012 20:52:21 +0000
+Subject: codel: refine one condition to avoid a nul rec_inv_sqrt
+
+
+From: Eric Dumazet <edumazet at google.com>
+
+[ Upstream commit 2359a47671fc4fb0fe5e9945f76c2cb10792c0f8 ]
+
+One condition before codel_Newton_step() was not good if
+we never left the dropping state for a flow. As a result
+rec_inv_sqrt was 0, instead of the ~0 initial value.
+
+codel control law was then set to a very aggressive mode, dropping
+many packets before reaching 'target' and recovering from this problem.
+
+To keep codel_vars_init() as efficient as possible, refine
+the condition to make sure rec_inv_sqrt initial value is correct
+
+Many thanks to Anton Mich for discovering the issue and suggesting
+a fix.
+
+Reported-by: Anton Mich <lp2s1h at gmail.com>
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/net/codel.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/include/net/codel.h
++++ b/include/net/codel.h
+@@ -305,6 +305,8 @@ static struct sk_buff *codel_dequeue(str
+ }
+ }
+ } else if (drop) {
++ u32 delta;
++
+ if (params->ecn && INET_ECN_set_ce(skb)) {
+ stats->ecn_mark++;
+ } else {
+@@ -320,9 +322,11 @@ static struct sk_buff *codel_dequeue(str
+ * assume that the drop rate that controlled the queue on the
+ * last cycle is a good starting point to control it now.
+ */
+- if (codel_time_before(now - vars->drop_next,
++ delta = vars->count - vars->lastcount;
++ if (delta > 1 &&
++ codel_time_before(now - vars->drop_next,
+ 16 * params->interval)) {
+- vars->count = (vars->count - vars->lastcount) | 1;
++ vars->count = delta;
+ /* we dont care if rec_inv_sqrt approximation
+ * is not very precise :
+ * Next Newton steps will correct it quadratically.
+From 019c941564d043bd0b99a53f4e9c25c5a917b934 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings at solarflare.com>
+Date: Mon, 30 Jul 2012 15:57:00 +0000
+Subject: net: Allow driver to limit number of GSO segments per skb
+
+
+From: Ben Hutchings <bhutchings at solarflare.com>
+
+[ Upstream commit 30b678d844af3305cda5953467005cebb5d7b687 ]
+
+A peer (or local user) may cause TCP to use a nominal MSS of as little
+as 88 (actual MSS of 76 with timestamps). Given that we have a
+sufficiently prodigious local sender and the peer ACKs quickly enough,
+it is nevertheless possible to grow the window for such a connection
+to the point that we will try to send just under 64K at once. This
+results in a single skb that expands to 861 segments.
+
+In some drivers with TSO support, such an skb will require hundreds of
+DMA descriptors; a substantial fraction of a TX ring or even more than
+a full ring. The TX queue selected for the skb may stall and trigger
+the TX watchdog repeatedly (since the problem skb will be retried
+after the TX reset). This particularly affects sfc, for which the
+issue is designated as CVE-2012-3412.
+
+Therefore:
+1. Add the field net_device::gso_max_segs holding the device-specific
+ limit.
+2. In netif_skb_features(), if the number of segments is too high then
+ mask out GSO features to force fall back to software GSO.
+
+Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/linux/netdevice.h | 2 ++
+ net/core/dev.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1301,6 +1301,8 @@ struct net_device {
+ /* for setting kernel sock attribute on TCP connection setup */
+ #define GSO_MAX_SIZE 65536
+ unsigned int gso_max_size;
++#define GSO_MAX_SEGS 65535
++ u16 gso_max_segs;
+
+ #ifdef CONFIG_DCB
+ /* Data Center Bridging netlink ops */
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2119,6 +2119,9 @@ netdev_features_t netif_skb_features(str
+ __be16 protocol = skb->protocol;
+ netdev_features_t features = skb->dev->features;
+
++ if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
++ features &= ~NETIF_F_GSO_MASK;
++
+ if (protocol == htons(ETH_P_8021Q)) {
+ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+ protocol = veh->h_vlan_encapsulated_proto;
+@@ -5911,6 +5914,7 @@ struct net_device *alloc_netdev_mqs(int
+ dev_net_set(dev, &init_net);
+
+ dev->gso_max_size = GSO_MAX_SIZE;
++ dev->gso_max_segs = GSO_MAX_SEGS;
+
+ INIT_LIST_HEAD(&dev->napi_list);
+ INIT_LIST_HEAD(&dev->unreg_list);
+From aebf58da7fc90169585f6b18dd43175b1d4d3b4c Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings at solarflare.com>
+Date: Mon, 30 Jul 2012 15:57:44 +0000
+Subject: sfc: Fix maximum number of TSO segments and minimum TX queue size
+
+
+From: Ben Hutchings <bhutchings at solarflare.com>
+
+[ Upstream commit 7e6d06f0de3f74ca929441add094518ae332257c ]
+
+
+Currently an skb requiring TSO may not fit within a minimum-size TX
+queue. The TX queue selected for the skb may stall and trigger the TX
+watchdog repeatedly (since the problem skb will be retried after the
+TX reset). This issue is designated as CVE-2012-3412.
+
+Set the maximum number of TSO segments for our devices to 100. This
+should make no difference to behaviour unless the actual MSS is less
+than about 700. Increase the minimum TX queue size accordingly to
+allow for 2 worst-case skbs, so that there will definitely be space
+to add an skb after we wake a queue.
+
+To avoid invalidating existing configurations, change
+efx_ethtool_set_ringparam() to fix up values that are too small rather
+than returning -EINVAL.
+
+Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/efx.c | 6 ++++++
+ drivers/net/ethernet/sfc/efx.h | 14 ++++++++++----
+ drivers/net/ethernet/sfc/ethtool.c | 16 +++++++++++-----
+ drivers/net/ethernet/sfc/tx.c | 19 +++++++++++++++++++
+ 4 files changed, 46 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -1503,6 +1503,11 @@ static int efx_probe_all(struct efx_nic
+ goto fail2;
+ }
+
++ BUILD_BUG_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_RXQ_MIN_ENT);
++ if (WARN_ON(EFX_DEFAULT_DMAQ_SIZE < EFX_TXQ_MIN_ENT(efx))) {
++ rc = -EINVAL;
++ goto fail3;
++ }
+ efx->rxq_entries = efx->txq_entries = EFX_DEFAULT_DMAQ_SIZE;
+
+ rc = efx_probe_filters(efx);
+@@ -2070,6 +2075,7 @@ static int efx_register_netdev(struct ef
+ net_dev->irq = efx->pci_dev->irq;
+ net_dev->netdev_ops = &efx_netdev_ops;
+ SET_ETHTOOL_OPS(net_dev, &efx_ethtool_ops);
++ net_dev->gso_max_segs = EFX_TSO_MAX_SEGS;
+
+ rtnl_lock();
+
+--- a/drivers/net/ethernet/sfc/efx.h
++++ b/drivers/net/ethernet/sfc/efx.h
+@@ -30,6 +30,7 @@ extern netdev_tx_t
+ efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
+ extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
+ extern int efx_setup_tc(struct net_device *net_dev, u8 num_tc);
++extern unsigned int efx_tx_max_skb_descs(struct efx_nic *efx);
+
+ /* RX */
+ extern int efx_probe_rx_queue(struct efx_rx_queue *rx_queue);
+@@ -52,10 +53,15 @@ extern void efx_schedule_slow_fill(struc
+ #define EFX_MAX_EVQ_SIZE 16384UL
+ #define EFX_MIN_EVQ_SIZE 512UL
+
+-/* The smallest [rt]xq_entries that the driver supports. Callers of
+- * efx_wake_queue() assume that they can subsequently send at least one
+- * skb. Falcon/A1 may require up to three descriptors per skb_frag. */
+-#define EFX_MIN_RING_SIZE (roundup_pow_of_two(2 * 3 * MAX_SKB_FRAGS))
++/* Maximum number of TCP segments we support for soft-TSO */
++#define EFX_TSO_MAX_SEGS 100
++
++/* The smallest [rt]xq_entries that the driver supports. RX minimum
++ * is a bit arbitrary. For TX, we must have space for at least 2
++ * TSO skbs.
++ */
++#define EFX_RXQ_MIN_ENT 128U
++#define EFX_TXQ_MIN_ENT(efx) (2 * efx_tx_max_skb_descs(efx))
+
+ /* Filters */
+ extern int efx_probe_filters(struct efx_nic *efx);
+--- a/drivers/net/ethernet/sfc/ethtool.c
++++ b/drivers/net/ethernet/sfc/ethtool.c
+@@ -680,21 +680,27 @@ static int efx_ethtool_set_ringparam(str
+ struct ethtool_ringparam *ring)
+ {
+ struct efx_nic *efx = netdev_priv(net_dev);
++ u32 txq_entries;
+
+ if (ring->rx_mini_pending || ring->rx_jumbo_pending ||
+ ring->rx_pending > EFX_MAX_DMAQ_SIZE ||
+ ring->tx_pending > EFX_MAX_DMAQ_SIZE)
+ return -EINVAL;
+
+- if (ring->rx_pending < EFX_MIN_RING_SIZE ||
+- ring->tx_pending < EFX_MIN_RING_SIZE) {
++ if (ring->rx_pending < EFX_RXQ_MIN_ENT) {
+ netif_err(efx, drv, efx->net_dev,
+- "TX and RX queues cannot be smaller than %ld\n",
+- EFX_MIN_RING_SIZE);
++ "RX queues cannot be smaller than %u\n",
++ EFX_RXQ_MIN_ENT);
+ return -EINVAL;
+ }
+
+- return efx_realloc_channels(efx, ring->rx_pending, ring->tx_pending);
++ txq_entries = max(ring->tx_pending, EFX_TXQ_MIN_ENT(efx));
++ if (txq_entries != ring->tx_pending)
++ netif_warn(efx, drv, efx->net_dev,
++ "increasing TX queue size to minimum of %u\n",
++ txq_entries);
++
++ return efx_realloc_channels(efx, ring->rx_pending, txq_entries);
+ }
+
+ static int efx_ethtool_set_pauseparam(struct net_device *net_dev,
+--- a/drivers/net/ethernet/sfc/tx.c
++++ b/drivers/net/ethernet/sfc/tx.c
+@@ -119,6 +119,25 @@ efx_max_tx_len(struct efx_nic *efx, dma_
+ return len;
+ }
+
++unsigned int efx_tx_max_skb_descs(struct efx_nic *efx)
++{
++ /* Header and payload descriptor for each output segment, plus
++ * one for every input fragment boundary within a segment
++ */
++ unsigned int max_descs = EFX_TSO_MAX_SEGS * 2 + MAX_SKB_FRAGS;
++
++ /* Possibly one more per segment for the alignment workaround */
++ if (EFX_WORKAROUND_5391(efx))
++ max_descs += EFX_TSO_MAX_SEGS;
++
++ /* Possibly more for PCIe page boundaries within input fragments */
++ if (PAGE_SIZE > EFX_PAGE_SIZE)
++ max_descs += max_t(unsigned int, MAX_SKB_FRAGS,
++ DIV_ROUND_UP(GSO_MAX_SIZE, EFX_PAGE_SIZE));
++
++ return max_descs;
++}
++
+ /*
+ * Add a socket buffer to a TX queue
+ *
+From 1378c3d6150bcbd40ef652487adef9c67b500bf1 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings at solarflare.com>
+Date: Mon, 30 Jul 2012 16:11:42 +0000
+Subject: tcp: Apply device TSO segment limit earlier
+
+
+From: Ben Hutchings <bhutchings at solarflare.com>
+
+[ Upstream commit 1485348d2424e1131ea42efc033cbd9366462b01 ]
+
+Cache the device gso_max_segs in sock::sk_gso_max_segs and use it to
+limit the size of TSO skbs. This avoids the need to fall back to
+software GSO for local TCP senders.
+
+Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/net/sock.h | 2 ++
+ net/core/sock.c | 1 +
+ net/ipv4/tcp.c | 4 +++-
+ net/ipv4/tcp_cong.c | 3 ++-
+ net/ipv4/tcp_output.c | 21 ++++++++++++---------
+ 5 files changed, 20 insertions(+), 11 deletions(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -217,6 +217,7 @@ struct cg_proto;
+ * @sk_route_nocaps: forbidden route capabilities (e.g NETIF_F_GSO_MASK)
+ * @sk_gso_type: GSO type (e.g. %SKB_GSO_TCPV4)
+ * @sk_gso_max_size: Maximum GSO segment size to build
++ * @sk_gso_max_segs: Maximum number of GSO segments
+ * @sk_lingertime: %SO_LINGER l_linger setting
+ * @sk_backlog: always used with the per-socket spinlock held
+ * @sk_callback_lock: used with the callbacks in the end of this struct
+@@ -336,6 +337,7 @@ struct sock {
+ netdev_features_t sk_route_nocaps;
+ int sk_gso_type;
+ unsigned int sk_gso_max_size;
++ u16 sk_gso_max_segs;
+ int sk_rcvlowat;
+ unsigned long sk_lingertime;
+ struct sk_buff_head sk_error_queue;
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1403,6 +1403,7 @@ void sk_setup_caps(struct sock *sk, stru
+ } else {
+ sk->sk_route_caps |= NETIF_F_SG | NETIF_F_HW_CSUM;
+ sk->sk_gso_max_size = dst->dev->gso_max_size;
++ sk->sk_gso_max_segs = dst->dev->gso_max_segs;
+ }
+ }
+ }
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -805,7 +805,9 @@ static unsigned int tcp_xmit_size_goal(s
+ old_size_goal + mss_now > xmit_size_goal)) {
+ xmit_size_goal = old_size_goal;
+ } else {
+- tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
++ tp->xmit_size_goal_segs =
++ min_t(u16, xmit_size_goal / mss_now,
++ sk->sk_gso_max_segs);
+ xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
+ }
+ }
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -291,7 +291,8 @@ bool tcp_is_cwnd_limited(const struct so
+ left = tp->snd_cwnd - in_flight;
+ if (sk_can_gso(sk) &&
+ left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
+- left * tp->mss_cache < sk->sk_gso_max_size)
++ left * tp->mss_cache < sk->sk_gso_max_size &&
++ left < sk->sk_gso_max_segs)
+ return true;
+ return left <= tcp_max_tso_deferred_mss(tp);
+ }
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1334,21 +1334,21 @@ static void tcp_cwnd_validate(struct soc
+ * when we would be allowed to send the split-due-to-Nagle skb fully.
+ */
+ static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
+- unsigned int mss_now, unsigned int cwnd)
++ unsigned int mss_now, unsigned int max_segs)
+ {
+ const struct tcp_sock *tp = tcp_sk(sk);
+- u32 needed, window, cwnd_len;
++ u32 needed, window, max_len;
+
+ window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
+- cwnd_len = mss_now * cwnd;
++ max_len = mss_now * max_segs;
+
+- if (likely(cwnd_len <= window && skb != tcp_write_queue_tail(sk)))
+- return cwnd_len;
++ if (likely(max_len <= window && skb != tcp_write_queue_tail(sk)))
++ return max_len;
+
+ needed = min(skb->len, window);
+
+- if (cwnd_len <= needed)
+- return cwnd_len;
++ if (max_len <= needed)
++ return max_len;
+
+ return needed - needed % mss_now;
+ }
+@@ -1577,7 +1577,8 @@ static bool tcp_tso_should_defer(struct
+ limit = min(send_win, cong_win);
+
+ /* If a full-sized TSO skb can be sent, do it. */
+- if (limit >= sk->sk_gso_max_size)
++ if (limit >= min_t(unsigned int, sk->sk_gso_max_size,
++ sk->sk_gso_max_segs * tp->mss_cache))
+ goto send_now;
+
+ /* Middle in queue won't get any more data, full sendable already? */
+@@ -1803,7 +1804,9 @@ static bool tcp_write_xmit(struct sock *
+ limit = mss_now;
+ if (tso_segs > 1 && !tcp_urg_mode(tp))
+ limit = tcp_mss_split_point(sk, skb, mss_now,
+- cwnd_quota);
++ min_t(unsigned int,
++ cwnd_quota,
++ sk->sk_gso_max_segs));
+
+ if (skb->len > limit &&
+ unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
+From 4a27ff65129fad3975e85b51a4d163b9308b0a50 Mon Sep 17 00:00:00 2001
+From: Hiroaki SHIMODA <shimoda.hiroaki at gmail.com>
+Date: Fri, 3 Aug 2012 19:57:52 +0900
+Subject: net_sched: gact: Fix potential panic in tcf_gact().
+
+
+From: Hiroaki SHIMODA <shimoda.hiroaki at gmail.com>
+
+[ Upstream commit 696ecdc10622d86541f2e35cc16e15b6b3b1b67e ]
+
+gact_rand array is accessed by gact->tcfg_ptype whose value
+is assumed to less than MAX_RAND, but any range checks are
+not performed.
+
+So add a check in tcf_gact_init(). And in tcf_gact(), we can
+reduce a branch.
+
+Signed-off-by: Hiroaki SHIMODA <shimoda.hiroaki at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/sched/act_gact.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/net/sched/act_gact.c
++++ b/net/sched/act_gact.c
+@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *
+ struct tcf_common *pc;
+ int ret = 0;
+ int err;
++#ifdef CONFIG_GACT_PROB
++ struct tc_gact_p *p_parm = NULL;
++#endif
+
+ if (nla == NULL)
+ return -EINVAL;
+@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *
+ #ifndef CONFIG_GACT_PROB
+ if (tb[TCA_GACT_PROB] != NULL)
+ return -EOPNOTSUPP;
++#else
++ if (tb[TCA_GACT_PROB]) {
++ p_parm = nla_data(tb[TCA_GACT_PROB]);
++ if (p_parm->ptype >= MAX_RAND)
++ return -EINVAL;
++ }
+ #endif
+
+ pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
+@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *
+ spin_lock_bh(&gact->tcf_lock);
+ gact->tcf_action = parm->action;
+ #ifdef CONFIG_GACT_PROB
+- if (tb[TCA_GACT_PROB] != NULL) {
+- struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
++ if (p_parm) {
+ gact->tcfg_paction = p_parm->paction;
+ gact->tcfg_pval = p_parm->pval;
+ gact->tcfg_ptype = p_parm->ptype;
+@@ -133,7 +141,7 @@ static int tcf_gact(struct sk_buff *skb,
+
+ spin_lock(&gact->tcf_lock);
+ #ifdef CONFIG_GACT_PROB
+- if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
++ if (gact->tcfg_ptype)
+ action = gact_rand[gact->tcfg_ptype](gact);
+ else
+ action = gact->tcf_action;
+From 55ad44e231bc005c1f6ad799e2badd8c35412601 Mon Sep 17 00:00:00 2001
+From: Wu Fengguang <fengguang.wu at intel.com>
+Date: Thu, 2 Aug 2012 23:10:01 +0000
+Subject: isdnloop: fix and simplify isdnloop_init()
+
+
+From: Wu Fengguang <fengguang.wu at intel.com>
+
+[ Upstream commit 77f00f6324cb97cf1df6f9c4aaeea6ada23abdb2 ]
+
+Fix a buffer overflow bug by removing the revision and printk.
+
+[ 22.016214] isdnloop-ISDN-driver Rev 1.11.6.7
+[ 22.097508] isdnloop: (loop0) virtual card added
+[ 22.174400] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff83244972
+[ 22.174400]
+[ 22.436157] Pid: 1, comm: swapper Not tainted 3.5.0-bisect-00018-gfa8bbb1-dirty #129
+[ 22.624071] Call Trace:
+[ 22.720558] [<ffffffff832448c3>] ? CallcNew+0x56/0x56
+[ 22.815248] [<ffffffff8222b623>] panic+0x110/0x329
+[ 22.914330] [<ffffffff83244972>] ? isdnloop_init+0xaf/0xb1
+[ 23.014800] [<ffffffff832448c3>] ? CallcNew+0x56/0x56
+[ 23.090763] [<ffffffff8108e24b>] __stack_chk_fail+0x2b/0x30
+[ 23.185748] [<ffffffff83244972>] isdnloop_init+0xaf/0xb1
+
+Signed-off-by: Fengguang Wu <fengguang.wu at intel.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/isdn/isdnloop/isdnloop.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/drivers/isdn/isdnloop/isdnloop.c
++++ b/drivers/isdn/isdnloop/isdnloop.c
+@@ -16,7 +16,6 @@
+ #include <linux/sched.h>
+ #include "isdnloop.h"
+
+-static char *revision = "$Revision: 1.11.6.7 $";
+ static char *isdnloop_id = "loop0";
+
+ MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
+@@ -1494,17 +1493,6 @@ isdnloop_addcard(char *id1)
+ static int __init
+ isdnloop_init(void)
+ {
+- char *p;
+- char rev[10];
+-
+- if ((p = strchr(revision, ':'))) {
+- strcpy(rev, p + 1);
+- p = strchr(rev, '$');
+- *p = 0;
+- } else
+- strcpy(rev, " ??? ");
+- printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
+-
+ if (isdnloop_id)
+ return (isdnloop_addcard(isdnloop_id));
+
+From aa50adc8f1a1da412f01cc21e992b175c73af74e Mon Sep 17 00:00:00 2001
+From: Gao feng <gaofeng at cn.fujitsu.com>
+Date: Tue, 7 Aug 2012 00:23:11 +0000
+Subject: pptp: lookup route with the proper net namespace
+
+
+From: Gao feng <gaofeng at cn.fujitsu.com>
+
+[ Upstream commit 08252b32311c3fa84219ad794d640af7399b5485 ]
+
+pptp always use init_net as the net namespace to lookup
+route, this will cause route lookup failed in container.
+
+because we already set the correct net namespace to struct
+sock in pptp_create,so fix this by using sock_net(sk) to
+replace &init_net.
+
+Signed-off-by: Gao feng <gaofeng at cn.fujitsu.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/ppp/pptp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -189,7 +189,7 @@ static int pptp_xmit(struct ppp_channel
+ if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ goto tx_error;
+
+- rt = ip_route_output_ports(&init_net, &fl4, NULL,
++ rt = ip_route_output_ports(sock_net(sk), &fl4, NULL,
+ opt->dst_addr.sin_addr.s_addr,
+ opt->src_addr.sin_addr.s_addr,
+ 0, 0, IPPROTO_GRE,
+@@ -468,7 +468,7 @@ static int pptp_connect(struct socket *s
+ po->chan.private = sk;
+ po->chan.ops = &pptp_chan_ops;
+
+- rt = ip_route_output_ports(&init_net, &fl4, sk,
++ rt = ip_route_output_ports(sock_net(sk), &fl4, sk,
+ opt->dst_addr.sin_addr.s_addr,
+ opt->src_addr.sin_addr.s_addr,
+ 0, 0,
+From 55939a0509f7270c6a77473e3071fbdbd61b5387 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov at ispras.ru>
+Date: Wed, 8 Aug 2012 00:33:25 +0000
+Subject: net/core: Fix potential memory leak in dev_set_alias()
+
+
+From: Alexey Khoroshilov <khoroshilov at ispras.ru>
+
+[ Upstream commit 7364e445f62825758fa61195d237a5b8ecdd06ec ]
+
+Do not leak memory by updating pointer with potentially NULL realloc return value.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov at ispras.ru>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/core/dev.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1055,6 +1055,8 @@ rollback:
+ */
+ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
+ {
++ char *new_ifalias;
++
+ ASSERT_RTNL();
+
+ if (len >= IFALIASZ)
+@@ -1068,9 +1070,10 @@ int dev_set_alias(struct net_device *dev
+ return 0;
+ }
+
+- dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+- if (!dev->ifalias)
++ new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
++ if (!new_ifalias)
+ return -ENOMEM;
++ dev->ifalias = new_ifalias;
+
+ strlcpy(dev->ifalias, alias, len+1);
+ return len;
+From 2337b3461addc75ef50c117cca63df2bcb181166 Mon Sep 17 00:00:00 2001
+From: "danborkmann at iogearbox.net" <danborkmann at iogearbox.net>
+Date: Fri, 10 Aug 2012 22:48:54 +0000
+Subject: af_packet: remove BUG statement in tpacket_destruct_skb
+
+
+From: "danborkmann at iogearbox.net" <danborkmann at iogearbox.net>
+
+[ Upstream commit 7f5c3e3a80e6654cf48dfba7cf94f88c6b505467 ]
+
+Here's a quote of the comment about the BUG macro from asm-generic/bug.h:
+
+ Don't use BUG() or BUG_ON() unless there's really no way out; one
+ example might be detecting data structure corruption in the middle
+ of an operation that can't be backed out of. If the (sub)system
+ can somehow continue operating, perhaps with reduced functionality,
+ it's probably not BUG-worthy.
+
+ If you're tempted to BUG(), think again: is completely giving up
+ really the *only* solution? There are usually better options, where
+ users don't need to reboot ASAP and can mostly shut down cleanly.
+
+In our case, the status flag of a ring buffer slot is managed from both sides,
+the kernel space and the user space. This means that even though the kernel
+side might work as expected, the user space screws up and changes this flag
+right between the send(2) is triggered when the flag is changed to
+TP_STATUS_SENDING and a given skb is destructed after some time. Then, this
+will hit the BUG macro. As David suggested, the best solution is to simply
+remove this statement since it cannot be used for kernel side internal
+consistency checks. I've tested it and the system still behaves /stable/ in
+this case, so in accordance with the above comment, we should rather remove it.
+
+Signed-off-by: Daniel Borkmann <daniel.borkmann at tik.ee.ethz.ch>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/packet/af_packet.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1943,7 +1943,6 @@ static void tpacket_destruct_skb(struct
+
+ if (likely(po->tx_ring.pg_vec)) {
+ ph = skb_shinfo(skb)->destructor_arg;
+- BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
+ BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
+ atomic_dec(&po->tx_ring.pending);
+ __packet_set_status(po, ph, TP_STATUS_AVAILABLE);
+From 4771461ea660338626e4213d108e5d929ff95a4f Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings at solarflare.com>
+Date: Tue, 14 Aug 2012 08:54:51 +0000
+Subject: ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side lock
+
+
+From: Ben Hutchings <bhutchings at solarflare.com>
+
+[ Upstream commit 4acd4945cd1e1f92b20d14e349c6c6a52acbd42d ]
+
+Cong Wang reports that lockdep detected suspicious RCU usage while
+enabling IPV6 forwarding:
+
+ [ 1123.310275] ===============================
+ [ 1123.442202] [ INFO: suspicious RCU usage. ]
+ [ 1123.558207] 3.6.0-rc1+ #109 Not tainted
+ [ 1123.665204] -------------------------------
+ [ 1123.768254] include/linux/rcupdate.h:430 Illegal context switch in RCU read-side critical section!
+ [ 1123.992320]
+ [ 1123.992320] other info that might help us debug this:
+ [ 1123.992320]
+ [ 1124.307382]
+ [ 1124.307382] rcu_scheduler_active = 1, debug_locks = 0
+ [ 1124.522220] 2 locks held by sysctl/5710:
+ [ 1124.648364] #0: (rtnl_mutex){+.+.+.}, at: [<ffffffff81768498>] rtnl_trylock+0x15/0x17
+ [ 1124.882211] #1: (rcu_read_lock){.+.+.+}, at: [<ffffffff81871df8>] rcu_lock_acquire+0x0/0x29
+ [ 1125.085209]
+ [ 1125.085209] stack backtrace:
+ [ 1125.332213] Pid: 5710, comm: sysctl Not tainted 3.6.0-rc1+ #109
+ [ 1125.441291] Call Trace:
+ [ 1125.545281] [<ffffffff8109d915>] lockdep_rcu_suspicious+0x109/0x112
+ [ 1125.667212] [<ffffffff8107c240>] rcu_preempt_sleep_check+0x45/0x47
+ [ 1125.781838] [<ffffffff8107c260>] __might_sleep+0x1e/0x19b
+[...]
+ [ 1127.445223] [<ffffffff81757ac5>] call_netdevice_notifiers+0x4a/0x4f
+[...]
+ [ 1127.772188] [<ffffffff8175e125>] dev_disable_lro+0x32/0x6b
+ [ 1127.885174] [<ffffffff81872d26>] dev_forward_change+0x30/0xcb
+ [ 1128.013214] [<ffffffff818738c4>] addrconf_forward_change+0x85/0xc5
+[...]
+
+addrconf_forward_change() uses RCU iteration over the netdev list,
+which is unnecessary since it already holds the RTNL lock. We also
+cannot reasonably require netdevice notifier functions not to sleep.
+
+Reported-by: Cong Wang <amwang at redhat.com>
+Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/ipv6/addrconf.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -493,8 +493,7 @@ static void addrconf_forward_change(stru
+ struct net_device *dev;
+ struct inet6_dev *idev;
+
+- rcu_read_lock();
+- for_each_netdev_rcu(net, dev) {
++ for_each_netdev(net, dev) {
+ idev = __in6_dev_get(dev);
+ if (idev) {
+ int changed = (!idev->cnf.forwarding) ^ (!newf);
+@@ -503,7 +502,6 @@ static void addrconf_forward_change(stru
+ dev_forward_change(idev);
+ }
+ }
+- rcu_read_unlock();
+ }
+
+ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
+From ce43fdf08181ec04357cd52eab4668bcd80d3424 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:44 +0000
+Subject: atm: fix info leak in getsockopt(SO_ATMPVC)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit e862f1a9b7df4e8196ebec45ac62295138aa3fc2 ]
+
+The ATM code fails to initialize the two padding bytes of struct
+sockaddr_atmpvc inserted for alignment. Add an explicit memset(0)
+before filling the structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/atm/common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/atm/common.c
++++ b/net/atm/common.c
+@@ -812,6 +812,7 @@ int vcc_getsockopt(struct socket *sock,
+
+ if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
+ return -ENOTCONN;
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = vcc->dev->number;
+ pvc.sap_addr.vpi = vcc->vpi;
+From 728ddd57f43fe7bbf9b3486d1622bb16aa8e0f02 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:45 +0000
+Subject: atm: fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a ]
+
+The ATM code fails to initialize the two padding bytes of struct
+sockaddr_atmpvc inserted for alignment. Add an explicit memset(0)
+before filling the structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/atm/pvc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/atm/pvc.c
++++ b/net/atm/pvc.c
+@@ -95,6 +95,7 @@ static int pvc_getname(struct socket *so
+ return -ENOTCONN;
+ *sockaddr_len = sizeof(struct sockaddr_atmpvc);
+ addr = (struct sockaddr_atmpvc *)sockaddr;
++ memset(addr, 0, sizeof(*addr));
+ addr->sap_family = AF_ATMPVC;
+ addr->sap_addr.itf = vcc->dev->number;
+ addr->sap_addr.vpi = vcc->vpi;
+From f922ac54143cd628dda10bc682e1dfce674eaeb8 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:46 +0000
+Subject: Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit e15ca9a0ef9a86f0477530b0f44a725d67f889ee ]
+
+The HCI code fails to initialize the two padding bytes of struct
+hci_ufilter before copying it to userland -- that for leaking two
+bytes kernel stack. Add an explicit memset(0) before filling the
+structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/hci_sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -1016,6 +1016,7 @@ static int hci_sock_getsockopt(struct so
+ {
+ struct hci_filter *f = &hci_pi(sk)->filter;
+
++ memset(&uf, 0, sizeof(uf));
+ uf.type_mask = f->type_mask;
+ uf.opcode = f->opcode;
+ uf.event_mask[0] = *((u32 *) f->event_mask + 0);
+From bb9c32102505b6d7a3f3f4a97cacf67b75588046 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:47 +0000
+Subject: Bluetooth: HCI - Fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 3f68ba07b1da811bf383b4b701b129bfcb2e4988 ]
+
+The HCI code fails to initialize the hci_channel member of struct
+sockaddr_hci and that for leaks two bytes kernel stack via the
+getsockname() syscall. Initialize hci_channel with 0 to avoid the
+info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/hci_sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -706,6 +706,7 @@ static int hci_sock_getname(struct socke
+ *addr_len = sizeof(*haddr);
+ haddr->hci_family = AF_BLUETOOTH;
+ haddr->hci_dev = hdev->id;
++ haddr->hci_channel= 0;
+
+ release_sock(sk);
+ return 0;
+From fbd3ba1637931cd8a8e934f234ae79b50e22e5d4 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:48 +0000
+Subject: Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 9ad2de43f1aee7e7274a4e0d41465489299e344b ]
+
+The RFCOMM code fails to initialize the key_size member of struct
+bt_security before copying it to userland -- that for leaking one
+byte kernel stack. Initialize key_size with 0 to avoid the info
+leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/rfcomm/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -841,6 +841,7 @@ static int rfcomm_sock_getsockopt(struct
+ }
+
+ sec.level = rfcomm_pi(sk)->sec_level;
++ sec.key_size = 0;
+
+ len = min_t(unsigned int, len, sizeof(sec));
+ if (copy_to_user(optval, (char *) &sec, len))
+From 2ef6d025b5b062c6ad6926edd149323b1da27f55 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:49 +0000
+Subject: Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a ]
+
+The RFCOMM code fails to initialize the two padding bytes of struct
+rfcomm_dev_list_req inserted for alignment before copying it to
+userland. Additionally there are two padding bytes in each instance of
+struct rfcomm_dev_info. The ioctl() that for disclosures two bytes plus
+dev_num times two bytes uninitialized kernel heap memory.
+
+Allocate the memory using kzalloc() to fix this issue.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/rfcomm/tty.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bluetooth/rfcomm/tty.c
++++ b/net/bluetooth/rfcomm/tty.c
+@@ -461,7 +461,7 @@ static int rfcomm_get_dev_list(void __us
+
+ size = sizeof(*dl) + dev_num * sizeof(*di);
+
+- dl = kmalloc(size, GFP_KERNEL);
++ dl = kzalloc(size, GFP_KERNEL);
+ if (!dl)
+ return -ENOMEM;
+
+From 16ddf8d8c926d2c4d886a33608d43e47426edb48 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:50 +0000
+Subject: Bluetooth: RFCOMM - Fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 9344a972961d1a6d2c04d9008b13617bcb6ec2ef ]
+
+The RFCOMM code fails to initialize the trailing padding byte of struct
+sockaddr_rc added for alignment. It that for leaks one byte kernel stack
+via the getsockname() syscall. Add an explicit memset(0) before filling
+the structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/rfcomm/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -547,6 +547,7 @@ static int rfcomm_sock_getname(struct so
+
+ BT_DBG("sock %p, sk %p", sock, sk);
+
++ memset(sa, 0, sizeof(*sa));
+ sa->rc_family = AF_BLUETOOTH;
+ sa->rc_channel = rfcomm_pi(sk)->channel;
+ if (peer)
+From b902fc94a9bbb206b63a5841970a7aa853926618 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:51 +0000
+Subject: Bluetooth: L2CAP - Fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 792039c73cf176c8e39a6e8beef2c94ff46522ed ]
+
+The L2CAP code fails to initialize the l2_bdaddr_type member of struct
+sockaddr_l2 and the padding byte added for alignment. It that for leaks
+two bytes kernel stack via the getsockname() syscall. Add an explicit
+memset(0) before filling the structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Marcel Holtmann <marcel at holtmann.org>
+Cc: Gustavo Padovan <gustavo at padovan.org>
+Cc: Johan Hedberg <johan.hedberg at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/bluetooth/l2cap_sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -246,6 +246,7 @@ static int l2cap_sock_getname(struct soc
+
+ BT_DBG("sock %p, sk %p", sock, sk);
+
++ memset(la, 0, sizeof(struct sockaddr_l2));
+ addr->sa_family = AF_BLUETOOTH;
+ *len = sizeof(struct sockaddr_l2);
+
+From c2a22a136f3fedc20e23349a52256c4eb489c47f Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:52 +0000
+Subject: l2tp: fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 04d4fbca1017c11381e7d82acea21dd741e748bc ]
+
+The L2TP code for IPv6 fails to initialize the l2tp_unused member of
+struct sockaddr_l2tpip6 and that for leaks two bytes kernel stack via
+the getsockname() syscall. Initialize l2tp_unused with 0 to avoid the
+info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: James Chapman <jchapman at katalix.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/l2tp/l2tp_ip6.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -410,6 +410,7 @@ static int l2tp_ip6_getname(struct socke
+ lsa->l2tp_family = AF_INET6;
+ lsa->l2tp_flowinfo = 0;
+ lsa->l2tp_scope_id = 0;
++ lsa->l2tp_unused = 0;
+ if (peer) {
+ if (!lsk->peer_conn_id)
+ return -ENOTCONN;
+From 15967b68adbcfa836663ae9fa5f201270377af03 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:53 +0000
+Subject: llc: fix info leak via getsockname()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 3592aaeb80290bda0f2cf0b5456c97bfc638b192 ]
+
+The LLC code wrongly returns 0, i.e. "success", when the socket is
+zapped. Together with the uninitialized uaddrlen pointer argument from
+sys_getsockname this leads to an arbitrary memory leak of up to 128
+bytes kernel stack via the getsockname() syscall.
+
+Return an error instead when the socket is zapped to prevent the info
+leak. Also remove the unnecessary memset(0). We don't directly write to
+the memory pointed by uaddr but memcpy() a local structure at the end of
+the function that is properly initialized.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Arnaldo Carvalho de Melo <acme at ghostprotocols.net>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/llc/af_llc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -969,14 +969,13 @@ static int llc_ui_getname(struct socket
+ struct sockaddr_llc sllc;
+ struct sock *sk = sock->sk;
+ struct llc_sock *llc = llc_sk(sk);
+- int rc = 0;
++ int rc = -EBADF;
+
+ memset(&sllc, 0, sizeof(sllc));
+ lock_sock(sk);
+ if (sock_flag(sk, SOCK_ZAPPED))
+ goto out;
+ *uaddrlen = sizeof(sllc);
+- memset(uaddr, 0, *uaddrlen);
+ if (peer) {
+ rc = -ENOTCONN;
+ if (sk->sk_state != TCP_ESTABLISHED)
+From 9c61250e1c8771a3afa7708b24c0fb742d78382d Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:55 +0000
+Subject: dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 7b07f8eb75aa3097cdfd4f6eac3da49db787381d ]
+
+The CCID3 code fails to initialize the trailing padding bytes of struct
+tfrc_tx_info added for alignment on 64 bit architectures. It that for
+potentially leaks four bytes kernel stack via the getsockopt() syscall.
+Add an explicit memset(0) before filling the structure to avoid the
+info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Gerrit Renker <gerrit at erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/dccp/ccids/ccid3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/dccp/ccids/ccid3.c
++++ b/net/dccp/ccids/ccid3.c
+@@ -531,6 +531,7 @@ static int ccid3_hc_tx_getsockopt(struct
+ case DCCP_SOCKOPT_CCID_TX_INFO:
+ if (len < sizeof(tfrc))
+ return -EINVAL;
++ memset(&tfrc, 0, sizeof(tfrc));
+ tfrc.tfrctx_x = hc->tx_x;
+ tfrc.tfrctx_x_recv = hc->tx_x_recv;
+ tfrc.tfrctx_x_calc = hc->tx_x_calc;
+From fb6087cf23d6356d3852b7e2a83a090839b20595 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:56 +0000
+Subject: ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 2d8a041b7bfe1097af21441cb77d6af95f4f4680 ]
+
+If at least one of CONFIG_IP_VS_PROTO_TCP or CONFIG_IP_VS_PROTO_UDP is
+not set, __ip_vs_get_timeouts() does not fully initialize the structure
+that gets copied to userland and that for leaks up to 12 bytes of kernel
+stack. Add an explicit memset(0) before passing the structure to
+__ip_vs_get_timeouts() to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Cc: Wensong Zhang <wensong at linux-vs.org>
+Cc: Simon Horman <horms at verge.net.au>
+Cc: Julian Anastasov <ja at ssi.bg>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/netfilter/ipvs/ip_vs_ctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -2759,6 +2759,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
+ {
+ struct ip_vs_timeout_user t;
+
++ memset(&t, 0, sizeof(t));
+ __ip_vs_get_timeouts(net, &t);
+ if (copy_to_user(user, &t, sizeof(t)) != 0)
+ ret = -EFAULT;
+From c8e371d87129cf9bad8c9d765d6a5b3eb938c5f9 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli at googlemail.com>
+Date: Wed, 15 Aug 2012 11:31:57 +0000
+Subject: net: fix info leak in compat dev_ifconf()
+
+
+From: Mathias Krause <minipli at googlemail.com>
+
+[ Upstream commit 43da5f2e0d0c69ded3d51907d9552310a6b545e8 ]
+
+The implementation of dev_ifconf() for the compat ioctl interface uses
+an intermediate ifc structure allocated in userland for the duration of
+the syscall. Though, it fails to initialize the padding bytes inserted
+for alignment and that for leaks four bytes of kernel stack. Add an
+explicit memset(0) before filling the structure to avoid the info leak.
+
+Signed-off-by: Mathias Krause <minipli at googlemail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2658,6 +2658,7 @@ static int dev_ifconf(struct net *net, s
+ if (copy_from_user(&ifc32, uifc32, sizeof(struct compat_ifconf)))
+ return -EFAULT;
+
++ memset(&ifc, 0, sizeof(ifc));
+ if (ifc32.ifcbuf == 0) {
+ ifc32.ifc_len = 0;
+ ifc.ifc_len = 0;
+From 7756088c98170a42a89287d32f89bfcec5863ffe Mon Sep 17 00:00:00 2001
+From: Eric Leblond <eric at regit.org>
+Date: Thu, 16 Aug 2012 22:02:58 +0000
+Subject: af_packet: don't emit packet on orig fanout group
+
+
+From: Eric Leblond <eric at regit.org>
+
+[ Upstream commit c0de08d04215031d68fa13af36f347a6cfa252ca ]
+
+If a packet is emitted on one socket in one group of fanout sockets,
+it is transmitted again. It is thus read again on one of the sockets
+of the fanout group. This result in a loop for software which
+generate packets when receiving one.
+This retransmission is not the intended behavior: a fanout group
+must behave like a single socket. The packet should not be
+transmitted on a socket if it originates from a socket belonging
+to the same fanout group.
+
+This patch fixes the issue by changing the transmission check to
+take fanout group info account.
+
+Reported-by: Aleksandr Kotov <a1k at mail.ru>
+Signed-off-by: Eric Leblond <eric at regit.org>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/linux/netdevice.h | 2 ++
+ net/core/dev.c | 16 ++++++++++++++--
+ net/packet/af_packet.c | 9 +++++++++
+ 3 files changed, 25 insertions(+), 2 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1520,6 +1520,8 @@ struct packet_type {
+ struct sk_buff **(*gro_receive)(struct sk_buff **head,
+ struct sk_buff *skb);
+ int (*gro_complete)(struct sk_buff *skb);
++ bool (*id_match)(struct packet_type *ptype,
++ struct sock *sk);
+ void *af_packet_priv;
+ struct list_head list;
+ };
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1640,6 +1640,19 @@ static inline int deliver_skb(struct sk_
+ return pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
+ }
+
++static inline bool skb_loop_sk(struct packet_type *ptype, struct sk_buff *skb)
++{
++ if (ptype->af_packet_priv == NULL)
++ return false;
++
++ if (ptype->id_match)
++ return ptype->id_match(ptype, skb->sk);
++ else if ((struct sock *)ptype->af_packet_priv == skb->sk)
++ return true;
++
++ return false;
++}
++
+ /*
+ * Support routine. Sends outgoing frames to any network
+ * taps currently in use.
+@@ -1657,8 +1670,7 @@ static void dev_queue_xmit_nit(struct sk
+ * they originated from - MvS (miquels at drinkel.ow.org)
+ */
+ if ((ptype->dev == dev || !ptype->dev) &&
+- (ptype->af_packet_priv == NULL ||
+- (struct sock *)ptype->af_packet_priv != skb->sk)) {
++ (!skb_loop_sk(ptype, skb))) {
+ if (pt_prev) {
+ deliver_skb(skb2, pt_prev, skb->dev);
+ pt_prev = ptype;
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1280,6 +1280,14 @@ static void __fanout_unlink(struct sock
+ spin_unlock(&f->lock);
+ }
+
++bool match_fanout_group(struct packet_type *ptype, struct sock * sk)
++{
++ if (ptype->af_packet_priv == (void*)((struct packet_sock *)sk)->fanout)
++ return true;
++
++ return false;
++}
++
+ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ {
+ struct packet_sock *po = pkt_sk(sk);
+@@ -1332,6 +1340,7 @@ static int fanout_add(struct sock *sk, u
+ match->prot_hook.dev = po->prot_hook.dev;
+ match->prot_hook.func = packet_rcv_fanout;
+ match->prot_hook.af_packet_priv = match;
++ match->prot_hook.id_match = match_fanout_group;
+ dev_add_pack(&match->prot_hook);
+ list_add(&match->list, &fanout_list);
+ }
+From 77c368502ce5496996462f232ea6e89c274d7e26 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet at google.com>
+Date: Tue, 21 Aug 2012 06:21:17 +0000
+Subject: af_netlink: force credentials passing [CVE-2012-3520]
+
+
+From: Eric Dumazet <edumazet at google.com>
+
+[ Upstream commit e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea ]
+
+Pablo Neira Ayuso discovered that avahi and
+potentially NetworkManager accept spoofed Netlink messages because of a
+kernel bug. The kernel passes all-zero SCM_CREDENTIALS ancillary data
+to the receiver if the sender did not provide such data, instead of not
+including any such data at all or including the correct data from the
+peer (as it is the case with AF_UNIX).
+
+This bug was introduced in commit 16e572626961
+(af_unix: dont send SCM_CREDENTIALS by default)
+
+This patch forces passing credentials for netlink, as
+before the regression.
+
+Another fix would be to not add SCM_CREDENTIALS in
+netlink messages if not provided by the sender, but it
+might break some programs.
+
+With help from Florian Weimer & Petr Matousek
+
+This issue is designated as CVE-2012-3520
+
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Cc: Petr Matousek <pmatouse at redhat.com>
+Cc: Florian Weimer <fweimer at redhat.com>
+Cc: Pablo Neira Ayuso <pablo at netfilter.org>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/net/scm.h | 4 +++-
+ net/netlink/af_netlink.c | 2 +-
+ net/unix/af_unix.c | 4 ++--
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -71,9 +71,11 @@ static __inline__ void scm_destroy(struc
+ }
+
+ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
+- struct scm_cookie *scm)
++ struct scm_cookie *scm, bool forcecreds)
+ {
+ memset(scm, 0, sizeof(*scm));
++ if (forcecreds)
++ scm_set_cred(scm, task_tgid(current), current_cred());
+ unix_get_peersec_dgram(sock, scm);
+ if (msg->msg_controllen <= 0)
+ return 0;
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1344,7 +1344,7 @@ static int netlink_sendmsg(struct kiocb
+ if (NULL == siocb->scm)
+ siocb->scm = &scm;
+
+- err = scm_send(sock, msg, siocb->scm);
++ err = scm_send(sock, msg, siocb->scm, true);
+ if (err < 0)
+ return err;
+
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1448,7 +1448,7 @@ static int unix_dgram_sendmsg(struct kio
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+ wait_for_unix_gc();
+- err = scm_send(sock, msg, siocb->scm);
++ err = scm_send(sock, msg, siocb->scm, false);
+ if (err < 0)
+ return err;
+
+@@ -1617,7 +1617,7 @@ static int unix_stream_sendmsg(struct ki
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+ wait_for_unix_gc();
+- err = scm_send(sock, msg, siocb->scm);
++ err = scm_send(sock, msg, siocb->scm, false);
+ if (err < 0)
+ return err;
+
+From 85fdd856a3c5e2e20a8e34c29268e6e18f2dd01e Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo at netfilter.org>
+Date: Thu, 23 Aug 2012 02:09:11 +0000
+Subject: netlink: fix possible spoofing from non-root processes
+
+
+From: Pablo Neira Ayuso <pablo at netfilter.org>
+
+[ Upstream commit 20e1db19db5d6b9e4e83021595eab0dc8f107bef ]
+
+Non-root user-space processes can send Netlink messages to other
+processes that are well-known for being subscribed to Netlink
+asynchronous notifications. This allows ilegitimate non-root
+process to send forged messages to Netlink subscribers.
+
+The userspace process usually verifies the legitimate origin in
+two ways:
+
+a) Socket credentials. If UID != 0, then the message comes from
+ some ilegitimate process and the message needs to be dropped.
+
+b) Netlink portID. In general, portID == 0 means that the origin
+ of the messages comes from the kernel. Thus, discarding any
+ message not coming from the kernel.
+
+However, ctnetlink sets the portID in event messages that has
+been triggered by some user-space process, eg. conntrack utility.
+So other processes subscribed to ctnetlink events, eg. conntrackd,
+know that the event was triggered by some user-space action.
+
+Neither of the two ways to discard ilegitimate messages coming
+from non-root processes can help for ctnetlink.
+
+This patch adds capability validation in case that dst_pid is set
+in netlink_sendmsg(). This approach is aggressive since existing
+applications using any Netlink bus to deliver messages between
+two user-space processes will break. Note that the exception is
+NETLINK_USERSOCK, since it is reserved for netlink-to-netlink
+userspace communication.
+
+Still, if anyone wants that his Netlink bus allows netlink-to-netlink
+userspace, then they can set NL_NONROOT_SEND. However, by default,
+I don't think it makes sense to allow to use NETLINK_ROUTE to
+communicate two processes that are sending no matter what information
+that is not related to link/neighbouring/routing. They should be using
+NETLINK_USERSOCK instead for that.
+
+Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/netlink/af_netlink.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1355,7 +1355,8 @@ static int netlink_sendmsg(struct kiocb
+ dst_pid = addr->nl_pid;
+ dst_group = ffs(addr->nl_groups);
+ err = -EPERM;
+- if (dst_group && !netlink_capable(sock, NL_NONROOT_SEND))
++ if ((dst_group || dst_pid) &&
++ !netlink_capable(sock, NL_NONROOT_SEND))
+ goto out;
+ } else {
+ dst_pid = nlk->dst_pid;
+@@ -2124,6 +2125,7 @@ static void __init netlink_add_usersock_
+ rcu_assign_pointer(nl_table[NETLINK_USERSOCK].listeners, listeners);
+ nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
+ nl_table[NETLINK_USERSOCK].registered = 1;
++ nl_table[NETLINK_USERSOCK].nl_nonroot = NL_NONROOT_SEND;
+
+ netlink_table_ungrab();
+ }
+From 24baff9a467fac676343e7070fac3f2f8b36da07 Mon Sep 17 00:00:00 2001
+From: Yuchung Cheng <ycheng at google.com>
+Date: Thu, 23 Aug 2012 07:05:17 +0000
+Subject: tcp: fix cwnd reduction for non-sack recovery
+
+
+From: Yuchung Cheng <ycheng at google.com>
+
+[ Upstream commit 7c4a56fec379ac0d7754e0d4da6a7361f1a4fe64 ]
+
+The cwnd reduction in fast recovery is based on the number of packets
+newly delivered per ACK. For non-sack connections every DUPACK
+signifies a packet has been delivered, but the sender mistakenly
+skips counting them for cwnd reduction.
+
+The fix is to compute newly_acked_sacked after DUPACKs are accounted
+in sacked_out for non-sack connections.
+
+Signed-off-by: Yuchung Cheng <ycheng at google.com>
+Acked-by: Nandita Dukkipati <nanditad at google.com>
+Acked-by: Neal Cardwell <ncardwell at google.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/ipv4/tcp_input.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3107,13 +3107,14 @@ static void tcp_enter_recovery(struct so
+ * tcp_xmit_retransmit_queue().
+ */
+ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
+- int newly_acked_sacked, bool is_dupack,
++ int prior_sacked, bool is_dupack,
+ int flag)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
+ int do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
+ (tcp_fackets_out(tp) > tp->reordering));
++ int newly_acked_sacked = 0;
+ int fast_rexmit = 0;
+
+ if (WARN_ON(!tp->packets_out && tp->sacked_out))
+@@ -3173,6 +3174,7 @@ static void tcp_fastretrans_alert(struct
+ tcp_add_reno_sack(sk);
+ } else
+ do_lost = tcp_try_undo_partial(sk, pkts_acked);
++ newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
+ break;
+ case TCP_CA_Loss:
+ if (flag & FLAG_DATA_ACKED)
+@@ -3194,6 +3196,7 @@ static void tcp_fastretrans_alert(struct
+ if (is_dupack)
+ tcp_add_reno_sack(sk);
+ }
++ newly_acked_sacked = pkts_acked + tp->sacked_out - prior_sacked;
+
+ if (icsk->icsk_ca_state <= TCP_CA_Disorder)
+ tcp_try_undo_dsack(sk);
+@@ -3771,7 +3774,6 @@ static int tcp_ack(struct sock *sk, cons
+ int prior_packets;
+ int prior_sacked = tp->sacked_out;
+ int pkts_acked = 0;
+- int newly_acked_sacked = 0;
+ bool frto_cwnd = false;
+
+ /* If the ack is older than previous acks
+@@ -3847,8 +3849,6 @@ static int tcp_ack(struct sock *sk, cons
+ flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una);
+
+ pkts_acked = prior_packets - tp->packets_out;
+- newly_acked_sacked = (prior_packets - prior_sacked) -
+- (tp->packets_out - tp->sacked_out);
+
+ if (tp->frto_counter)
+ frto_cwnd = tcp_process_frto(sk, flag);
+@@ -3862,7 +3862,7 @@ static int tcp_ack(struct sock *sk, cons
+ tcp_may_raise_cwnd(sk, flag))
+ tcp_cong_avoid(sk, ack, prior_in_flight);
+ is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
+- tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
++ tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
+ is_dupack, flag);
+ } else {
+ if ((flag & FLAG_DATA_ACKED) && !frto_cwnd)
+@@ -3877,7 +3877,7 @@ static int tcp_ack(struct sock *sk, cons
+ no_queue:
+ /* If data was DSACKed, see if we can undo a cwnd reduction. */
+ if (flag & FLAG_DSACKING_ACK)
+- tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
++ tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
+ is_dupack, flag);
+ /* If this ack opens up a zero window, clear backoff. It was
+ * being used to time the probes, and is probably far higher than
+@@ -3897,8 +3897,7 @@ old_ack:
+ */
+ if (TCP_SKB_CB(skb)->sacked) {
+ flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una);
+- newly_acked_sacked = tp->sacked_out - prior_sacked;
+- tcp_fastretrans_alert(sk, pkts_acked, newly_acked_sacked,
++ tcp_fastretrans_alert(sk, pkts_acked, prior_sacked,
+ is_dupack, flag);
+ }
+
+From 39ccdade2c87b83383c5832ea37ed0d17c427248 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings at solarflare.com>
+Date: Wed, 15 Aug 2012 18:09:15 +0100
+Subject: sfc: Fix reporting of IPv4 full filters through ethtool
+
+
+From: Ben Hutchings <bhutchings at solarflare.com>
+
+[ Upstream commit ac70b2e9a13423b5efa0178e081936ce6979aea5 ]
+
+ETHTOOL_GRXCLSRULE returns filters for a TCP/IPv4 or UDP/IPv4 4-tuple
+with source and destination swapped.
+
+Signed-off-by: Ben Hutchings <bhutchings at solarflare.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/sfc/ethtool.c
++++ b/drivers/net/ethernet/sfc/ethtool.c
+@@ -863,8 +863,8 @@ static int efx_ethtool_get_class_rule(st
+ &ip_entry->ip4dst, &ip_entry->pdst);
+ if (rc != 0) {
+ rc = efx_filter_get_ipv4_full(
+- &spec, &proto, &ip_entry->ip4src, &ip_entry->psrc,
+- &ip_entry->ip4dst, &ip_entry->pdst);
++ &spec, &proto, &ip_entry->ip4dst, &ip_entry->pdst,
++ &ip_entry->ip4src, &ip_entry->psrc);
+ EFX_WARN_ON_PARANOID(rc);
+ ip_mask->ip4src = ~0;
+ ip_mask->psrc = ~0;
+From 7cb4850eb37c3957bc80893ee078cb9073bfa165 Mon Sep 17 00:00:00 2001
+From: Claudiu Manoil <claudiu.manoil at freescale.com>
+Date: Thu, 23 Aug 2012 21:46:25 +0000
+Subject: gianfar: fix default tx vlan offload feature flag
+
+
+From: Claudiu Manoil <claudiu.manoil at freescale.com>
+
+[ Upstream commit e2c53be223aca36cf93eb6a0f6bafa079e78f52b ]
+
+Commit -
+"b852b72 gianfar: fix bug caused by
+87c288c6e9aa31720b72e2bc2d665e24e1653c3e"
+disables by default (on mac init) the hw vlan tag insertion.
+The "features" flags were not updated to reflect this, and
+"ethtool -K" shows tx-vlan-offload to be "on" by default.
+
+Cc: Sebastian Poehn <sebastian.poehn at belden.com>
+Signed-off-by: Claudiu Manoil <claudiu.manoil at freescale.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1037,7 +1037,7 @@ static int gfar_probe(struct platform_de
+
+ if (priv->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
+ dev->hw_features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+- dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
++ dev->features |= NETIF_F_HW_VLAN_RX;
+ }
+
+ if (priv->device_flags & FSL_GIANFAR_DEV_HAS_EXTENDED_HASH) {
+From f48305cbef36e65b5ef0d9c394768a6601cfe5b9 Mon Sep 17 00:00:00 2001
+From: "xeb at mail.ru" <xeb at mail.ru>
+Date: Fri, 24 Aug 2012 01:07:38 +0000
+Subject: l2tp: avoid to use synchronize_rcu in tunnel free function
+
+
+From: "xeb at mail.ru" <xeb at mail.ru>
+
+[ Upstream commit 99469c32f79a32d8481f87be0d3c66dad286f4ec ]
+
+Avoid to use synchronize_rcu in l2tp_tunnel_free because context may be
+atomic.
+
+Signed-off-by: Dmitry Kozlov <xeb at mail.ru>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/l2tp/l2tp_core.c | 3 +--
+ net/l2tp/l2tp_core.h | 1 +
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1346,11 +1346,10 @@ static void l2tp_tunnel_free(struct l2tp
+ /* Remove from tunnel list */
+ spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+ list_del_rcu(&tunnel->list);
++ kfree_rcu(tunnel, rcu);
+ spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+- synchronize_rcu();
+
+ atomic_dec(&l2tp_tunnel_count);
+- kfree(tunnel);
+ }
+
+ /* Create a socket for the tunnel, if one isn't set up by
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -163,6 +163,7 @@ struct l2tp_tunnel_cfg {
+
+ struct l2tp_tunnel {
+ int magic; /* Should be L2TP_TUNNEL_MAGIC */
++ struct rcu_head rcu;
+ rwlock_t hlist_lock; /* protect session_hlist */
+ struct hlist_head session_hlist[L2TP_HASH_SIZE];
+ /* hashed list of sessions,
+From 6879e6e89b5331040673e8f65dc0a15fcb7e62fd Mon Sep 17 00:00:00 2001
+From: Francesco Ruggeri <fruggeri at aristanetworks.com>
+Date: Fri, 24 Aug 2012 07:38:35 +0000
+Subject: net: ipv4: ipmr_expire_timer causes crash when removing net namespace
+
+
+From: Francesco Ruggeri <fruggeri at aristanetworks.com>
+
+[ Upstream commit acbb219d5f53821b2d0080d047800410c0420ea1 ]
+
+When tearing down a net namespace, ipv4 mr_table structures are freed
+without first deactivating their timers. This can result in a crash in
+run_timer_softirq.
+This patch mimics the corresponding behaviour in ipv6.
+Locking and synchronization seem to be adequate.
+We are about to kfree mrt, so existing code should already make sure that
+no other references to mrt are pending or can be created by incoming traffic.
+The functions invoked here do not cause new references to mrt or other
+race conditions to be created.
+Invoking del_timer_sync guarantees that ipmr_expire_timer is inactive.
+Both ipmr_expire_process (whose completion we may have to wait in
+del_timer_sync) and mroute_clean_tables internally use mfc_unres_lock
+or other synchronizations when needed, and they both only modify mrt.
+
+Tested in Linux 3.4.8.
+
+Signed-off-by: Francesco Ruggeri <fruggeri at aristanetworks.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/ipv4/ipmr.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -124,6 +124,8 @@ static DEFINE_SPINLOCK(mfc_unres_lock);
+ static struct kmem_cache *mrt_cachep __read_mostly;
+
+ static struct mr_table *ipmr_new_table(struct net *net, u32 id);
++static void ipmr_free_table(struct mr_table *mrt);
++
+ static int ip_mr_forward(struct net *net, struct mr_table *mrt,
+ struct sk_buff *skb, struct mfc_cache *cache,
+ int local);
+@@ -131,6 +133,7 @@ static int ipmr_cache_report(struct mr_t
+ struct sk_buff *pkt, vifi_t vifi, int assert);
+ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+ struct mfc_cache *c, struct rtmsg *rtm);
++static void mroute_clean_tables(struct mr_table *mrt);
+ static void ipmr_expire_process(unsigned long arg);
+
+ #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+@@ -271,7 +274,7 @@ static void __net_exit ipmr_rules_exit(s
+
+ list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
+ list_del(&mrt->list);
+- kfree(mrt);
++ ipmr_free_table(mrt);
+ }
+ fib_rules_unregister(net->ipv4.mr_rules_ops);
+ }
+@@ -299,7 +302,7 @@ static int __net_init ipmr_rules_init(st
+
+ static void __net_exit ipmr_rules_exit(struct net *net)
+ {
+- kfree(net->ipv4.mrt);
++ ipmr_free_table(net->ipv4.mrt);
+ }
+ #endif
+
+@@ -336,6 +339,13 @@ static struct mr_table *ipmr_new_table(s
+ return mrt;
+ }
+
++static void ipmr_free_table(struct mr_table *mrt)
++{
++ del_timer_sync(&mrt->ipmr_expire_timer);
++ mroute_clean_tables(mrt);
++ kfree(mrt);
++}
++
+ /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
+
+ static void ipmr_del_tunnel(struct net_device *dev, struct vifctl *v)
+From 04c43d45d82e21b0ea77a15823c875d5ac9c3d15 Mon Sep 17 00:00:00 2001
+From: Yuval Mintz <yuvalmin at broadcom.com>
+Date: Sun, 26 Aug 2012 00:35:45 +0000
+Subject: bnx2x: fix 57840_MF pci id
+
+
+From: Yuval Mintz <yuvalmin at broadcom.com>
+
+[ Upstream commit 5c879d2094946081af934739850c7260e8b25d3c ]
+
+Commit c3def943c7117d42caaed3478731ea7c3c87190e have added support for
+new pci ids of the 57840 board, while failing to change the obsolete value
+in 'pci_ids.h'.
+This patch does so, allowing the probe of such devices.
+
+Signed-off-by: Yuval Mintz <yuvalmin at broadcom.com>
+Signed-off-by: Eilon Greenstein <eilong at broadcom.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ include/linux/pci_ids.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2148,7 +2148,7 @@
+ #define PCI_DEVICE_ID_TIGON3_5704S 0x16a8
+ #define PCI_DEVICE_ID_NX2_57800_VF 0x16a9
+ #define PCI_DEVICE_ID_NX2_5706S 0x16aa
+-#define PCI_DEVICE_ID_NX2_57840_MF 0x16ab
++#define PCI_DEVICE_ID_NX2_57840_MF 0x16a4
+ #define PCI_DEVICE_ID_NX2_5708S 0x16ac
+ #define PCI_DEVICE_ID_NX2_57840_VF 0x16ad
+ #define PCI_DEVICE_ID_NX2_57810_MF 0x16ae
+From 05ee0f138d368dbf7951e46c1819a83deec5c8d8 Mon Sep 17 00:00:00 2001
+From: Jaccon Bastiaansen <jaccon.bastiaansen at gmail.com>
+Date: Mon, 27 Aug 2012 11:53:51 +0000
+Subject: cs89x0 : packet reception not working
+
+
+From: Jaccon Bastiaansen <jaccon.bastiaansen at gmail.com>
+
+[ Upstream commit b72c200975a4ed579dbf3353019e19528745a29a ]
+
+The RxCFG register of the CS89x0 could be configured incorrectly
+(because of misplaced parentheses), resulting in the disabling
+of packet reception.
+
+Signed-off-by: Jaccon Bastiaansen <jaccon.bastiaansen at gmail.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ drivers/net/ethernet/cirrus/cs89x0.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/cirrus/cs89x0.c
++++ b/drivers/net/ethernet/cirrus/cs89x0.c
+@@ -1243,6 +1243,7 @@ static void set_multicast_list(struct ne
+ {
+ struct net_local *lp = netdev_priv(dev);
+ unsigned long flags;
++ u16 cfg;
+
+ spin_lock_irqsave(&lp->lock, flags);
+ if (dev->flags & IFF_PROMISC)
+@@ -1260,11 +1261,10 @@ static void set_multicast_list(struct ne
+ /* in promiscuous mode, we accept errored packets,
+ * so we have to enable interrupts on them also
+ */
+- writereg(dev, PP_RxCFG,
+- (lp->curr_rx_cfg |
+- (lp->rx_mode == RX_ALL_ACCEPT)
+- ? (RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL)
+- : 0));
++ cfg = lp->curr_rx_cfg;
++ if (lp->rx_mode == RX_ALL_ACCEPT)
++ cfg |= RX_CRC_ERROR_ENBL | RX_RUNT_ENBL | RX_EXTRA_DATA_ENBL;
++ writereg(dev, PP_RxCFG, cfg);
+ spin_unlock_irqrestore(&lp->lock, flags);
+ }
+
+From 802de090dee2eb363027e6634a3740877d45b972 Mon Sep 17 00:00:00 2001
+From: Jesse Gross <jesse at nicira.com>
+Date: Fri, 25 May 2012 11:29:30 -0700
+Subject: openvswitch: Reset upper layer protocol info on internal devices.
+
+
+From: Jesse Gross <jesse at nicira.com>
+
+[ Upstream commit 7fe99e2d434eafeac0c57b279a77e5de39212636 ]
+
+It's possible that packets that are sent on internal devices (from
+the OVS perspective) have already traversed the local IP stack.
+After they go through the internal device, they will again travel
+through the IP stack which may get confused by the presence of
+existing information in the skb. The problem can be observed
+when switching between namespaces. This clears out that information
+to avoid problems but deliberately leaves other metadata alone.
+This is to provide maximum flexibility in chaining together OVS
+and other Linux components.
+
+Signed-off-by: Jesse Gross <jesse at nicira.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+ net/openvswitch/vport-internal_dev.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/net/openvswitch/vport-internal_dev.c
++++ b/net/openvswitch/vport-internal_dev.c
+@@ -24,6 +24,9 @@
+ #include <linux/ethtool.h>
+ #include <linux/skbuff.h>
+
++#include <net/dst.h>
++#include <net/xfrm.h>
++
+ #include "datapath.h"
+ #include "vport-internal_dev.h"
+ #include "vport-netdev.h"
+@@ -209,6 +212,11 @@ static int internal_dev_recv(struct vpor
+ int len;
+
+ len = skb->len;
++
++ skb_dst_drop(skb);
++ nf_reset(skb);
++ secpath_reset(skb);
++
+ skb->dev = netdev;
+ skb->pkt_type = PACKET_HOST;
+ skb->protocol = eth_type_trans(skb, netdev);
+From ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj at kernel.org>
+Date: Tue, 18 Sep 2012 12:48:43 -0700
+Subject: workqueue: reimplement work_on_cpu() using system_wq
+
+From: Tejun Heo <tj at kernel.org>
+
+commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.
+
+The existing work_on_cpu() implementation is hugely inefficient. It
+creates a new kthread, execute that single function and then let the
+kthread die on each invocation.
+
+Now that system_wq can handle concurrent executions, there's no
+advantage of doing this. Reimplement work_on_cpu() using system_wq
+which makes it simpler and way more efficient.
+
+stable: While this isn't a fix in itself, it's needed to fix a
+ workqueue related bug in cpufreq/powernow-k8. AFAICS, this
+ shouldn't break other existing users.
+
+Signed-off-by: Tejun Heo <tj at kernel.org>
+Acked-by: Jiri Kosina <jkosina at suse.cz>
+Cc: Linus Torvalds <torvalds at linux-foundation.org>
+Cc: Bjorn Helgaas <bhelgaas at google.com>
+Cc: Len Brown <lenb at kernel.org>
+Cc: Rafael J. Wysocki <rjw at sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3628,18 +3628,17 @@ static int __devinit workqueue_cpu_down_
+ #ifdef CONFIG_SMP
+
+ struct work_for_cpu {
+- struct completion completion;
++ struct work_struct work;
+ long (*fn)(void *);
+ void *arg;
+ long ret;
+ };
+
+-static int do_work_for_cpu(void *_wfc)
++static void work_for_cpu_fn(struct work_struct *work)
+ {
+- struct work_for_cpu *wfc = _wfc;
++ struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
++
+ wfc->ret = wfc->fn(wfc->arg);
+- complete(&wfc->completion);
+- return 0;
+ }
+
+ /**
+@@ -3654,19 +3653,11 @@ static int do_work_for_cpu(void *_wfc)
+ */
+ long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
+ {
+- struct task_struct *sub_thread;
+- struct work_for_cpu wfc = {
+- .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
+- .fn = fn,
+- .arg = arg,
+- };
++ struct work_for_cpu wfc = { .fn = fn, .arg = arg };
+
+- sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
+- if (IS_ERR(sub_thread))
+- return PTR_ERR(sub_thread);
+- kthread_bind(sub_thread, cpu);
+- wake_up_process(sub_thread);
+- wait_for_completion(&wfc.completion);
++ INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
++ schedule_work_on(cpu, &wfc.work);
++ flush_work(&wfc.work);
+ return wfc.ret;
+ }
+ EXPORT_SYMBOL_GPL(work_on_cpu);
+From 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj at kernel.org>
+Date: Tue, 18 Sep 2012 14:24:59 -0700
+Subject: cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU
+
+From: Tejun Heo <tj at kernel.org>
+
+commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.
+
+powernowk8_target() runs off a per-cpu work item and if the
+cpufreq_policy->cpu is different from the current one, it migrates the
+kworker to the target CPU by manipulating current->cpus_allowed. The
+function migrates the kworker back to the original CPU but this is
+still broken. Workqueue concurrency management requires the kworkers
+to stay on the same CPU and powernowk8_target() ends up triggerring
+BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on
+fidvid_mutex and sleeps.
+
+It is unclear why this bug is being reported now. Duncan says it
+appeared to be a regression of 3.6-rc1 and couldn't reproduce it on
+3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool
+instead of @gcwq or @cpu where applicable" which is an non-functional
+change. Given that the reproduce case sometimes took upto days to
+trigger, it's easy to be misled while bisecting. Maybe something made
+contention on fidvid_mutex more likely? I don't know.
+
+This patch fixes the bug by using work_on_cpu() instead if @pol->cpu
+isn't the same as the current one. The code assumes that
+cpufreq_policy->cpu is kept online by the caller, which Rafael tells
+me is the case.
+
+stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
+ system_wq") should be applied before this; otherwise, the
+ behavior could be horrible.
+
+Signed-off-by: Tejun Heo <tj at kernel.org>
+Reported-by: Duncan <1i5t5.duncan at cox.net>
+Tested-by: Duncan <1i5t5.duncan at cox.net>
+Cc: Rafael J. Wysocki <rjw at sisk.pl>
+Cc: Andreas Herrmann <andreas.herrmann3 at amd.com>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernow-k8.c | 63 ++++++++++++++++++++++--------------------
+ 1 file changed, 34 insertions(+), 29 deletions(-)
+
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -35,7 +35,6 @@
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ #include <linux/cpumask.h>
+-#include <linux/sched.h> /* for current / set_cpus_allowed() */
+ #include <linux/io.h>
+ #include <linux/delay.h>
+
+@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(s
+ return res;
+ }
+
+-/* Driver entry point to switch to the target frequency */
+-static int powernowk8_target(struct cpufreq_policy *pol,
+- unsigned targfreq, unsigned relation)
++struct powernowk8_target_arg {
++ struct cpufreq_policy *pol;
++ unsigned targfreq;
++ unsigned relation;
++};
++
++static long powernowk8_target_fn(void *arg)
+ {
+- cpumask_var_t oldmask;
++ struct powernowk8_target_arg *pta = arg;
++ struct cpufreq_policy *pol = pta->pol;
++ unsigned targfreq = pta->targfreq;
++ unsigned relation = pta->relation;
+ struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
+ u32 checkfid;
+ u32 checkvid;
+ unsigned int newstate;
+- int ret = -EIO;
++ int ret;
+
+ if (!data)
+ return -EINVAL;
+@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpuf
+ checkfid = data->currfid;
+ checkvid = data->currvid;
+
+- /* only run on specific CPU from here on. */
+- /* This is poor form: use a workqueue or smp_call_function_single */
+- if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
+- return -ENOMEM;
+-
+- cpumask_copy(oldmask, tsk_cpus_allowed(current));
+- set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
+-
+- if (smp_processor_id() != pol->cpu) {
+- printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
+- goto err_out;
+- }
+-
+ if (pending_bit_stuck()) {
+ printk(KERN_ERR PFX "failing targ, change pending bit set\n");
+- goto err_out;
++ return -EIO;
+ }
+
+ pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
+ pol->cpu, targfreq, pol->min, pol->max, relation);
+
+ if (query_current_values_with_pending_wait(data))
+- goto err_out;
++ return -EIO;
+
+ if (cpu_family != CPU_HW_PSTATE) {
+ pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
+@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpuf
+
+ if (cpufreq_frequency_table_target(pol, data->powernow_table,
+ targfreq, relation, &newstate))
+- goto err_out;
++ return -EIO;
+
+ mutex_lock(&fidvid_mutex);
+
+@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpuf
+ ret = transition_frequency_fidvid(data, newstate);
+ if (ret) {
+ printk(KERN_ERR PFX "transition frequency failed\n");
+- ret = 1;
+ mutex_unlock(&fidvid_mutex);
+- goto err_out;
++ return 1;
+ }
+ mutex_unlock(&fidvid_mutex);
+
+@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpuf
+ data->powernow_table[newstate].index);
+ else
+ pol->cur = find_khz_freq_from_fid(data->currfid);
+- ret = 0;
+
+-err_out:
+- set_cpus_allowed_ptr(current, oldmask);
+- free_cpumask_var(oldmask);
+- return ret;
++ return 0;
++}
++
++/* Driver entry point to switch to the target frequency */
++static int powernowk8_target(struct cpufreq_policy *pol,
++ unsigned targfreq, unsigned relation)
++{
++ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
++ .relation = relation };
++
++ /*
++ * Must run on @pol->cpu. cpufreq core is responsible for ensuring
++ * that we're bound to the current CPU and pol->cpu stays online.
++ */
++ if (smp_processor_id() == pol->cpu)
++ return powernowk8_target_fn(&pta);
++ else
++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
+ }
+
+ /* Driver entry point to verify the policy and range of frequencies */
+From 2453f5f992717251cfadab6184fbb3ec2f2e8b40 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron at beardog.cce.hp.com>
+Date: Fri, 14 Sep 2012 16:35:10 -0500
+Subject: cciss: fix handling of protocol error
+
+From: "Stephen M. Cameron" <scameron at beardog.cce.hp.com>
+
+commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.
+
+If a command completes with a status of CMD_PROTOCOL_ERR, this
+information should be conveyed to the SCSI mid layer, not dropped
+on the floor. Unlike a similar bug in the hpsa driver, this bug
+only affects tape drives and CD and DVD ROM drives in the cciss
+driver, and to induce it, you have to disconnect (or damage) a
+cable, so it is not a very likely scenario (which would explain
+why the bug has gone undetected for the last 10 years.)
+
+Signed-off-by: Stephen M. Cameron <scameron at beardog.cce.hp.com>
+Signed-off-by: Jens Axboe <axboe at kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman
+ }
+ break;
+ case CMD_PROTOCOL_ERR:
++ cmd->result = DID_ERROR << 16;
+ dev_warn(&h->pdev->dev,
+ "%p has protocol error\n", c);
+ break;
+From 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds at linux-foundation.org>
+Date: Fri, 14 Sep 2012 14:48:21 -0700
+Subject: vfs: make O_PATH file descriptors usable for 'fstat()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds at linux-foundation.org>
+
+commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream.
+
+We already use them for openat() and friends, but fstat() also wants to
+be able to use O_PATH file descriptors. This should make it more
+directly comparable to the O_SEARCH of Solaris.
+
+Note that you could already do the same thing with "fstatat()" and an
+empty path, but just doing "fstat()" directly is simpler and faster, so
+there is no reason not to just allow it directly.
+
+See also commit 332a2e1244bd, which did the same thing for fchdir, for
+the same reasons.
+
+Reported-by: ольга крыжановская <olga.kryzhanovska at gmail.com>
+Cc: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ fs/stat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
+ int vfs_fstat(unsigned int fd, struct kstat *stat)
+ {
+ int fput_needed;
+- struct file *f = fget_light(fd, &fput_needed);
++ struct file *f = fget_raw_light(fd, &fput_needed);
+ int error = -EBADF;
+
+ if (f) {
+From b161dfa6937ae46d50adce8a7c6b12233e96e7bd Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi at suse.cz>
+Date: Mon, 17 Sep 2012 22:31:38 +0200
+Subject: vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
+
+From: Miklos Szeredi <mszeredi at suse.cz>
+
+commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.
+
+IBM reported a soft lockup after applying the fix for the rename_lock
+deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression
+in kernel 2.6.38") was found to be the culprit.
+
+The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the
+dentry was killed. This flag can be set on non-killed dentries too,
+which results in infinite retries when trying to traverse the dentry
+tree.
+
+This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is
+only set in d_kill() and makes try_to_ascend() test only this flag.
+
+IBM reported successful test results with this patch.
+
+Signed-off-by: Miklos Szeredi <mszeredi at suse.cz>
+Cc: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ fs/dcache.c | 4 ++--
+ include/linux/dcache.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dent
+ * Inform try_to_ascend() that we are no longer attached to the
+ * dentry tree
+ */
+- dentry->d_flags |= DCACHE_DISCONNECTED;
++ dentry->d_flags |= DCACHE_DENTRY_KILLED;
+ if (parent)
+ spin_unlock(&parent->d_lock);
+ dentry_iput(dentry);
+@@ -1046,7 +1046,7 @@ static struct dentry *try_to_ascend(stru
+ * or deletion
+ */
+ if (new != old->d_parent ||
+- (old->d_flags & DCACHE_DISCONNECTED) ||
++ (old->d_flags & DCACHE_DENTRY_KILLED) ||
+ (!locked && read_seqretry(&rename_lock, seq))) {
+ spin_unlock(&new->d_lock);
+ new = NULL;
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -206,6 +206,8 @@ struct dentry_operations {
+ #define DCACHE_MANAGED_DENTRY \
+ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
+
++#define DCACHE_DENTRY_KILLED 0x100000
++
+ extern seqlock_t rename_lock;
+
+ static inline int dname_external(struct dentry *dentry)
+From 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa Mon Sep 17 00:00:00 2001
+From: Amerigo Wang <amwang at redhat.com>
+Date: Sat, 18 Aug 2012 07:02:20 +0000
+Subject: netconsole: remove a redundant netconsole_target_put()
+
+From: Amerigo Wang <amwang at redhat.com>
+
+commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream.
+
+This netconsole_target_put() is obviously redundant, and it
+causes a kernel segfault when removing a bridge device which has
+netconsole running on it.
+
+This is caused by:
+
+ commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093
+ Author: Amerigo Wang <amwang at redhat.com>
+ Date: Thu May 19 21:39:10 2011 +0000
+
+ netpoll: disable netpoll when enslave a device
+
+Signed-off-by: Cong Wang <amwang at redhat.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/netconsole.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struc
+ flags);
+ dev_put(nt->np.dev);
+ nt->np.dev = NULL;
+- netconsole_target_put(nt);
+ }
+ nt->enabled = 0;
+ stopped = true;
+From 8335eafc2859e1a26282bef7c3d19f3d68868b8a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks at canonical.com>
+Date: Thu, 13 Sep 2012 12:00:56 -0700
+Subject: eCryptfs: Copy up attributes of the lower target inode after rename
+
+From: Tyler Hicks <tyhicks at canonical.com>
+
+commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream.
+
+After calling into the lower filesystem to do a rename, the lower target
+inode's attributes were not copied up to the eCryptfs target inode. This
+resulted in the eCryptfs target inode staying around, rather than being
+evicted, because i_nlink was not updated for the eCryptfs inode. This
+also meant that eCryptfs didn't do the final iput() on the lower target
+inode so it stayed around, as well. This would result in a failure to
+free up space occupied by the target file in the rename() operation.
+Both target inodes would eventually be evicted when the eCryptfs
+filesystem was unmounted.
+
+This patch calls fsstack_copy_attr_all() after the lower filesystem
+does its ->rename() so that important inode attributes, such as i_nlink,
+are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called
+and eCryptfs can drop its final reference on the lower inode.
+
+http://launchpad.net/bugs/561129
+
+Signed-off-by: Tyler Hicks <tyhicks at canonical.com>
+Tested-by: Colin Ian King <colin.king at canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ fs/ecryptfs/inode.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ struct dentry *lower_old_dir_dentry;
+ struct dentry *lower_new_dir_dentry;
+ struct dentry *trap = NULL;
++ struct inode *target_inode;
+
+ lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
+ lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
+@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ dget(lower_new_dentry);
+ lower_old_dir_dentry = dget_parent(lower_old_dentry);
+ lower_new_dir_dentry = dget_parent(lower_new_dentry);
++ target_inode = new_dentry->d_inode;
+ trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+ /* source should not be ancestor of target */
+ if (trap == lower_old_dentry) {
+@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, s
+ lower_new_dir_dentry->d_inode, lower_new_dentry);
+ if (rc)
+ goto out_lock;
++ if (target_inode)
++ fsstack_copy_attr_all(target_inode,
++ ecryptfs_inode_to_lower(target_inode));
+ fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
+ if (new_dir != old_dir)
+ fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
+From 4c054ba63ad47ef244cfcfa1cea38134620a5bae Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab at linux-iscsi.org>
+Date: Thu, 16 Aug 2012 15:33:10 -0700
+Subject: target: Fix ->data_length re-assignment bug with SCSI overflow
+
+From: Nicholas Bellinger <nab at linux-iscsi.org>
+
+commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.
+
+This patch fixes a long-standing bug with SCSI overflow handling
+where se_cmd->data_length was incorrectly being re-assigned to
+the larger CDB extracted allocation length, resulting in a number
+of fabric level errors that would end up causing a session reset
+in most cases. So instead now:
+
+ - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the
+ smaller value)
+ - Use existing se_cmd->data_length for OVERFLOW (to use the smaller
+ value)
+
+This fix has been tested with the following CDB to generate an
+SCSI overflow:
+
+ sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0
+
+Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric
+ports. Here is a bit more detail on each case:
+
+ - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
+ -3584 bytes of data.
+ - tcm_qla2xxx: Working as expected, returnins 512 bytes of data
+ - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection
+ in transport_generic_map_mem_to_cmd()
+ - tcm_vhost: Same as loopback
+
+Reported-by: Roland Dreier <roland at purestorage.com>
+Cc: Roland Dreier <roland at purestorage.com>
+Cc: Christoph Hellwig <hch at lst.de>
+Cc: Boaz Harrosh <bharrosh at panasas.com>
+Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3000,15 +3000,20 @@ static int transport_generic_cmd_sequenc
+ /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
+ goto out_invalid_cdb_field;
+ }
+-
++ /*
++ * For the overflow case keep the existing fabric provided
++ * ->data_length. Otherwise for the underflow case, reset
++ * ->data_length to the smaller SCSI expected data transfer
++ * length.
++ */
+ if (size > cmd->data_length) {
+ cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
+ cmd->residual_count = (size - cmd->data_length);
+ } else {
+ cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
+ cmd->residual_count = (cmd->data_length - size);
++ cmd->data_length = size;
+ }
+- cmd->data_length = size;
+ }
+
+ if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
+From 27a2709912ac19c755d34c79fe11994b0bf8082b Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Wed, 5 Sep 2012 17:09:14 +0200
+Subject: target: simplify code around transport_get_sense_data
+
+From: Paolo Bonzini <pbonzini at redhat.com>
+
+commit 27a2709912ac19c755d34c79fe11994b0bf8082b upstream.
+
+The error conditions in transport_get_sense_data are superfluous
+and complicate the code unnecessarily:
+
+* SCF_TRANSPORT_TASK_SENSE is checked in the caller;
+
+* it's simply part of the invariants of dev->transport->get_sense_buffer
+ that it must be there if transport_complete ever returns 1, and that
+ it must not return NULL. Besides, the entire callback will disappear
+ with the next patch.
+
+* similarly in the caller we can expect that sense data is only sent
+ for non-zero cmd->scsi_status.
+
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Nicholas Bellinger <nab at linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 49 ++++++++-------------------------
+ 1 file changed, 13 insertions(+), 36 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2261,7 +2261,7 @@ out:
+ /*
+ * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
+ */
+-static int transport_get_sense_data(struct se_cmd *cmd)
++static void transport_get_sense_data(struct se_cmd *cmd)
+ {
+ unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
+ struct se_device *dev = cmd->se_dev;
+@@ -2271,30 +2271,15 @@ static int transport_get_sense_data(stru
+ WARN_ON(!cmd->se_lun);
+
+ if (!dev)
+- return 0;
++ return;
+
+ spin_lock_irqsave(&cmd->t_state_lock, flags);
+ if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+- return 0;
+- }
+-
+- if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
+- goto out;
+-
+- if (!dev->transport->get_sense_buffer) {
+- pr_err("dev->transport->get_sense_buffer is NULL\n");
+- goto out;
++ return;
+ }
+
+ sense_buffer = dev->transport->get_sense_buffer(cmd);
+- if (!sense_buffer) {
+- pr_err("ITT 0x%08x cmd %p: Unable to locate"
+- " sense buffer for task with sense\n",
+- cmd->se_tfo->get_task_tag(cmd), cmd);
+- goto out;
+- }
+-
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+ offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
+@@ -2306,11 +2291,6 @@ static int transport_get_sense_data(stru
+
+ pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
+ dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
+- return 0;
+-
+-out:
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+- return -1;
+ }
+
+ static inline long long transport_dev_end_lba(struct se_device *dev)
+@@ -3171,7 +3151,7 @@ static void transport_handle_queue_full(
+ static void target_complete_ok_work(struct work_struct *work)
+ {
+ struct se_cmd *cmd = container_of(work, struct se_cmd, work);
+- int reason = 0, ret;
++ int ret;
+
+ /*
+ * Check if we need to move delayed/dormant tasks from cmds on the
+@@ -3192,19 +3172,16 @@ static void target_complete_ok_work(stru
+ * the struct se_cmd in question.
+ */
+ if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
+- if (transport_get_sense_data(cmd) < 0)
+- reason = TCM_NON_EXISTENT_LUN;
++ WARN_ON(!cmd->scsi_status);
++ transport_get_sense_data(cmd);
++ ret = transport_send_check_condition_and_sense(
++ cmd, 0, 1);
++ if (ret == -EAGAIN || ret == -ENOMEM)
++ goto queue_full;
+
+- if (cmd->scsi_status) {
+- ret = transport_send_check_condition_and_sense(
+- cmd, reason, 1);
+- if (ret == -EAGAIN || ret == -ENOMEM)
+- goto queue_full;
+-
+- transport_lun_remove_cmd(cmd);
+- transport_cmd_check_stop_to_fabric(cmd);
+- return;
+- }
++ transport_lun_remove_cmd(cmd);
++ transport_cmd_check_stop_to_fabric(cmd);
++ return;
+ }
+ /*
+ * Check for a callback, used by amongst other things
+From bf8801145c01ab600f8df66e8c879ac642fa5846 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon at arm.com>
+Date: Thu, 16 Aug 2012 18:55:44 +0100
+Subject: ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint access type
+
+From: Will Deacon <will.deacon at arm.com>
+
+commit bf8801145c01ab600f8df66e8c879ac642fa5846 upstream.
+
+From ARM debug architecture v7.1 onwards, a watchpoint exception causes
+the DFAR to be updated with the faulting data address. However, DFSR.WnR
+takes an UNKNOWN value and therefore cannot be used in general to
+determine the access type that triggered the watchpoint.
+
+This patch forbids watchpoints without an overflow handler from
+specifying a specific access type (load/store). Those with overflow
+handlers must be able to handle false positives potentially triggered by
+a watchpoint of a different access type on the same address. For
+SIGTRAP-based handlers (i.e. ptrace), this should have no impact.
+
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/kernel/hw_breakpoint.c | 55 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 40 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
+ arch >= ARM_DEBUG_ARCH_V7_1;
+ }
+
++/* Can we determine the watchpoint access type from the fsr? */
++static int debug_exception_updates_fsr(void)
++{
++ return 0;
++}
++
+ /* Determine number of WRP registers available. */
+ static int get_num_wrp_resources(void)
+ {
+@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct
+ info->address &= ~alignment_mask;
+ info->ctrl.len <<= offset;
+
+- /*
+- * Currently we rely on an overflow handler to take
+- * care of single-stepping the breakpoint when it fires.
+- * In the case of userspace breakpoints on a core with V7 debug,
+- * we can use the mismatch feature as a poor-man's hardware
+- * single-step, but this only works for per-task breakpoints.
+- */
+- if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
+- !core_has_mismatch_brps() || !bp->hw.bp_target)) {
+- pr_warning("overflow handler required but none found\n");
+- ret = -EINVAL;
++ if (!bp->overflow_handler) {
++ /*
++ * Mismatch breakpoints are required for single-stepping
++ * breakpoints.
++ */
++ if (!core_has_mismatch_brps())
++ return -EINVAL;
++
++ /* We don't allow mismatch breakpoints in kernel space. */
++ if (arch_check_bp_in_kernelspace(bp))
++ return -EPERM;
++
++ /*
++ * Per-cpu breakpoints are not supported by our stepping
++ * mechanism.
++ */
++ if (!bp->hw.bp_target)
++ return -EINVAL;
++
++ /*
++ * We only support specific access types if the fsr
++ * reports them.
++ */
++ if (!debug_exception_updates_fsr() &&
++ (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
++ info->ctrl.type == ARM_BREAKPOINT_STORE))
++ return -EINVAL;
+ }
++
+ out:
+ return ret;
+ }
+@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned
+ goto unlock;
+
+ /* Check that the access type matches. */
+- access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
+- HW_BREAKPOINT_R;
+- if (!(access & hw_breakpoint_type(wp)))
+- goto unlock;
++ if (debug_exception_updates_fsr()) {
++ access = (fsr & ARM_FSR_ACCESS_MASK) ?
++ HW_BREAKPOINT_W : HW_BREAKPOINT_R;
++ if (!(access & hw_breakpoint_type(wp)))
++ goto unlock;
++ }
+
+ /* We have a winner. */
+ info->trigger = addr;
+From dbece45894d3ab1baac15a96dc4e1e8e23f64a93 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon at arm.com>
+Date: Fri, 24 Aug 2012 15:20:59 +0100
+Subject: ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores
+
+From: Will Deacon <will.deacon at arm.com>
+
+commit dbece45894d3ab1baac15a96dc4e1e8e23f64a93 upstream.
+
+When enabling the MMU for ARMv7 CPUs, the decompressor does not touch
+the ttbcr register, assuming that it will be zeroed (N == 0, EAE == 0).
+Given that only EAE is defined as 0 for non-secure copies of the
+register (and a bootloader such as kexec may leave it set to 1 anyway),
+we should ensure that we reset the register ourselves before turning on
+the MMU.
+
+This patch zeroes TTBCR.EAE and TTBCR.N prior to enabling the MMU for
+ARMv7 cores in the decompressor, configuring us exclusively for 32-bit
+translation tables via TTBR0.
+
+Acked-by: Nicolas Pitre <nico at linaro.org>
+Signed-off-by: Matthew Leach <matthew.leach at arm.com>
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/boot/compressed/head.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -659,10 +659,14 @@ __armv7_mmu_cache_on:
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+ orr r0, r0, #1 << 25 @ big-endian page tables
+ #endif
++ mrcne p15, 0, r6, c2, c0, 2 @ read ttb control reg
+ orrne r0, r0, #1 @ MMU enabled
+ movne r1, #0xfffffffd @ domain 0 = client
++ bic r6, r6, #1 << 31 @ 32-bit translation system
++ bic r6, r6, #3 << 0 @ use only ttbr0
+ mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer
+ mcrne p15, 0, r1, c3, c0, 0 @ load domain access control
++ mcrne p15, 0, r6, c2, c0, 2 @ load ttb control
+ #endif
+ mcr p15, 0, r0, c7, c5, 4 @ ISB
+ mcr p15, 0, r0, c1, c0, 0 @ load control register
+From 70b0476a2394de4f4e32e0b67288d80ff71ca963 Mon Sep 17 00:00:00 2001
+From: David Brown <davidb at codeaurora.org>
+Date: Tue, 4 Sep 2012 21:36:37 +0100
+Subject: ARM: 7513/1: Make sure dtc is built before running it
+
+From: David Brown <davidb at codeaurora.org>
+
+commit 70b0476a2394de4f4e32e0b67288d80ff71ca963 upstream.
+
+'make dtbs' in a clean tree will try running the dtc before actually
+building it. Make these rules depend upon the scripts to build it.
+
+Signed-off-by: David Brown <davidb at codeaurora.org>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -279,10 +279,10 @@ zImage Image xipImage bootpImage uImage:
+ zinstall uinstall install: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
+
+-%.dtb:
++%.dtb: scripts
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
+
+-dtbs:
++dtbs: scripts
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
+
+ # We use MRPROPER_FILES and CLEAN_FILES now
+From 2b2040af0b64cd93e5d4df2494c4486cf604090d Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon at arm.com>
+Date: Fri, 7 Sep 2012 18:21:44 +0100
+Subject: ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
+
+From: Will Deacon <will.deacon at arm.com>
+
+commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream.
+
+get_user may fail to load from the provided __user address due to an
+unhandled fault generated by the access.
+
+In the case of the undefined instruction trap, this results in failure
+to load the faulting instruction, in which case we should send SIGILL to
+the task rather than continue with potentially uninitialised data.
+
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/kernel/traps.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst
+ #endif
+ instr = *(u32 *) pc;
+ } else if (thumb_mode(regs)) {
+- get_user(instr, (u16 __user *)pc);
++ if (get_user(instr, (u16 __user *)pc))
++ goto die_sig;
+ if (is_wide_instruction(instr)) {
+ unsigned int instr2;
+- get_user(instr2, (u16 __user *)pc+1);
++ if (get_user(instr2, (u16 __user *)pc+1))
++ goto die_sig;
+ instr <<= 16;
+ instr |= instr2;
+ }
+- } else {
+- get_user(instr, (u32 __user *)pc);
++ } else if (get_user(instr, (u32 __user *)pc)) {
++ goto die_sig;
+ }
+
+ if (call_undef_hook(regs, instr) == 0)
+ return;
+
++die_sig:
+ #ifdef CONFIG_DEBUG_USER
+ if (user_debug & UDBG_UNDEFINED) {
+ printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
+From 8404663f81d212918ff85f493649a7991209fa04 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel at arm.linux.org.uk>
+Date: Fri, 7 Sep 2012 18:22:28 +0100
+Subject: ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
+
+From: Russell King <rmk+kernel at arm.linux.org.uk>
+
+commit 8404663f81d212918ff85f493649a7991209fa04 upstream.
+
+The {get,put}_user macros don't perform range checking on the provided
+__user address when !CPU_HAS_DOMAINS.
+
+This patch reworks the out-of-line assembly accessors to check the user
+address against a specified limit, returning -EFAULT if is is out of
+range.
+
+[will: changed get_user register allocation to match put_user]
+[rmk: fixed building on older ARM architectures]
+
+Reported-by: Catalin Marinas <catalin.marinas at arm.com>
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/include/asm/assembler.h | 8 +++++++
+ arch/arm/include/asm/uaccess.h | 40 ++++++++++++++++++++++++++-------------
+ arch/arm/lib/getuser.S | 23 ++++++++++++++--------
+ arch/arm/lib/putuser.S | 6 +++++
+ 4 files changed, 56 insertions(+), 21 deletions(-)
+
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -320,4 +320,12 @@
+ .size \name , . - \name
+ .endm
+
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcccs \tmp, \tmp, \limit
++ bcs \bad
++#endif
++ .endm
++
+ #endif /* __ASM_ASSEMBLER_H__ */
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
+ extern int __get_user_2(void *);
+ extern int __get_user_4(void *);
+
+-#define __get_user_x(__r2,__p,__e,__s,__i...) \
++#define __GUP_CLOBBER_1 "lr", "cc"
++#ifdef CONFIG_CPU_USE_DOMAINS
++#define __GUP_CLOBBER_2 "ip", "lr", "cc"
++#else
++#define __GUP_CLOBBER_2 "lr", "cc"
++#endif
++#define __GUP_CLOBBER_4 "lr", "cc"
++
++#define __get_user_x(__r2,__p,__e,__l,__s) \
+ __asm__ __volatile__ ( \
+ __asmeq("%0", "r0") __asmeq("%1", "r2") \
++ __asmeq("%3", "r1") \
+ "bl __get_user_" #__s \
+ : "=&r" (__e), "=r" (__r2) \
+- : "0" (__p) \
+- : __i, "cc")
++ : "0" (__p), "r" (__l) \
++ : __GUP_CLOBBER_##__s)
+
+ #define get_user(x,p) \
+ ({ \
++ unsigned long __limit = current_thread_info()->addr_limit - 1; \
+ register const typeof(*(p)) __user *__p asm("r0") = (p);\
+ register unsigned long __r2 asm("r2"); \
++ register unsigned long __l asm("r1") = __limit; \
+ register int __e asm("r0"); \
+ switch (sizeof(*(__p))) { \
+ case 1: \
+- __get_user_x(__r2, __p, __e, 1, "lr"); \
+- break; \
++ __get_user_x(__r2, __p, __e, __l, 1); \
++ break; \
+ case 2: \
+- __get_user_x(__r2, __p, __e, 2, "r3", "lr"); \
++ __get_user_x(__r2, __p, __e, __l, 2); \
+ break; \
+ case 4: \
+- __get_user_x(__r2, __p, __e, 4, "lr"); \
++ __get_user_x(__r2, __p, __e, __l, 4); \
+ break; \
+ default: __e = __get_user_bad(); break; \
+ } \
+@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsigned
+ extern int __put_user_4(void *, unsigned int);
+ extern int __put_user_8(void *, unsigned long long);
+
+-#define __put_user_x(__r2,__p,__e,__s) \
++#define __put_user_x(__r2,__p,__e,__l,__s) \
+ __asm__ __volatile__ ( \
+ __asmeq("%0", "r0") __asmeq("%2", "r2") \
++ __asmeq("%3", "r1") \
+ "bl __put_user_" #__s \
+ : "=&r" (__e) \
+- : "0" (__p), "r" (__r2) \
++ : "0" (__p), "r" (__r2), "r" (__l) \
+ : "ip", "lr", "cc")
+
+ #define put_user(x,p) \
+ ({ \
++ unsigned long __limit = current_thread_info()->addr_limit - 1; \
+ register const typeof(*(p)) __r2 asm("r2") = (x); \
+ register const typeof(*(p)) __user *__p asm("r0") = (p);\
++ register unsigned long __l asm("r1") = __limit; \
+ register int __e asm("r0"); \
+ switch (sizeof(*(__p))) { \
+ case 1: \
+- __put_user_x(__r2, __p, __e, 1); \
++ __put_user_x(__r2, __p, __e, __l, 1); \
+ break; \
+ case 2: \
+- __put_user_x(__r2, __p, __e, 2); \
++ __put_user_x(__r2, __p, __e, __l, 2); \
+ break; \
+ case 4: \
+- __put_user_x(__r2, __p, __e, 4); \
++ __put_user_x(__r2, __p, __e, __l, 4); \
+ break; \
+ case 8: \
+- __put_user_x(__r2, __p, __e, 8); \
++ __put_user_x(__r2, __p, __e, __l, 8); \
+ break; \
+ default: __e = __put_user_bad(); break; \
+ } \
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -16,8 +16,9 @@
+ * __get_user_X
+ *
+ * Inputs: r0 contains the address
++ * r1 contains the address limit, which must be preserved
+ * Outputs: r0 is the error code
+- * r2, r3 contains the zero-extended value
++ * r2 contains the zero-extended value
+ * lr corrupted
+ *
+ * No other registers must be altered. (see <asm/uaccess.h>
+@@ -27,33 +28,39 @@
+ * Note also that it is intended that __get_user_bad is not global.
+ */
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+ #include <asm/errno.h>
+ #include <asm/domain.h>
+
+ ENTRY(__get_user_1)
++ check_uaccess r0, 1, r1, r2, __get_user_bad
+ 1: TUSER(ldrb) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__get_user_1)
+
+ ENTRY(__get_user_2)
+-#ifdef CONFIG_THUMB2_KERNEL
+-2: TUSER(ldrb) r2, [r0]
+-3: TUSER(ldrb) r3, [r0, #1]
++ check_uaccess r0, 2, r1, r2, __get_user_bad
++#ifdef CONFIG_CPU_USE_DOMAINS
++rb .req ip
++2: ldrbt r2, [r0], #1
++3: ldrbt rb, [r0], #0
+ #else
+-2: TUSER(ldrb) r2, [r0], #1
+-3: TUSER(ldrb) r3, [r0]
++rb .req r0
++2: ldrb r2, [r0]
++3: ldrb rb, [r0, #1]
+ #endif
+ #ifndef __ARMEB__
+- orr r2, r2, r3, lsl #8
++ orr r2, r2, rb, lsl #8
+ #else
+- orr r2, r3, r2, lsl #8
++ orr r2, rb, r2, lsl #8
+ #endif
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__get_user_2)
+
+ ENTRY(__get_user_4)
++ check_uaccess r0, 4, r1, r2, __get_user_bad
+ 4: TUSER(ldr) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -16,6 +16,7 @@
+ * __put_user_X
+ *
+ * Inputs: r0 contains the address
++ * r1 contains the address limit, which must be preserved
+ * r2, r3 contains the value
+ * Outputs: r0 is the error code
+ * lr corrupted
+@@ -27,16 +28,19 @@
+ * Note also that it is intended that __put_user_bad is not global.
+ */
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+ #include <asm/errno.h>
+ #include <asm/domain.h>
+
+ ENTRY(__put_user_1)
++ check_uaccess r0, 1, r1, ip, __put_user_bad
+ 1: TUSER(strb) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
++ check_uaccess r0, 2, r1, ip, __put_user_bad
+ mov ip, r2, lsr #8
+ #ifdef CONFIG_THUMB2_KERNEL
+ #ifndef __ARMEB__
+@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
+ ENDPROC(__put_user_2)
+
+ ENTRY(__put_user_4)
++ check_uaccess r0, 4, r1, ip, __put_user_bad
+ 4: TUSER(str) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__put_user_4)
+
+ ENTRY(__put_user_8)
++ check_uaccess r0, 8, r1, ip, __put_user_bad
+ #ifdef CONFIG_THUMB2_KERNEL
+ 5: TUSER(str) r2, [r0]
+ 6: TUSER(str) r3, [r0, #4]
+From 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 Mon Sep 17 00:00:00 2001
+From: "Dae S. Kim" <dae at velatum.com>
+Date: Fri, 31 Aug 2012 02:00:51 +0200
+Subject: Staging: Android alarm: IOCTL command encoding fix
+
+From: "Dae S. Kim" <dae at velatum.com>
+
+commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 upstream.
+
+Fixed a bug. Data was being written to user space using an IOCTL
+command encoded with _IOC_WRITE access mode.
+
+Signed-off-by: Dae S. Kim <dae at velatum.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/android/android_alarm.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/android/android_alarm.h
++++ b/drivers/staging/android/android_alarm.h
+@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
+ #define ANDROID_ALARM_WAIT _IO('a', 1)
+
+ #define ALARM_IOW(c, type, size) _IOW('a', (c) | ((type) << 4), size)
++#define ALARM_IOR(c, type, size) _IOR('a', (c) | ((type) << 4), size)
++
+ /* Set alarm */
+ #define ANDROID_ALARM_SET(type) ALARM_IOW(2, type, struct timespec)
+ #define ANDROID_ALARM_SET_AND_WAIT(type) ALARM_IOW(3, type, struct timespec)
+-#define ANDROID_ALARM_GET_TIME(type) ALARM_IOW(4, type, struct timespec)
++#define ANDROID_ALARM_GET_TIME(type) ALARM_IOR(4, type, struct timespec)
+ #define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)
+ #define ANDROID_ALARM_BASE_CMD(cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))
+ #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd) (_IOC_NR(cmd) >> 4)
+From 45caae74d238ef6583e9402cb8c550cc0b0f7dbd Mon Sep 17 00:00:00 2001
+From: Igor Grinberg <grinberg at compulab.co.il>
+Date: Tue, 28 Aug 2012 01:26:14 +0300
+Subject: ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
+
+From: Igor Grinberg <grinberg at compulab.co.il>
+
+commit 45caae74d238ef6583e9402cb8c550cc0b0f7dbd upstream.
+
+Currently, omap2_sync32k_clocksource_init() function initializes the 32K
+timer as the system clock source regardless of the CONFIG_OMAP_32K_TIMER
+setting.
+Fix this by providing a default implementation for
+!CONFIG_OMAP_32K_TIMER case.
+
+Signed-off-by: Igor Grinberg <grinberg at compulab.co.il>
+Reviewed-by: Paul Walmsley <paul at pwsan.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar at ti.com>
+Signed-off-by: Tony Lindgren <tony at atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/timer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -263,6 +263,7 @@ static u32 notrace dmtimer_read_sched_cl
+ return 0;
+ }
+
++#ifdef CONFIG_OMAP_32K_TIMER
+ /* Setup free-running counter for clocksource */
+ static int __init omap2_sync32k_clocksource_init(void)
+ {
+@@ -302,6 +303,12 @@ static int __init omap2_sync32k_clocksou
+
+ return ret;
+ }
++#else
++static inline int omap2_sync32k_clocksource_init(void)
++{
++ return -ENODEV;
++}
++#endif
+
+ static void __init omap2_gptimer_clocksource_init(int gptimer_id,
+ const char *fck_source)
+From 912bfe76528c287bc4812521b8d53366954b39a5 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam at freescale.com>
+Date: Sun, 19 Aug 2012 14:05:59 -0300
+Subject: ARM: clk-imx25: Fix SSI clock registration
+
+From: Fabio Estevam <fabio.estevam at freescale.com>
+
+commit 912bfe76528c287bc4812521b8d53366954b39a5 upstream.
+
+SSI block has two types of clock:
+
+ipg: bus clock, the clock needed for accessing registers.
+per: peripheral clock, the clock needed for generating the bit rate.
+
+Currently SSI driver only supports slave mode and only need to handle
+the ipg clock, because the peripheral clock comes from the master codec.
+
+Only register the ipg clock and do not register the peripheral clock for ssi.
+
+Signed-off-by: Fabio Estevam <fabio.estevam at freescale.com>
+Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx25.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-imx/clk-imx25.c
++++ b/arch/arm/mach-imx/clk-imx25.c
+@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
+ clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
+ clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
+ clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
+- clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
+- clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
++ clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
++ clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
+ clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
+ clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
+ clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
+From 48540058612786d365602f3324ed97f9071092de Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam at freescale.com>
+Date: Mon, 20 Aug 2012 09:39:22 -0300
+Subject: ARM: clk-imx35: Fix SSI clock registration
+
+From: Fabio Estevam <fabio.estevam at freescale.com>
+
+commit 48540058612786d365602f3324ed97f9071092de upstream.
+
+SSI block has two types of clock:
+
+ipg: bus clock, the clock needed for accessing registers.
+per: peripheral clock, the clock needed for generating the bit rate.
+
+Currently SSI driver only supports slave mode and only need to handle
+the ipg clock, because the peripheral clock comes from the master codec.
+
+Only register the ipg clock and do not register the peripheral clock for ssi.
+
+Signed-off-by: Fabio Estevam <fabio.estevam at freescale.com>
+Tested-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx35.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
+ clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
+ clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
+ clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
+- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
+- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
+- clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
++ clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
++ clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
+ /* i.mx35 has the i.mx21 type uart */
+ clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
+ clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
+From a849088aa1552b1a28eea3daff599ee22a734ae3 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel at arm.linux.org.uk>
+Date: Sat, 25 Aug 2012 09:03:15 +0100
+Subject: ARM: Fix ioremap() of address zero
+
+From: Russell King <rmk+kernel at arm.linux.org.uk>
+
+commit a849088aa1552b1a28eea3daff599ee22a734ae3 upstream.
+
+Murali Nalajala reports a regression that ioremapping address zero
+results in an oops dump:
+
+Unable to handle kernel paging request at virtual address fa200000
+pgd = d4f80000
+[fa200000] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in:
+CPU: 0 Tainted: G W (3.4.0-g3b5f728-00009-g638207a #13)
+PC is at msm_pm_config_rst_vector_before_pc+0x8/0x30
+LR is at msm_pm_boot_config_before_pc+0x18/0x20
+pc : [<c0078f84>] lr : [<c007903c>] psr: a0000093
+sp : c0837ef0 ip : cfe00000 fp : 0000000d
+r10: da7efc17 r9 : 225c4278 r8 : 00000006
+r7 : 0003c000 r6 : c085c824 r5 : 00000001 r4 : fa101000
+r3 : fa200000 r2 : c095080c r1 : 002250fc r0 : 00000000
+Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 25180059 DAC: 00000015
+[<c0078f84>] (msm_pm_config_rst_vector_before_pc+0x8/0x30) from [<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20)
+[<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20) from [<c007a55c>] (msm_pm_power_collapse+0x410/0xb04)
+[<c007a55c>] (msm_pm_power_collapse+0x410/0xb04) from [<c007b17c>] (arch_idle+0x294/0x3e0)
+[<c007b17c>] (arch_idle+0x294/0x3e0) from [<c000eed8>] (default_idle+0x18/0x2c)
+[<c000eed8>] (default_idle+0x18/0x2c) from [<c000f254>] (cpu_idle+0x90/0xe4)
+[<c000f254>] (cpu_idle+0x90/0xe4) from [<c057231c>] (rest_init+0x88/0xa0)
+[<c057231c>] (rest_init+0x88/0xa0) from [<c07ff890>] (start_kernel+0x3a8/0x40c)
+Code: c0704256 e12fff1e e59f2020 e5923000 (e5930000)
+
+This is caused by the 'reserved' entries which we insert (see
+19b52abe3c5d7 - ARM: 7438/1: fill possible PMD empty section gaps)
+which get matched for physical address zero.
+
+Resolve this by marking these reserved entries with a different flag.
+
+Tested-by: Murali Nalajala <mnalajal at codeaurora.org>
+Acked-by: Nicolas Pitre <nico at linaro.org>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/mm/mm.h | 3 +++
+ arch/arm/mm/mmu.c | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/mm.h
++++ b/arch/arm/mm/mm.h
+@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct a
+ /* permanent static mappings from iotable_init() */
+ #define VM_ARM_STATIC_MAPPING 0x40000000
+
++/* empty mapping */
++#define VM_ARM_EMPTY_MAPPING 0x20000000
++
+ /* mapping type (attributes) for permanent static mappings */
+ #define VM_ARM_MTYPE(mt) ((mt) << 20)
+ #define VM_ARM_MTYPE_MASK (0x1f << 20)
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -813,7 +813,7 @@ static void __init pmd_empty_section_gap
+ vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
+ vm->addr = (void *)addr;
+ vm->size = SECTION_SIZE;
+- vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
++ vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
+ vm->caller = pmd_empty_section_gap;
+ vm_area_add_early(vm);
+ }
+@@ -826,7 +826,7 @@ static void __init fill_pmd_gaps(void)
+
+ /* we're still single threaded hence no lock needed here */
+ for (vm = vmlist; vm; vm = vm->next) {
+- if (!(vm->flags & VM_ARM_STATIC_MAPPING))
++ if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
+ continue;
+ addr = (unsigned long)vm->addr;
+ if (addr < next)
+From ab548d2dba63ba947287965e525cc02a15d9853d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Thu, 6 Sep 2012 10:10:11 +0200
+Subject: ALSA: hda - Fix missing Master volume for STAC9200/925x
+
+From: Takashi Iwai <tiwai at suse.de>
+
+commit ab548d2dba63ba947287965e525cc02a15d9853d upstream.
+
+With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with
+vmaster hook in patch_sigmatel.c], the former Master volume control
+was converted to PCM. This was supposed to be covered by the vmaster
+control. But due to the lack of "PCM" slave definition, this didn't
+happen properly. The patch fixes the missing entry.
+
+Reported-by: Andrew Shadura <bugzilla at tut.by>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux
+
+ static const char * const slave_pfxs[] = {
+ "Front", "Surround", "Center", "LFE", "Side",
+- "Headphone", "Speaker", "IEC958",
++ "Headphone", "Speaker", "IEC958", "PCM",
+ NULL
+ };
+
+From 1213a205f9ed27d97de3d5bed28fb085ef4853e2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Thu, 6 Sep 2012 14:58:00 +0200
+Subject: ALSA: usb-audio: Fix bogus error messages for delay accounting
+
+From: Takashi Iwai <tiwai at suse.de>
+
+commit 1213a205f9ed27d97de3d5bed28fb085ef4853e2 upstream.
+
+The recent fix for the missing fine delayed time adjustment gives
+strange error messages at each start of the playback stream, such as
+ delay: estimated 0, actual 352
+ delay: estimated 353, actual 705
+
+These come from the sanity check in retire_playback_urb(). Before the
+stream is activated via start_endpoints(), a few silent packets have
+been already sent. And at this point the delay account is still in
+the state as if the new packets are just queued, so the driver gets
+confused and spews the bogus error messages.
+
+For fixing the issue, we just need to check whether the received
+packet is valid, whether it's zero sized or not.
+
+Reported-by: Markus Trippelsdorf <markus at trippelsdorf.de>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct s
+ int processed = urb->transfer_buffer_length / stride;
+ int est_delay;
+
++ /* ignore the delay accounting when procssed=0 is given, i.e.
++ * silent payloads are procssed before handling the actual data
++ */
++ if (!processed)
++ return;
++
+ spin_lock_irqsave(&subs->lock, flags);
+ est_delay = snd_usb_pcm_delay(subs, runtime->rate);
+ /* update delay with exact number of samples played */
+From 07dc59f0988cb54fd87bd373b3b27eb2401dd811 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai at suse.de>
+Date: Mon, 10 Sep 2012 09:39:31 +0200
+Subject: ALSA: hda - Fix Oops at codec reset/reconfig
+
+From: Takashi Iwai <tiwai at suse.de>
+
+commit 07dc59f0988cb54fd87bd373b3b27eb2401dd811 upstream.
+
+snd_hda_codec_reset() calls restore_pincfgs() where the codec is
+powered up again, which eventually tries to resume and initialize via
+the callbacks of the codec. However, it's the place just after codec
+free callback, thus no codec callbacks should be called after that.
+On a codec like CS4206, it results in Oops due to the access in init
+callback.
+
+This patch fixes the issue by clearing the codec callbacks properly
+after freeing codec.
+
+Reported-by: Daniel J Blueman <daniel at quora.org>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2325,6 +2325,7 @@ int snd_hda_codec_reset(struct hda_codec
+ }
+ if (codec->patch_ops.free)
+ codec->patch_ops.free(codec);
++ memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
+ snd_hda_jack_tbl_clear(codec);
+ codec->proc_widget_hook = NULL;
+ codec->spec = NULL;
+@@ -2340,7 +2341,6 @@ int snd_hda_codec_reset(struct hda_codec
+ codec->num_pcms = 0;
+ codec->pcm_info = NULL;
+ codec->preset = NULL;
+- memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
+ codec->slave_dig_outs = NULL;
+ codec->spdif_status_reset = 0;
+ module_put(codec->owner);
+From 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 Mon Sep 17 00:00:00 2001
+From: Matteo Frigo <athena at fftw.org>
+Date: Wed, 12 Sep 2012 10:12:06 -0400
+Subject: ALSA: ice1724: Use linear scale for AK4396 volume control.
+
+From: Matteo Frigo <athena at fftw.org>
+
+commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream.
+
+The AK4396 DAC has a linear-scale attentuator, but
+sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is
+not quite right. This patch restores the correct scale, borrowing
+from the ak4396 code in sound/pci/oxygen/oxygen.c.
+
+Signed-off-by: Matteo Frigo <athena at fftw.org>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/pci/ice1712/prodigy_hifi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd
+ }
+
+ static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
++static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
+
+ static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
+ {
+@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h
+ .info = ak4396_dac_vol_info,
+ .get = ak4396_dac_vol_get,
+ .put = ak4396_dac_vol_put,
+- .tlv = { .p = db_scale_wm_dac },
++ .tlv = { .p = ak4396_db_scale },
+ },
+ };
+
+From tiwai at suse.de Fri Sep 21 10:24:28 2012
+From: Takashi Iwai <tiwai at suse.de>
+Date: Thu, 20 Sep 2012 07:44:11 +0200
+Subject: ALSA: hda - Workaround for silent output on VAIO Z with ALC889
+To: stable at vger.kernel.org
+Cc: Adam Williamson <awilliam at redhat.com>
+Message-ID: <s5h4nmtnt90.wl%tiwai at suse.de>
+
+From: Takashi Iwai <tiwai at suse.de>
+
+commit e427c2375646789ecd0ccaef1a1e41458559ab2d upstream.
+
+On recent kernels, Realtek codec parser tries to optimize the routing
+aggressively and take the headphone output as primary at first. This
+caused a regression on VAIO Z with ALC889, the silent output from the
+speaker.
+
+The problem seems that the speaker pin must be connected to the first
+DAC (0x02) on this machine by some reason although the codec itself
+advertises the flexible routing with any DACs.
+
+This patch adds a fix-up for choosing the speaker pin as the primary
+so that the right DAC is assigned on this device.
+
+Reported-and-tested-by: Adam Williamson <awilliam at redhat.com>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+---
+
+---
+ Documentation/sound/alsa/HD-Audio-Models.txt | 1 +
+ sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/Documentation/sound/alsa/HD-Audio-Models.txt
++++ b/Documentation/sound/alsa/HD-Audio-Models.txt
+@@ -47,6 +47,7 @@ ALC882/883/885/888/889
+ acer-aspire-4930g Acer Aspire 4930G/5930G/6530G/6930G/7730G
+ acer-aspire-8930g Acer Aspire 8330G/6935G
+ acer-aspire Acer Aspire others
++ no-primary-hp VAIO Z workaround (for fixed speaker DAC)
+
+ ALC861/660
+ ==========
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -201,6 +201,7 @@ struct alc_spec {
+ unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */
+ unsigned int parse_flags; /* passed to snd_hda_parse_pin_defcfg() */
+ unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */
++ unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins */
+
+ /* auto-mute control */
+ int automute_mode;
+@@ -4182,7 +4183,8 @@ static int alc_parse_auto_config(struct
+ return 0; /* can't find valid BIOS pin config */
+ }
+
+- if (cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
++ if (!spec->no_primary_hp &&
++ cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
+ cfg->line_outs <= cfg->hp_outs) {
+ /* use HP as primary out */
+ cfg->speaker_outs = cfg->line_outs;
+@@ -4909,6 +4911,7 @@ enum {
+ ALC889_FIXUP_DAC_ROUTE,
+ ALC889_FIXUP_MBP_VREF,
+ ALC889_FIXUP_IMAC91_VREF,
++ ALC882_FIXUP_NO_PRIMARY_HP,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -5030,6 +5033,17 @@ static void alc889_fixup_imac91_vref(str
+ spec->keep_vref_in_automute = 1;
+ }
+
++/* Don't take HP output as primary
++ * strangely, the speaker output doesn't work on VAIO Z through DAC 0x05
++ */
++static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
++ const struct alc_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ if (action == ALC_FIXUP_ACT_PRE_PROBE)
++ spec->no_primary_hp = 1;
++}
++
+ static const struct alc_fixup alc882_fixups[] = {
+ [ALC882_FIXUP_ABIT_AW9D_MAX] = {
+ .type = ALC_FIXUP_PINS,
+@@ -5212,6 +5226,10 @@ static const struct alc_fixup alc882_fix
+ .chained = true,
+ .chain_id = ALC882_FIXUP_GPIO1,
+ },
++ [ALC882_FIXUP_NO_PRIMARY_HP] = {
++ .type = ALC_FIXUP_FUNC,
++ .v.func = alc882_fixup_no_primary_hp,
++ },
+ };
+
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -5246,6 +5264,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
+ SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
++ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+
+ /* All Apple entries are in codec SSIDs */
+ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
+@@ -5286,6 +5305,7 @@ static const struct alc_model_fixup alc8
+ {.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"},
+ {.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"},
+ {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
++ {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
+ {}
+ };
+
+From 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b Mon Sep 17 00:00:00 2001
+From: Christopher Brannon <chris at the-brannons.com>
+Date: Sat, 16 Jun 2012 16:55:20 -0500
+Subject: Staging: speakup: fix an improperly-declared variable.
+
+From: Christopher Brannon <chris at the-brannons.com>
+
+commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.
+
+A local static variable was declared as a pointer to a string
+constant. We're assigning to the underlying memory, so it
+needs to be an array instead.
+
+Signed-off-by: Christopher Brannon <chris at the-brannons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/speakup/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_data
+
+ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
+ {
+- static u_char *goto_buf = "\0\0\0\0\0\0";
++ static u_char goto_buf[8];
+ static int num;
+ int maxlen, go_pos;
+ char *cp;
+From 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 Mon Sep 17 00:00:00 2001
+From: Seth Jennings <sjenning at linux.vnet.ibm.com>
+Date: Wed, 29 Aug 2012 16:58:45 -0500
+Subject: staging: zcache: fix cleancache race condition with shrinker
+
+From: Seth Jennings <sjenning at linux.vnet.ibm.com>
+
+commit 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 upstream.
+
+This patch fixes a race condition that results in memory
+corruption when using cleancache.
+
+The race exists between the zcache shrinker handler,
+shrink_zcache_memory() and cleancache_get_page().
+
+In most cases, the shrinker will both evict a zbpg
+from its buddy list and flush it from tmem before a
+cleancache_get_page() occurs on that page. A subsequent
+cleancache_get_page() will fail in the tmem layer.
+
+In the rare case that two occur together and the
+cleancache_get_page() path gets through the tmem
+layer before the shrinker path can flush tmem,
+zbud_decompress() does a check to see if the zbpg is a
+"zombie", i.e. not on a buddy list, which means the shrinker
+is in the process of reclaiming it. If the zbpg is a zombie,
+zbud_decompress() returns -EINVAL.
+
+However, this return code is being ignored by the caller,
+zcache_pampd_get_data_and_free(), which results in the
+caller of cleancache_get_page() thinking that the page has
+been properly retrieved when it has not.
+
+This patch modifies zcache_pampd_get_data_and_free() to
+convey the failure up the stack so that the caller of
+cleancache_get_page() knows the page retrieval failed.
+
+This needs to be applied to stable trees as well.
+zcache-main.c was named zcache.c before v3.1, so
+I'm not sure how you want to handle trees earlier
+than that.
+
+Signed-off-by: Seth Jennings <sjenning at linux.vnet.ibm.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Reviewed-by: Minchan Kim <minchan at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/zcache/zcache-main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/zcache/zcache-main.c
++++ b/drivers/staging/zcache/zcache-main.c
+@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_fre
+ void *pampd, struct tmem_pool *pool,
+ struct tmem_oid *oid, uint32_t index)
+ {
+- int ret = 0;
+-
+ BUG_ON(!is_ephemeral(pool));
+- zbud_decompress((struct page *)(data), pampd);
++ if (zbud_decompress((struct page *)(data), pampd) < 0)
++ return -EINVAL;
+ zbud_free_and_delist((struct zbud_hdr *)pampd);
+ atomic_dec(&zcache_curr_eph_pampd_count);
+- return ret;
++ return 0;
+ }
+
+ /*
+From aa209eef3ce8419ff2926c2fa944dfbfb5afbacb Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy at gmail.com>
+Date: Wed, 29 Aug 2012 23:08:21 +0100
+Subject: staging: vt6656: [BUG] - Failed connection, incorrect endian.
+
+From: Malcolm Priestley <tvboxspy at gmail.com>
+
+commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream.
+
+Hi,
+
+This patch fixes a bug with driver failing to negotiate a connection.
+
+The bug was traced to commit
+203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90
+staging: vt6656: removed custom definitions of Ethernet packet types
+
+In that patch, definitions in include/linux/if_ether.h replaced ones
+in tether.h which had both big and little endian definitions.
+
+include/linux/if_ether.h only refers to big endian values, cpu_to_be16
+should be used for the correct endian architectures.
+
+Signed-off-by: Malcolm Priestley <tvboxspy at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/dpc.c | 2 +-
+ drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++-------------------
+ 2 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/staging/vt6656/dpc.c
++++ b/drivers/staging/vt6656/dpc.c
+@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
+ } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
+ cbHeaderSize += 6;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+- if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
+ (*pwType == cpu_to_le16(0xF380))) {
+ cbHeaderSize -= 8;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(
+ // 802.1H
+ if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
+ if (pDevice->dwDiagRefCount == 0) {
+- if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
+ (psEthHeader->wType == cpu_to_le16(0xF380))) {
+ memcpy((PBYTE) (pbyPayloadHead),
+ abySNAP_Bridgetunnel, 6);
+@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ Packet_Type = skb->data[ETH_HLEN+1];
+ Descriptor_type = skb->data[ETH_HLEN+1+1+2];
+ Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- /* 802.1x OR eapol-key challenge frame transfer */
+- if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+- (Packet_Type == 3)) {
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ /* 802.1x OR eapol-key challenge frame transfer */
++ if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
++ (Packet_Type == 3)) {
+ bTxeapol_key = TRUE;
+ if(!(Key_info & BIT3) && //WPA or RSN group-key challenge
+ (Key_info & BIT8) && (Key_info & BIT9)) { //send 2/2 key
+@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ }
+ }
+
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- if (pDevice->byBBType != BB_TYPE_11A) {
+- pDevice->wCurrentRate = RATE_1M;
+- pDevice->byACKRate = RATE_1M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- } else {
+- pDevice->wCurrentRate = RATE_6M;
+- pDevice->byACKRate = RATE_6M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- }
+- }
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ if (pDevice->byBBType != BB_TYPE_11A) {
++ pDevice->wCurrentRate = RATE_1M;
++ pDevice->byACKRate = RATE_1M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ } else {
++ pDevice->wCurrentRate = RATE_6M;
++ pDevice->byACKRate = RATE_6M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ }
++ }
+
+ DBG_PRT(MSG_LEVEL_DEBUG,
+ KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
+@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+
+ if (bNeedEncryption == TRUE) {
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
+- if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
++ if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
+ bNeedEncryption = FALSE;
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
+ if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
+From abf02cfc179bb4bd30d05f582d61b3b8f429b813 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet at google.com>
+Date: Mon, 10 Sep 2012 21:22:11 +0200
+Subject: staging: r8712u: fix bug in r8712_recv_indicatepkt()
+
+From: Eric Dumazet <edumazet at google.com>
+
+commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream.
+
+64bit arches have a buggy r8712u driver, let's fix it.
+
+skb->tail must be set properly or network stack behavior is undefined.
+
+Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071
+
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Cc: Dave Jones <davej at redhat.com>
+Acked-by: Larry Finger <Larry.Finger at lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/recv_linux.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/staging/rtl8712/recv_linux.c
++++ b/drivers/staging/rtl8712/recv_linux.c
+@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adap
+ if (skb == NULL)
+ goto _recv_indicatepkt_drop;
+ skb->data = precv_frame->u.hdr.rx_data;
+-#ifdef NET_SKBUFF_DATA_USES_OFFSET
+- skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
+- precv_frame->u.hdr.rx_head);
+-#else
+- skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
+-#endif
+ skb->len = precv_frame->u.hdr.len;
++ skb_set_tail_pointer(skb, skb->len);
+ if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ else
+From cadf84bfeb80e216fde328d357fe856160157d2c Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti at mev.co.uk>
+Date: Mon, 3 Sep 2012 16:39:38 +0100
+Subject: staging: comedi: amplc_pci224: Fix PCI ref count
+
+From: Ian Abbott <abbotti at mev.co.uk>
+
+commit cadf84bfeb80e216fde328d357fe856160157d2c upstream.
+
+When attaching a PCI device manually via the comedi driver `attach` hook
+(`pci224_attach()`) (called by the comedi core for the
+`COMEDI_DEVCONFIG` ioctl), its reference count is incremented in the
+`for_each_pci_dev` loop (in `pci224_find_pci_dev()`). It is decremented
+when the `detach` hook (`pci224_detach()`) is called to detach the
+device. However, when the PCI device is attached automatically via the
+`attach_pci` hook (`pci224_attach_pci()`, called at probe time via
+`comedi_pci_auto_config()`) it's reference count is not incremented so
+there will be an unmatched decrement when detaching the device.
+
+Increment the PCI device reference count in `pci224_attach_pci()` to
+correct the mismatch.
+
+Once support for manual configuration has been removed from this driver,
+the calls to `pci_dev_get()` and `pci_dev_put()` can be removed.
+
+Signed-off-by: Ian Abbott <abbotti at mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/amplc_pci224.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/staging/comedi/drivers/amplc_pci224.c
++++ b/drivers/staging/comedi/drivers/amplc_pci224.c
+@@ -1519,6 +1519,13 @@ pci224_attach_pci(struct comedi_device *
+ dev->minor, DRIVER_NAME);
+ return -EINVAL;
+ }
++ /*
++ * Need to 'get' the PCI device to match the 'put' in pci224_detach().
++ * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
++ * support for manual attachment of PCI devices via pci224_attach()
++ * has been removed.
++ */
++ pci_dev_get(pci_dev);
+ return pci224_attach_common(dev, pci_dev, NULL);
+ }
+
+From 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti at mev.co.uk>
+Date: Fri, 31 Aug 2012 20:41:30 +0100
+Subject: staging: comedi: das08: Correct AO output for das08jr-16-ao
+
+From: Ian Abbott <abbotti at mev.co.uk>
+
+commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.
+
+Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
+that knobbles the upper three-quarters of the output range for the
+'das08jr-16-ao' board.
+
+Signed-off-by: Ian Abbott <abbotti at mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/das08.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -678,7 +678,7 @@ static int das08jr_ao_winsn(struct comed
+ int chan;
+
+ lsb = data[0] & 0xff;
+- msb = (data[0] >> 8) & 0xf;
++ msb = (data[0] >> 8) & 0xff;
+
+ chan = CR_CHAN(insn->chanspec);
+
+From e6391a182865efc896cb2a8d79e07b7ac2f45b48 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti at mev.co.uk>
+Date: Fri, 31 Aug 2012 20:41:29 +0100
+Subject: staging: comedi: das08: Correct AI encoding for das08jr-16-ao
+
+From: Ian Abbott <abbotti at mev.co.uk>
+
+commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.
+
+The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
+`ai_encoding` member set to `das08_encode12`. It should be set to
+`das08_encode16` same as the 'das08jr/16' board. After all, this board
+has 16-bit AI resolution.
+
+The description of the A/D LSB register at offset 0 seems incorrect in
+the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
+resolution is only 12 bits. The diagrams of the A/D LSB and MSB
+registers show 15 data bits and a sign bit, which matches what the
+software expects for the `das08_encode16` AI encoding method.
+
+Signed-off-by: Ian Abbott <abbotti at mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/das08.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -403,7 +403,7 @@ static const struct das08_board_struct d
+ .ai = das08_ai_rinsn,
+ .ai_nbits = 16,
+ .ai_pg = das08_pg_none,
+- .ai_encoding = das08_encode12,
++ .ai_encoding = das08_encode16,
+ .ao = das08jr_ao_winsn,
+ .ao_nbits = 16,
+ .di = das08jr_di_rbits,
+From ba9edaa468869a8cea242a411066b0f490751798 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+Date: Tue, 11 Sep 2012 09:40:31 +0200
+Subject: USB: option: replace ZTE K5006-Z entry with vendor class rule
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn at mork.no>
+
+commit ba9edaa468869a8cea242a411066b0f490751798 upstream.
+
+Fix the ZTE K5006-Z entry so that it actually matches anything
+
+ commit f1b5c997 USB: option: add ZTE K5006-Z
+
+added a device specific entry assuming that the device would use
+class/subclass/proto == ff/ff/ff like other ZTE devices. It
+turns out that ZTE has started using vendor specific subclass
+and protocol codes:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=1018 Rev= 0.00
+S: Manufacturer=ZTE,Incorporated
+S: Product=ZTE LTE Technologies MSM
+S: SerialNumber=MF821Vxxxxxxx
+C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none)
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+We do not have any information on how ZTE intend to use these
+codes, but let us assume for now that the 3 sets matching
+serial functions in the K5006-Z always will identify a serial
+function in a ZTE device.
+
+Cc: Thomas Schäfer <tschaefer at t-online.de>
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -886,8 +886,6 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
+- .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
+@@ -1092,6 +1090,10 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
++
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
+From 6bf6104573482570f7103d3e5ddf9574db43a363 Mon Sep 17 00:00:00 2001
+From: Francesco Ruggeri <fruggeri at aristanetworks.com>
+Date: Thu, 13 Sep 2012 15:03:37 -0700
+Subject: fs/proc: fix potential unregister_sysctl_table hang
+
+From: Francesco Ruggeri <fruggeri at aristanetworks.com>
+
+commit 6bf6104573482570f7103d3e5ddf9574db43a363 upstream.
+
+The unregister_sysctl_table() function hangs if all references to its
+ctl_table_header structure are not dropped.
+
+This can happen sometimes because of a leak in proc_sys_lookup():
+proc_sys_lookup() gets a reference to the table via lookup_entry(), but
+it does not release it when a subsequent call to sysctl_follow_link()
+fails.
+
+This patch fixes this leak by making sure the reference is always
+dropped on return.
+
+See also commit 076c3eed2c31 ("sysctl: Rewrite proc_sys_lookup
+introducing find_entry and lookup_entry") which reorganized this code in
+3.4.
+
+Tested in Linux 3.4.4.
+
+Signed-off-by: Francesco Ruggeri <fruggeri at aristanetworks.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ fs/proc/proc_sysctl.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(st
+
+ err = ERR_PTR(-ENOMEM);
+ inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+- if (h)
+- sysctl_head_finish(h);
+-
+ if (!inode)
+ goto out;
+
+@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(st
+ d_add(dentry, inode);
+
+ out:
++ if (h)
++ sysctl_head_finish(h);
+ sysctl_head_finish(head);
+ return err;
+ }
+From c921928661eda599d73a6a86e58bdd5aecfa18cb Mon Sep 17 00:00:00 2001
+From: Stephen Warren <swarren at nvidia.com>
+Date: Fri, 24 Aug 2012 21:20:15 -0600
+Subject: sound: tegra_alc5632: remove HP detect GPIO inversion
+
+From: Stephen Warren <swarren at nvidia.com>
+
+commit c921928661eda599d73a6a86e58bdd5aecfa18cb upstream.
+
+Both the schematics and practical testing show that the HP detect GPIO
+is high when the headphones are plugged in. Hence, the snd_soc_jack_gpio
+should not specify to invert the signal.
+
+Signed-off-by: Stephen Warren <swarren at nvidia.com>
+Acked-by: Andrey Danin <danindrey at mail.ru>
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/soc/tegra/tegra_alc5632.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/tegra/tegra_alc5632.c
++++ b/sound/soc/tegra/tegra_alc5632.c
+@@ -92,7 +92,6 @@ static struct snd_soc_jack_gpio tegra_al
+ .name = "Headset detection",
+ .report = SND_JACK_HEADSET,
+ .debounce_time = 150,
+- .invert = 1,
+ };
+
+ static const struct snd_soc_dapm_widget tegra_alc5632_dapm_widgets[] = {
+From a6fa941d94b411bbd2b6421ffbde6db3c93e65ab Mon Sep 17 00:00:00 2001
+From: Al Viro <viro at ZenIV.linux.org.uk>
+Date: Mon, 20 Aug 2012 14:59:25 +0100
+Subject: perf_event: Switch to internal refcount, fix race with close()
+
+From: Al Viro <viro at ZenIV.linux.org.uk>
+
+commit a6fa941d94b411bbd2b6421ffbde6db3c93e65ab upstream.
+
+Don't mess with file refcounts (or keep a reference to file, for
+that matter) in perf_event. Use explicit refcount of its own
+instead. Deal with the race between the final reference to event
+going away and new children getting created for it by use of
+atomic_long_inc_not_zero() in inherit_event(); just have the
+latter free what it had allocated and return NULL, that works
+out just fine (children of siblings of something doomed are
+created as singletons, same as if the child of leader had been
+created and immediately killed).
+
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
+Link: http://lkml.kernel.org/r/20120820135925.GG23464@ZenIV.linux.org.uk
+Signed-off-by: Ingo Molnar <mingo at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/linux/perf_event.h | 2 -
+ kernel/events/core.c | 62 +++++++++++++++++++++++----------------------
+ 2 files changed, 34 insertions(+), 30 deletions(-)
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -925,7 +925,7 @@ struct perf_event {
+ struct hw_perf_event hw;
+
+ struct perf_event_context *ctx;
+- struct file *filp;
++ atomic_long_t refcount;
+
+ /*
+ * These accumulate total time (in nanoseconds) that children
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -2933,12 +2933,12 @@ EXPORT_SYMBOL_GPL(perf_event_release_ker
+ /*
+ * Called when the last reference to the file is gone.
+ */
+-static int perf_release(struct inode *inode, struct file *file)
++static void put_event(struct perf_event *event)
+ {
+- struct perf_event *event = file->private_data;
+ struct task_struct *owner;
+
+- file->private_data = NULL;
++ if (!atomic_long_dec_and_test(&event->refcount))
++ return;
+
+ rcu_read_lock();
+ owner = ACCESS_ONCE(event->owner);
+@@ -2973,7 +2973,13 @@ static int perf_release(struct inode *in
+ put_task_struct(owner);
+ }
+
+- return perf_event_release_kernel(event);
++ perf_event_release_kernel(event);
++}
++
++static int perf_release(struct inode *inode, struct file *file)
++{
++ put_event(file->private_data);
++ return 0;
+ }
+
+ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3225,7 +3231,7 @@ unlock:
+
+ static const struct file_operations perf_fops;
+
+-static struct perf_event *perf_fget_light(int fd, int *fput_needed)
++static struct file *perf_fget_light(int fd, int *fput_needed)
+ {
+ struct file *file;
+
+@@ -3239,7 +3245,7 @@ static struct perf_event *perf_fget_ligh
+ return ERR_PTR(-EBADF);
+ }
+
+- return file->private_data;
++ return file;
+ }
+
+ static int perf_event_set_output(struct perf_event *event,
+@@ -3271,19 +3277,21 @@ static long perf_ioctl(struct file *file
+
+ case PERF_EVENT_IOC_SET_OUTPUT:
+ {
++ struct file *output_file = NULL;
+ struct perf_event *output_event = NULL;
+ int fput_needed = 0;
+ int ret;
+
+ if (arg != -1) {
+- output_event = perf_fget_light(arg, &fput_needed);
+- if (IS_ERR(output_event))
+- return PTR_ERR(output_event);
++ output_file = perf_fget_light(arg, &fput_needed);
++ if (IS_ERR(output_file))
++ return PTR_ERR(output_file);
++ output_event = output_file->private_data;
+ }
+
+ ret = perf_event_set_output(event, output_event);
+ if (output_event)
+- fput_light(output_event->filp, fput_needed);
++ fput_light(output_file, fput_needed);
+
+ return ret;
+ }
+@@ -5922,6 +5930,7 @@ perf_event_alloc(struct perf_event_attr
+
+ mutex_init(&event->mmap_mutex);
+
++ atomic_long_set(&event->refcount, 1);
+ event->cpu = cpu;
+ event->attr = *attr;
+ event->group_leader = group_leader;
+@@ -6232,12 +6241,12 @@ SYSCALL_DEFINE5(perf_event_open,
+ return event_fd;
+
+ if (group_fd != -1) {
+- group_leader = perf_fget_light(group_fd, &fput_needed);
+- if (IS_ERR(group_leader)) {
+- err = PTR_ERR(group_leader);
++ group_file = perf_fget_light(group_fd, &fput_needed);
++ if (IS_ERR(group_file)) {
++ err = PTR_ERR(group_file);
+ goto err_fd;
+ }
+- group_file = group_leader->filp;
++ group_leader = group_file->private_data;
+ if (flags & PERF_FLAG_FD_OUTPUT)
+ output_event = group_leader;
+ if (flags & PERF_FLAG_FD_NO_GROUP)
+@@ -6372,7 +6381,6 @@ SYSCALL_DEFINE5(perf_event_open,
+ put_ctx(gctx);
+ }
+
+- event->filp = event_file;
+ WARN_ON_ONCE(ctx->parent_ctx);
+ mutex_lock(&ctx->mutex);
+
+@@ -6462,7 +6470,6 @@ perf_event_create_kernel_counter(struct
+ goto err_free;
+ }
+
+- event->filp = NULL;
+ WARN_ON_ONCE(ctx->parent_ctx);
+ mutex_lock(&ctx->mutex);
+ perf_install_in_context(ctx, event, cpu);
+@@ -6511,7 +6518,7 @@ static void sync_child_event(struct perf
+ * Release the parent event, if this was the last
+ * reference to it.
+ */
+- fput(parent_event->filp);
++ put_event(parent_event);
+ }
+
+ static void
+@@ -6587,9 +6594,8 @@ static void perf_event_exit_task_context
+ *
+ * __perf_event_exit_task()
+ * sync_child_event()
+- * fput(parent_event->filp)
+- * perf_release()
+- * mutex_lock(&ctx->mutex)
++ * put_event()
++ * mutex_lock(&ctx->mutex)
+ *
+ * But since its the parent context it won't be the same instance.
+ */
+@@ -6657,7 +6663,7 @@ static void perf_free_event(struct perf_
+ list_del_init(&event->child_list);
+ mutex_unlock(&parent->child_mutex);
+
+- fput(parent->filp);
++ put_event(parent);
+
+ perf_group_detach(event);
+ list_del_event(event, ctx);
+@@ -6737,6 +6743,12 @@ inherit_event(struct perf_event *parent_
+ NULL, NULL);
+ if (IS_ERR(child_event))
+ return child_event;
++
++ if (!atomic_long_inc_not_zero(&parent_event->refcount)) {
++ free_event(child_event);
++ return NULL;
++ }
++
+ get_ctx(child_ctx);
+
+ /*
+@@ -6778,14 +6790,6 @@ inherit_event(struct perf_event *parent_
+ raw_spin_unlock_irqrestore(&child_ctx->lock, flags);
+
+ /*
+- * Get a reference to the parent filp - we will fput it
+- * when the child event exits. This is safe to do because
+- * we are in the parent and we know that the filp still
+- * exists and has a nonzero count:
+- */
+- atomic_long_inc(&parent_event->filp->f_count);
+-
+- /*
+ * Link this into the parent event's child list
+ */
+ WARN_ON_ONCE(parent_event->ctx->parent_ctx);
+From 8f7412a792bc989d1bddd3c802282eec09456d57 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rjw at sisk.pl>
+Date: Fri, 14 Sep 2012 00:26:24 +0200
+Subject: ACPI / PM: Infer parent power state from child if unknown, v2
+
+From: "Rafael J. Wysocki" <rjw at sisk.pl>
+
+commit 8f7412a792bc989d1bddd3c802282eec09456d57 upstream.
+
+It turns out that there are ACPI BIOSes defining device objects with
+_PSx and without either _PSC or _PRx. For devices corresponding to
+those ACPI objetcs __acpi_bus_get_power() returns ACPI_STATE_UNKNOWN
+and their initial power states are regarded as unknown as a result.
+If such a device is a parent of another power-manageable device, the
+child cannot be put into a low-power state through ACPI, because
+__acpi_bus_set_power() refuses to change power states of devices
+whose parents' power states are unknown.
+
+To work around this problem, observe that the ACPI power state of
+a device cannot be higher-power (lower-number) than the power state
+of its parent. Thus, if the device's _PSC method or the
+configuration of its power resources indicates that the device is
+in D0, the device's parent has to be in D0 as well. Consequently,
+if the parent's power state is unknown when we've just learned that
+its child's power state is D0, we can safely set the parent's
+power.state field to ACPI_STATE_D0.
+
+Tested-by: Aaron Lu <aaron.lu at intel.com>
+Signed-off-by: Rafael J. Wysocki <rjw at sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/acpi/bus.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -237,6 +237,16 @@ static int __acpi_bus_get_power(struct a
+ } else if (result == ACPI_STATE_D3_HOT) {
+ result = ACPI_STATE_D3;
+ }
++
++ /*
++ * If we were unsure about the device parent's power state up to this
++ * point, the fact that the device is in D0 implies that the parent has
++ * to be in D0 too.
++ */
++ if (device->parent && device->parent->power.state == ACPI_STATE_UNKNOWN
++ && result == ACPI_STATE_D0)
++ device->parent->power.state = ACPI_STATE_D0;
++
+ *state = result;
+
+ out:
+From 40bf66ec9791f1452b90b82aadc3b6e6aee201f5 Mon Sep 17 00:00:00 2001
+From: Lin Ming <ming.m.lin at intel.com>
+Date: Fri, 14 Sep 2012 00:26:33 +0200
+Subject: ACPI / PM: Fix resource_lock dead lock in acpi_power_on_device
+
+From: Lin Ming <ming.m.lin at intel.com>
+
+commit 40bf66ec9791f1452b90b82aadc3b6e6aee201f5 upstream.
+
+Commit 0090def("ACPI: Add interface to register/unregister device
+to/from power resources") used resource_lock to protect the devices list
+that relies on power resource. It caused a mutex dead lock, as below
+
+ acpi_power_on ---> lock resource_lock
+ __acpi_power_on
+ acpi_power_on_device
+ acpi_power_get_inferred_state
+ acpi_power_get_list_state ---> lock resource_lock
+
+This patch adds a new mutex "devices_lock" to protect the devices list
+and calls acpi_power_on_device in acpi_power_on, instead of
+__acpi_power_on, after the resource_lock is released.
+
+[rjw: Changed data type of a boolean variable to bool.]
+
+Signed-off-by: Lin Ming <ming.m.lin at intel.com>
+Signed-off-by: Aaron Lu <aaron.lu at intel.com>
+Signed-off-by: Rafael J. Wysocki <rjw at sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/acpi/power.c | 34 +++++++++++++++++++++++-----------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+--- a/drivers/acpi/power.c
++++ b/drivers/acpi/power.c
+@@ -103,6 +103,7 @@ struct acpi_power_resource {
+
+ /* List of devices relying on this power resource */
+ struct acpi_power_resource_device *devices;
++ struct mutex devices_lock;
+ };
+
+ static struct list_head acpi_power_resource_list;
+@@ -221,7 +222,6 @@ static void acpi_power_on_device(struct
+
+ static int __acpi_power_on(struct acpi_power_resource *resource)
+ {
+- struct acpi_power_resource_device *device_list = resource->devices;
+ acpi_status status = AE_OK;
+
+ status = acpi_evaluate_object(resource->device->handle, "_ON", NULL, NULL);
+@@ -234,19 +234,15 @@ static int __acpi_power_on(struct acpi_p
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Power resource [%s] turned on\n",
+ resource->name));
+
+- while (device_list) {
+- acpi_power_on_device(device_list->device);
+-
+- device_list = device_list->next;
+- }
+-
+ return 0;
+ }
+
+ static int acpi_power_on(acpi_handle handle)
+ {
+ int result = 0;
++ bool resume_device = false;
+ struct acpi_power_resource *resource = NULL;
++ struct acpi_power_resource_device *device_list;
+
+ result = acpi_power_get_context(handle, &resource);
+ if (result)
+@@ -262,10 +258,25 @@ static int acpi_power_on(acpi_handle han
+ result = __acpi_power_on(resource);
+ if (result)
+ resource->ref_count--;
++ else
++ resume_device = true;
+ }
+
+ mutex_unlock(&resource->resource_lock);
+
++ if (!resume_device)
++ return result;
++
++ mutex_lock(&resource->devices_lock);
++
++ device_list = resource->devices;
++ while (device_list) {
++ acpi_power_on_device(device_list->device);
++ device_list = device_list->next;
++ }
++
++ mutex_unlock(&resource->devices_lock);
++
+ return result;
+ }
+
+@@ -351,7 +362,7 @@ static void __acpi_power_resource_unregi
+ if (acpi_power_get_context(res_handle, &resource))
+ return;
+
+- mutex_lock(&resource->resource_lock);
++ mutex_lock(&resource->devices_lock);
+ prev = NULL;
+ curr = resource->devices;
+ while (curr) {
+@@ -368,7 +379,7 @@ static void __acpi_power_resource_unregi
+ prev = curr;
+ curr = curr->next;
+ }
+- mutex_unlock(&resource->resource_lock);
++ mutex_unlock(&resource->devices_lock);
+ }
+
+ /* Unlink dev from all power resources in _PR0 */
+@@ -409,10 +420,10 @@ static int __acpi_power_resource_registe
+
+ power_resource_device->device = powered_device;
+
+- mutex_lock(&resource->resource_lock);
++ mutex_lock(&resource->devices_lock);
+ power_resource_device->next = resource->devices;
+ resource->devices = power_resource_device;
+- mutex_unlock(&resource->resource_lock);
++ mutex_unlock(&resource->devices_lock);
+
+ return 0;
+ }
+@@ -715,6 +726,7 @@ static int acpi_power_add(struct acpi_de
+
+ resource->device = device;
+ mutex_init(&resource->resource_lock);
++ mutex_init(&resource->devices_lock);
+ strcpy(resource->name, device->pnp.bus_id);
+ strcpy(acpi_device_name(device), ACPI_POWER_DEVICE_NAME);
+ strcpy(acpi_device_class(device), ACPI_POWER_CLASS);
+From f25b70613c048ceb1df052576fda03321ebf41cf Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu at intel.com>
+Date: Fri, 14 Sep 2012 20:54:44 +0200
+Subject: ACPI / PM: Use KERN_DEBUG when no power resources are found
+
+From: Aaron Lu <aaron.lu at intel.com>
+
+commit f25b70613c048ceb1df052576fda03321ebf41cf upstream.
+
+commit a606dac368eed5696fb38e16b1394f1d049c09e9 adds support to link
+devices which have _PRx, if a device does not have _PRx, a warning
+message will be printed.
+
+This commit is for ZPODD on Intel ZPODD capable platforms, on other
+platforms, it has no problem if there is no power resource for this
+device, so a warning here is not appropriate, change it to debug.
+
+Reported-by: Borislav Petkov <bp at amd64.org>
+Signed-off-by: Aaron Lu <aaron.lu at intel.com>
+Signed-off-by: Rafael J. Wysocki <rjw at sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/acpi/power.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/acpi/power.c
++++ b/drivers/acpi/power.c
+@@ -468,7 +468,7 @@ int acpi_power_resource_register_device(
+ return ret;
+
+ no_power_resource:
+- printk(KERN_WARNING PREFIX "Invalid Power Resource to register!");
++ printk(KERN_DEBUG PREFIX "Invalid Power Resource to register!");
+ return -ENODEV;
+ }
+
+From 1af36b2a993dddfa3d6860ec4879c9e8abc9b976 Mon Sep 17 00:00:00 2001
+From: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+Date: Tue, 17 Jul 2012 17:16:09 +0300
+Subject: mmc: mxs-mmc: fix deadlock in SDIO IRQ case
+
+From: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+
+commit 1af36b2a993dddfa3d6860ec4879c9e8abc9b976 upstream.
+
+Release the lock before mmc_signal_sdio_irq is called by mxs_mmc_irq_handler.
+
+Backtrace:
+[ 79.660000] =============================================
+[ 79.660000] [ INFO: possible recursive locking detected ]
+[ 79.660000] 3.4.0-00009-g3e96082-dirty #11 Not tainted
+[ 79.660000] ---------------------------------------------
+[ 79.660000] swapper/0 is trying to acquire lock:
+[ 79.660000] (&(&host->lock)->rlock#2){-.....}, at: [<c026ea3c>] mxs_mmc_enable_sdio_irq+0x18/0xd4
+[ 79.660000]
+[ 79.660000] but task is already holding lock:
+[ 79.660000] (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
+[ 79.660000]
+[ 79.660000] other info that might help us debug this:
+[ 79.660000] Possible unsafe locking scenario:
+[ 79.660000]
+[ 79.660000] CPU0
+[ 79.660000] ----
+[ 79.660000] lock(&(&host->lock)->rlock#2);
+[ 79.660000] lock(&(&host->lock)->rlock#2);
+[ 79.660000]
+[ 79.660000] *** DEADLOCK ***
+[ 79.660000]
+[ 79.660000] May be due to missing lock nesting notation
+[ 79.660000]
+[ 79.660000] 1 lock held by swapper/0:
+[ 79.660000] #0: (&(&host->lock)->rlock#2){-.....}, at: [<c026f744>] mxs_mmc_irq_handler+0x1c/0xe8
+[ 79.660000]
+[ 79.660000] stack backtrace:
+[ 79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c005f9c0>] (__lock_acquire+0x1948/0x1d48)
+[ 79.660000] [<c005f9c0>] (__lock_acquire+0x1948/0x1d48) from [<c005fea0>] (lock_acquire+0xe0/0xf8)
+[ 79.660000] [<c005fea0>] (lock_acquire+0xe0/0xf8) from [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58)
+[ 79.660000] [<c03a8460>] (_raw_spin_lock_irqsave+0x44/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
+[ 79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
+[ 79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
+[ 79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
+[ 79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
+[ 79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
+[ 79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
+[ 79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
+[ 79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
+[ 79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
+[ 79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
+[ 79.660000] BUG: spinlock lockup on CPU#0, swapper/0
+[ 79.660000] lock: c398cb2c, .magic: dead4ead, .owner: swapper/0, .owner_cpu: 0
+[ 79.660000] [<c0014bd0>] (unwind_backtrace+0x0/0xf4) from [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144)
+[ 79.660000] [<c01ddb1c>] (do_raw_spin_lock+0xf0/0x144) from [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58)
+[ 79.660000] [<c03a8468>] (_raw_spin_lock_irqsave+0x4c/0x58) from [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4)
+[ 79.660000] [<c026ea3c>] (mxs_mmc_enable_sdio_irq+0x18/0xd4) from [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8)
+[ 79.660000] [<c026f7fc>] (mxs_mmc_irq_handler+0xd4/0xe8) from [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254)
+[ 79.660000] [<c006bdd8>] (handle_irq_event_percpu+0x70/0x254) from [<c006bff8>] (handle_irq_event+0x3c/0x5c)
+[ 79.660000] [<c006bff8>] (handle_irq_event+0x3c/0x5c) from [<c006e6d0>] (handle_level_irq+0x90/0x110)
+[ 79.660000] [<c006e6d0>] (handle_level_irq+0x90/0x110) from [<c006b930>] (generic_handle_irq+0x38/0x50)
+[ 79.660000] [<c006b930>] (generic_handle_irq+0x38/0x50) from [<c00102fc>] (handle_IRQ+0x30/0x84)
+[ 79.660000] [<c00102fc>] (handle_IRQ+0x30/0x84) from [<c000f058>] (__irq_svc+0x38/0x60)
+[ 79.660000] [<c000f058>] (__irq_svc+0x38/0x60) from [<c0010520>] (default_idle+0x2c/0x40)
+[ 79.660000] [<c0010520>] (default_idle+0x2c/0x40) from [<c0010a90>] (cpu_idle+0x64/0xcc)
+[ 79.660000] [<c0010a90>] (cpu_idle+0x64/0xcc) from [<c04ff858>] (start_kernel+0x244/0x2c8)
+
+Signed-off-by: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+Acked-by: Shawn Guo <shawn.guo at linaro.org>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/mmc/host/mxs-mmc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -278,11 +278,11 @@ static irqreturn_t mxs_mmc_irq_handler(i
+ writel(stat & MXS_MMC_IRQ_BITS,
+ host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
+
++ spin_unlock(&host->lock);
++
+ if ((stat & BM_SSP_CTRL1_SDIO_IRQ) && (stat & BM_SSP_CTRL1_SDIO_IRQ_EN))
+ mmc_signal_sdio_irq(host->mmc);
+
+- spin_unlock(&host->lock);
+-
+ if (stat & BM_SSP_CTRL1_RESP_TIMEOUT_IRQ)
+ cmd->error = -ETIMEDOUT;
+ else if (stat & BM_SSP_CTRL1_RESP_ERR_IRQ)
+From fc108d24d3a6da63576a460e122fa1df0cbdea20 Mon Sep 17 00:00:00 2001
+From: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+Date: Tue, 17 Jul 2012 17:16:10 +0300
+Subject: mmc: mxs-mmc: fix deadlock caused by recursion loop
+
+From: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+
+commit fc108d24d3a6da63576a460e122fa1df0cbdea20 upstream.
+
+Release the lock before mmc_signal_sdio_irq is called by
+mxs_mmc_enable_sdio_irq.
+
+Backtrace:
+[ 65.470000] =============================================
+[ 65.470000] [ INFO: possible recursive locking detected ]
+[ 65.470000] 3.5.0-rc5 #2 Not tainted
+[ 65.470000] ---------------------------------------------
+[ 65.470000] ksdioirqd/mmc0/73 is trying to acquire lock:
+[ 65.470000] (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
+[ 65.470000]
+[ 65.470000] but task is already holding lock:
+[ 65.470000] (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
+[ 65.470000]
+[ 65.470000] other info that might help us debug this:
+[ 65.470000] Possible unsafe locking scenario:
+[ 65.470000]
+[ 65.470000] CPU0
+[ 65.470000] ----
+[ 65.470000] lock(&(&host->lock)->rlock#2);
+[ 65.470000] lock(&(&host->lock)->rlock#2);
+[ 65.470000]
+[ 65.470000] *** DEADLOCK ***
+[ 65.470000]
+[ 65.470000] May be due to missing lock nesting notation
+[ 65.470000]
+[ 65.470000] 1 lock held by ksdioirqd/mmc0/73:
+[ 65.470000] #0: (&(&host->lock)->rlock#2){-.-...}, at: [<bf054120>] mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]
+[ 65.470000]
+[ 65.470000] stack backtrace:
+[ 65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98)
+[ 65.470000] [<c005ccb8>] (__lock_acquire+0x14f8/0x1b98) from [<c005d3f8>] (lock_acquire+0xa0/0x108)
+[ 65.470000] [<c005d3f8>] (lock_acquire+0xa0/0x108) from [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c)
+[ 65.470000] [<c02f671c>] (_raw_spin_lock_irqsave+0x48/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
+[ 65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
+[ 65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
+[ 65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
+[ 65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
+[ 65.470000] BUG: spinlock lockup suspected on CPU#0, ksdioirqd/mmc0/73
+[ 65.470000] lock: 0xc3358724, .magic: dead4ead, .owner: ksdioirqd/mmc0/73, .owner_cpu: 0
+[ 65.470000] [<c0014990>] (unwind_backtrace+0x0/0xf4) from [<c01b46b0>] (do_raw_spin_lock+0x100/0x144)
+[ 65.470000] [<c01b46b0>] (do_raw_spin_lock+0x100/0x144) from [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c)
+[ 65.470000] [<c02f6724>] (_raw_spin_lock_irqsave+0x50/0x5c) from [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc])
+[ 65.470000] [<bf054120>] (mxs_mmc_enable_sdio_irq+0x18/0xdc [mxs_mmc]) from [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc])
+[ 65.470000] [<bf0541d0>] (mxs_mmc_enable_sdio_irq+0xc8/0xdc [mxs_mmc]) from [<c0219b38>] (sdio_irq_thread+0x1bc/0x274)
+[ 65.470000] [<c0219b38>] (sdio_irq_thread+0x1bc/0x274) from [<c003c324>] (kthread+0x8c/0x98)
+[ 65.470000] [<c003c324>] (kthread+0x8c/0x98) from [<c00101ac>] (kernel_thread_exit+0x0/0x8)
+
+Reported-by: Attila Kinali <attila at kinali.ch>
+Signed-off-by: Lauri Hintsala <lauri.hintsala at bluegiga.com>
+Acked-by: Shawn Guo <shawn.guo at linaro.org>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/mmc/host/mxs-mmc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/host/mxs-mmc.c
++++ b/drivers/mmc/host/mxs-mmc.c
+@@ -637,11 +637,6 @@ static void mxs_mmc_enable_sdio_irq(stru
+ host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+ writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
+ host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_SET);
+-
+- if (readl(host->base + HW_SSP_STATUS(host)) &
+- BM_SSP_STATUS_SDIO_IRQ)
+- mmc_signal_sdio_irq(host->mmc);
+-
+ } else {
+ writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
+ host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+@@ -650,6 +645,11 @@ static void mxs_mmc_enable_sdio_irq(stru
+ }
+
+ spin_unlock_irqrestore(&host->lock, flags);
++
++ if (enable && readl(host->base + HW_SSP_STATUS(host)) &
++ BM_SSP_STATUS_SDIO_IRQ)
++ mmc_signal_sdio_irq(host->mmc);
++
+ }
+
+ static const struct mmc_host_ops mxs_mmc_ops = {
+From 74f330bceaa7b88d06062e1cac3d519a3dfc041e Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo at linaro.org>
+Date: Wed, 22 Aug 2012 23:10:01 +0800
+Subject: mmc: sdhci-esdhc: break out early if clock is 0
+
+From: Shawn Guo <shawn.guo at linaro.org>
+
+commit 74f330bceaa7b88d06062e1cac3d519a3dfc041e upstream.
+
+Since commit 30832ab56 ("mmc: sdhci: Always pass clock request value
+zero to set_clock host op") was merged, esdhc_set_clock starts hitting
+"if (clock == 0)" where ESDHC_SYSTEM_CONTROL has been operated. This
+causes SDHCI card-detection function being broken. Fix the regression
+by moving "if (clock == 0)" above ESDHC_SYSTEM_CONTROL operation.
+
+Signed-off-by: Shawn Guo <shawn.guo at linaro.org>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-esdhc.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -48,14 +48,14 @@ static inline void esdhc_set_clock(struc
+ int div = 1;
+ u32 temp;
+
++ if (clock == 0)
++ goto out;
++
+ temp = sdhci_readl(host, ESDHC_SYSTEM_CONTROL);
+ temp &= ~(ESDHC_CLOCK_IPGEN | ESDHC_CLOCK_HCKEN | ESDHC_CLOCK_PEREN
+ | ESDHC_CLOCK_MASK);
+ sdhci_writel(host, temp, ESDHC_SYSTEM_CONTROL);
+
+- if (clock == 0)
+- goto out;
+-
+ while (host->max_clk / pre_div / 16 > clock && pre_div < 256)
+ pre_div *= 2;
+
+From 077d40731edc90ee9dedf63249034c8cd5f694ce Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches at atmel.com>
+Date: Tue, 24 Jul 2012 11:42:04 +0200
+Subject: mmc: atmel-mci: not busy flag has also to be used for read operations
+
+From: Ludovic Desroches <ludovic.desroches at atmel.com>
+
+commit 077d40731edc90ee9dedf63249034c8cd5f694ce upstream.
+
+Even if the datasheet says that the not busy flag has to be used only
+for write operations, it's false except for version lesser than v2xx.
+
+Not waiting on the not busy flag for read operations can cause the
+controller to hang-up during the initialization of some SD cards
+with DMA after the first CMD6 -- the next command is sent too early.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches at atmel.com>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/mmc/host/atmel-mci.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -81,6 +81,7 @@ struct atmel_mci_caps {
+ bool has_bad_data_ordering;
+ bool need_reset_after_xfer;
+ bool need_blksz_mul_4;
++ bool need_notbusy_for_read_ops;
+ };
+
+ struct atmel_mci_dma {
+@@ -1619,7 +1620,8 @@ static void atmci_tasklet_func(unsigned
+ __func__);
+ atmci_set_completed(host, EVENT_XFER_COMPLETE);
+
+- if (host->data->flags & MMC_DATA_WRITE) {
++ if (host->caps.need_notbusy_for_read_ops ||
++ (host->data->flags & MMC_DATA_WRITE)) {
+ atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY);
+ state = STATE_WAITING_NOTBUSY;
+ } else if (host->mrq->stop) {
+@@ -2212,6 +2214,7 @@ static void __init atmci_get_cap(struct
+ host->caps.has_bad_data_ordering = 1;
+ host->caps.need_reset_after_xfer = 1;
+ host->caps.need_blksz_mul_4 = 1;
++ host->caps.need_notbusy_for_read_ops = 0;
+
+ /* keep only major version number */
+ switch (version & 0xf00) {
+@@ -2232,6 +2235,7 @@ static void __init atmci_get_cap(struct
+ case 0x200:
+ host->caps.has_rwproof = 1;
+ host->caps.need_blksz_mul_4 = 0;
++ host->caps.need_notbusy_for_read_ops = 1;
+ case 0x100:
+ host->caps.has_bad_data_ordering = 0;
+ host->caps.need_reset_after_xfer = 0;
+From 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 Mon Sep 17 00:00:00 2001
+From: Ian Chen <ian.cy.chen at samsung.com>
+Date: Wed, 29 Aug 2012 15:05:36 +0900
+Subject: mmc: card: Skip secure erase on MoviNAND; causes unrecoverable corruption.
+
+From: Ian Chen <ian.cy.chen at samsung.com>
+
+commit 3550ccdb9d8d350e526b809bf3dd92b550a74fe1 upstream.
+
+For several MoviNAND eMMC parts, there are known issues with secure
+erase and secure trim. For these specific MoviNAND devices, we skip
+these operations.
+
+Specifically, there is a bug in the eMMC firmware that causes
+unrecoverable corruption when the MMC is erased with MMC_CAP_ERASE
+enabled.
+
+References:
+
+http://forum.xda-developers.com/showthread.php?t=1644364
+https://plus.google.com/111398485184813224730/posts/21pTYfTsCkB#111398485184813224730/posts/21pTYfTsCkB
+
+Signed-off-by: Ian Chen <ian.cy.chen at samsung.com>
+Reviewed-by: Namjae Jeon <linkinjeon at gmail.com>
+Acked-by: Jaehoon Chung <jh80.chung at samsung.com>
+Reviewed-by: Linus Walleij <linus.walleij at linaro.org>
+Signed-off-by: Chris Ball <cjb at laptop.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 26 +++++++++++++++++++++++++-
+ include/linux/mmc/card.h | 1 +
+ 2 files changed, 26 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1429,7 +1429,8 @@ static int mmc_blk_issue_rq(struct mmc_q
+ /* complete ongoing async transfer before issuing discard */
+ if (card->host->areq)
+ mmc_blk_issue_rw_rq(mq, NULL);
+- if (req->cmd_flags & REQ_SECURE)
++ if (req->cmd_flags & REQ_SECURE &&
++ !(card->quirks & MMC_QUIRK_SEC_ERASE_TRIM_BROKEN))
+ ret = mmc_blk_issue_secdiscard_rq(mq, req);
+ else
+ ret = mmc_blk_issue_discard_rq(mq, req);
+@@ -1734,6 +1735,7 @@ force_ro_fail:
+ #define CID_MANFID_SANDISK 0x2
+ #define CID_MANFID_TOSHIBA 0x11
+ #define CID_MANFID_MICRON 0x13
++#define CID_MANFID_SAMSUNG 0x15
+
+ static const struct mmc_fixup blk_fixups[] =
+ {
+@@ -1770,6 +1772,28 @@ static const struct mmc_fixup blk_fixups
+ MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc,
+ MMC_QUIRK_LONG_READ_TIME),
+
++ /*
++ * On these Samsung MoviNAND parts, performing secure erase or
++ * secure trim can result in unrecoverable corruption due to a
++ * firmware bug.
++ */
++ MMC_FIXUP("M8G2FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("MAG4FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("MBG8FA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("MCGAFA", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("VAL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("VYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("KYL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++ MMC_FIXUP("VZL00M", CID_MANFID_SAMSUNG, CID_OEMID_ANY, add_quirk_mmc,
++ MMC_QUIRK_SEC_ERASE_TRIM_BROKEN),
++
+ END_FIXUP
+ };
+
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -238,6 +238,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BLK_NO_CMD23 (1<<7) /* Avoid CMD23 for regular multiblock */
+ #define MMC_QUIRK_BROKEN_BYTE_MODE_512 (1<<8) /* Avoid sending 512 bytes in */
+ #define MMC_QUIRK_LONG_READ_TIME (1<<9) /* Data read time > CSD says */
++#define MMC_QUIRK_SEC_ERASE_TRIM_BROKEN (1<<10) /* Skip secure for erase/trim */
+ /* byte mode */
+ unsigned int poweroff_notify_state; /* eMMC4.5 notify feature */
+ #define MMC_NO_POWER_NOTIFICATION 0
+From 81ff3478d9ba7f0b48b0abef740e542fd83adf79 Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter at amd.com>
+Date: Thu, 19 Jul 2012 18:28:26 +0200
+Subject: oprofile, s390: Fix uninitialized memory access when writing to oprofilefs
+
+From: Robert Richter <robert.richter at amd.com>
+
+commit 81ff3478d9ba7f0b48b0abef740e542fd83adf79 upstream.
+
+If oprofilefs_ulong_from_user() is called with count equals zero, *val
+remains unchanged. Depending on the implementation it might be
+uninitialized. Fixing users of oprofilefs_ulong_ from_user().
+
+We missed these s390 changes with:
+
+ 913050b oprofile: Fix uninitialized memory access when writing to writing to oprofilefs
+
+Signed-off-by: Robert Richter <robert.richter at amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/s390/oprofile/init.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/s390/oprofile/init.c
++++ b/arch/s390/oprofile/init.c
+@@ -171,7 +171,7 @@ static ssize_t hw_interval_write(struct
+ if (*offset)
+ return -EINVAL;
+ retval = oprofilefs_ulong_from_user(&val, buf, count);
+- if (retval)
++ if (retval <= 0)
+ return retval;
+ if (val < oprofile_min_interval)
+ oprofile_hw_interval = oprofile_min_interval;
+@@ -214,7 +214,7 @@ static ssize_t hwsampler_zero_write(stru
+ return -EINVAL;
+
+ retval = oprofilefs_ulong_from_user(&val, buf, count);
+- if (retval)
++ if (retval <= 0)
+ return retval;
+ if (val != 0)
+ return -EINVAL;
+@@ -245,7 +245,7 @@ static ssize_t hwsampler_kernel_write(st
+ return -EINVAL;
+
+ retval = oprofilefs_ulong_from_user(&val, buf, count);
+- if (retval)
++ if (retval <= 0)
+ return retval;
+
+ if (val != 0 && val != 1)
+@@ -280,7 +280,7 @@ static ssize_t hwsampler_user_write(stru
+ return -EINVAL;
+
+ retval = oprofilefs_ulong_from_user(&val, buf, count);
+- if (retval)
++ if (retval <= 0)
+ return retval;
+
+ if (val != 0 && val != 1)
+@@ -319,7 +319,7 @@ static ssize_t timer_enabled_write(struc
+ return -EINVAL;
+
+ retval = oprofilefs_ulong_from_user(&val, buf, count);
+- if (retval)
++ if (retval <= 0)
+ return retval;
+
+ if (val != 0 && val != 1)
+From c0a48e6c75f2ac190d812bea5fc339696e434c2e Mon Sep 17 00:00:00 2001
+From: Michael Grzeschik <m.grzeschik at pengutronix.de>
+Date: Wed, 12 Sep 2012 14:58:01 +0300
+Subject: usb: chipidea: udc: add pullup fuction, needed by the uvc gadget
+
+From: Michael Grzeschik <m.grzeschik at pengutronix.de>
+
+commit c0a48e6c75f2ac190d812bea5fc339696e434c2e upstream.
+
+Add function to physicaly enable or disable of pullup connection on the USB-D+
+line. The uvc gaget will fail, if this function is not implemented.
+
+Signed-off-by: Michael Grzeschik <m.grzeschik at pengutronix.de>
+Acked-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Marc Kleine-Budde <mkl at pengutronix.de>
+Signed-off-by: Alexander Shishkin <alexander.shishkin at linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/udc.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -77,8 +77,7 @@ static inline int ep_to_bit(struct ci13x
+ }
+
+ /**
+- * hw_device_state: enables/disables interrupts & starts/stops device (execute
+- * without interruption)
++ * hw_device_state: enables/disables interrupts (execute without interruption)
+ * @dma: 0 => disable, !0 => enable and set dma engine
+ *
+ * This function returns an error code
+@@ -92,7 +91,6 @@ static int hw_device_state(struct ci13xx
+ USBi_UI|USBi_UEI|USBi_PCI|USBi_URI|USBi_SLI);
+ hw_write(udc, OP_USBCMD, USBCMD_RS, USBCMD_RS);
+ } else {
+- hw_write(udc, OP_USBCMD, USBCMD_RS, 0);
+ hw_write(udc, OP_USBINTR, ~0, 0);
+ }
+ return 0;
+@@ -1419,6 +1417,21 @@ static int ci13xxx_vbus_draw(struct usb_
+ return -ENOTSUPP;
+ }
+
++/* Change Data+ pullup status
++ * this func is used by usb_gadget_connect/disconnet
++ */
++static int ci13xxx_pullup(struct usb_gadget *_gadget, int is_on)
++{
++ struct ci13xxx *ci = container_of(_gadget, struct ci13xxx, gadget);
++
++ if (is_on)
++ hw_write(ci, OP_USBCMD, USBCMD_RS, USBCMD_RS);
++ else
++ hw_write(ci, OP_USBCMD, USBCMD_RS, 0);
++
++ return 0;
++}
++
+ static int ci13xxx_start(struct usb_gadget *gadget,
+ struct usb_gadget_driver *driver);
+ static int ci13xxx_stop(struct usb_gadget *gadget,
+@@ -1431,6 +1444,7 @@ static int ci13xxx_stop(struct usb_gadge
+ static const struct usb_gadget_ops usb_gadget_ops = {
+ .vbus_session = ci13xxx_vbus_session,
+ .wakeup = ci13xxx_wakeup,
++ .pullup = ci13xxx_pullup,
+ .vbus_draw = ci13xxx_vbus_draw,
+ .udc_start = ci13xxx_start,
+ .udc_stop = ci13xxx_stop,
+From 1b68a4ca2d038addb7314211d122fb6d7002b38b Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+Date: Sun, 19 Aug 2012 21:54:58 +0200
+Subject: usb: gadget: dummy_hcd: fixup error probe path
+
+From: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+
+commit 1b68a4ca2d038addb7314211d122fb6d7002b38b upstream.
+
+If USB2 host controller probes fine but USB3 does not then we don't
+remove the USB controller properly and lock up the system while the HUB
+code will try to enumerate the USB2 controller and access memory which
+is no longer available in case the dummy_hcd was compiled as a module.
+
+This is a problem since 448b6eb1 ("USB: Make sure to fetch the BOS desc
+for roothubs.) if used in USB3 mode because dummy does not provide this
+descriptor and explodes later.
+
+Signed-off-by: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/gadget/dummy_hcd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/dummy_hcd.c
++++ b/drivers/usb/gadget/dummy_hcd.c
+@@ -2503,10 +2503,8 @@ static int dummy_hcd_probe(struct platfo
+ hs_hcd->has_tt = 1;
+
+ retval = usb_add_hcd(hs_hcd, 0, 0);
+- if (retval != 0) {
+- usb_put_hcd(hs_hcd);
+- return retval;
+- }
++ if (retval)
++ goto put_usb2_hcd;
+
+ if (mod_data.is_super_speed) {
+ ss_hcd = usb_create_shared_hcd(&dummy_hcd, &pdev->dev,
+@@ -2525,6 +2523,8 @@ static int dummy_hcd_probe(struct platfo
+ put_usb3_hcd:
+ usb_put_hcd(ss_hcd);
+ dealloc_usb2_hcd:
++ usb_remove_hcd(hs_hcd);
++put_usb2_hcd:
+ usb_put_hcd(hs_hcd);
+ the_controller.hs_hcd = the_controller.ss_hcd = NULL;
+ return retval;
+From 3b9c1c5ba7a95caae8440ea47308496b14f7301a Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+Date: Sun, 19 Aug 2012 21:54:59 +0200
+Subject: usb: gadget: dummy_hcd: add support for USB_DT_BOS on rh
+
+From: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+
+commit 3b9c1c5ba7a95caae8440ea47308496b14f7301a upstream.
+
+Without a reply for USB_DT_BOS the USB3 mode does not work since
+448b6eb1 ("USB: Make sure to fetch the BOS desc for roothubs.).
+
+Signed-off-by: Sebastian Andrzej Siewior <sebastian at breakpoint.cc>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/gadget/dummy_hcd.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/usb/gadget/dummy_hcd.c
++++ b/drivers/usb/gadget/dummy_hcd.c
+@@ -1916,6 +1916,27 @@ done:
+ return retval;
+ }
+
++/* usb 3.0 root hub device descriptor */
++struct {
++ struct usb_bos_descriptor bos;
++ struct usb_ss_cap_descriptor ss_cap;
++} __packed usb3_bos_desc = {
++
++ .bos = {
++ .bLength = USB_DT_BOS_SIZE,
++ .bDescriptorType = USB_DT_BOS,
++ .wTotalLength = cpu_to_le16(sizeof(usb3_bos_desc)),
++ .bNumDeviceCaps = 1,
++ },
++ .ss_cap = {
++ .bLength = USB_DT_USB_SS_CAP_SIZE,
++ .bDescriptorType = USB_DT_DEVICE_CAPABILITY,
++ .bDevCapabilityType = USB_SS_CAP_TYPE,
++ .wSpeedSupported = cpu_to_le16(USB_5GBPS_OPERATION),
++ .bFunctionalitySupport = ilog2(USB_5GBPS_OPERATION),
++ },
++};
++
+ static inline void
+ ss_hub_descriptor(struct usb_hub_descriptor *desc)
+ {
+@@ -2006,6 +2027,18 @@ static int dummy_hub_control(
+ else
+ hub_descriptor((struct usb_hub_descriptor *) buf);
+ break;
++
++ case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
++ if (hcd->speed != HCD_USB3)
++ goto error;
++
++ if ((wValue >> 8) != USB_DT_BOS)
++ goto error;
++
++ memcpy(buf, &usb3_bos_desc, sizeof(usb3_bos_desc));
++ retval = sizeof(usb3_bos_desc);
++ break;
++
+ case GetHubStatus:
+ *(__le32 *) buf = cpu_to_le32(0);
+ break;
+From 8b7dda554cf61e87523dee412eaf598f8646bd79 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+Date: Fri, 20 Jul 2012 20:34:24 +0200
+Subject: usb: gadget: at91udc: don't overwrite driver data
+
+From: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+
+commit 8b7dda554cf61e87523dee412eaf598f8646bd79 upstream.
+
+The driver was converted to the new start/stop interface in f3d8bf34c2
+("usb: gadget: at91_udc: convert to new style start/stop interface").
+I overlooked that the driver is overwritting the private data which is
+used by the composite framework. The udc driver doesn't read it, it is
+only written here.
+
+Tested-by: Fabio Porcedda <fabio.porcedda at gmail.com>
+Tested-by: Mario Isidoro <Mario.Isidoro at tecmic.pt>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/gadget/at91_udc.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/gadget/at91_udc.c
++++ b/drivers/usb/gadget/at91_udc.c
+@@ -1634,7 +1634,6 @@ static int at91_start(struct usb_gadget
+ udc = container_of(gadget, struct at91_udc, gadget);
+ udc->driver = driver;
+ udc->gadget.dev.driver = &driver->driver;
+- dev_set_drvdata(&udc->gadget.dev, &driver->driver);
+ udc->enabled = 1;
+ udc->selfpowered = 1;
+
+@@ -1655,7 +1654,6 @@ static int at91_stop(struct usb_gadget *
+ spin_unlock_irqrestore(&udc->lock, flags);
+
+ udc->gadget.dev.driver = NULL;
+- dev_set_drvdata(&udc->gadget.dev, NULL);
+ udc->driver = NULL;
+
+ DBG("unbound from %s\n", driver->driver.name);
+From f3bb8e63a8ee0398dffe412e774d8801db7e1bf1 Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+Date: Fri, 20 Jul 2012 20:34:25 +0200
+Subject: usb: gadget: at91udc: Don't check for ep->ep.desc
+
+From: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+
+commit f3bb8e63a8ee0398dffe412e774d8801db7e1bf1 upstream.
+
+Earlier we used to check for ep->ep.desc to figure out if this ep has
+already been enabled and if so, abort.
+Ido Shayevitz removed the usb_endpoint_descriptor from private udc
+structure 5a6506f00 ("usb: gadget: Update at91_udc to use
+usb_endpoint_descriptor inside the struct usb_ep") but did not fix up
+the ep_enable condition because _now_ the member is always true and we
+can't check if this ep is enabled twice.
+
+Cc: Ido Shayevitz <idos at codeaurora.org>
+Tested-by: Fabio Porcedda <fabio.porcedda at gmail.com>
+Tested-by: Mario Isidoro <Mario.Isidoro at tecmic.pt>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
+Signed-off-by: Felipe Balbi <balbi at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/usb/gadget/at91_udc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/at91_udc.c
++++ b/drivers/usb/gadget/at91_udc.c
+@@ -475,8 +475,7 @@ static int at91_ep_enable(struct usb_ep
+ unsigned long flags;
+
+ if (!_ep || !ep
+- || !desc || ep->ep.desc
+- || _ep->name == ep0name
++ || !desc || _ep->name == ep0name
+ || desc->bDescriptorType != USB_DT_ENDPOINT
+ || (maxpacket = usb_endpoint_maxp(desc)) == 0
+ || maxpacket > ep->maxpacket) {
+@@ -530,7 +529,6 @@ ok:
+ tmp |= AT91_UDP_EPEDS;
+ __raw_writel(tmp, ep->creg);
+
+- ep->ep.desc = desc;
+ ep->ep.maxpacket = maxpacket;
+
+ /*
+From 17c60c6b763cb5b83b0185e7d38d01d18e55a05a Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan at linux.intel.com>
+Date: Tue, 4 Sep 2012 16:07:18 +0100
+Subject: ahci: Add alternate identifier for the 88SE9172
+
+From: Alan Cox <alan at linux.intel.com>
+
+commit 17c60c6b763cb5b83b0185e7d38d01d18e55a05a upstream.
+
+This can also appear as 0x9192. Reported in bugzilla and confirmed with the
+board documentation for these boards.
+
+Resolves-bug: https://bugzilla.kernel.org/show_bug.cgi?id=42970
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Jeff Garzik <jgarzik at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/ata/ahci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -396,6 +396,8 @@ static const struct pci_device_id ahci_p
+ .driver_data = board_ahci_yes_fbs }, /* 88se9125 */
+ { PCI_DEVICE(0x1b4b, 0x917a),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
++ { PCI_DEVICE(0x1b4b, 0x9192),
++ .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
+ { PCI_DEVICE(0x1b4b, 0x91a3),
+ .driver_data = board_ahci_yes_fbs },
+
+From 60e233a56609fd963c59e99bd75c663d63fa91b6 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn at mork.no>
+Date: Sun, 2 Sep 2012 15:41:34 +0200
+Subject: kobject: fix oops with "input0: bad kobj_uevent_env content in show_uevent()"
+
+From: Bjørn Mork <bjorn at mork.no>
+
+commit 60e233a56609fd963c59e99bd75c663d63fa91b6 upstream.
+
+Fengguang Wu <fengguang.wu at intel.com> writes:
+
+> After the __devinit* removal series, I can still get kernel panic in
+> show_uevent(). So there are more sources of bug..
+>
+> Debug patch:
+>
+> @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device
+> goto out;
+>
+> /* copy keys to file */
+> - for (i = 0; i < env->envp_idx; i++)
+> + dev_err(dev, "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name);
+> + for (i = 0; i < env->envp_idx; i++) {
+> + printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]);
+> count += sprintf(&buf[count], "%s\n", env->envp[i]);
+> + }
+>
+> Oops message, the env[] is again not properly initilized:
+>
+> [ 44.068623] input input0: uevent 61 env[805306368]: input0/.../input0
+> [ 44.069552] uevent 0 env[0]: (null)
+
+This is a completely different CONFIG_HOTPLUG problem, only
+demonstrating another reason why CONFIG_HOTPLUG should go away. I had a
+hard time trying to disable it anyway ;-)
+
+The problem this time is lots of code assuming that a call to
+add_uevent_var() will guarantee that env->buflen > 0. This is not true
+if CONFIG_HOTPLUG is unset. So things like this end up overwriting
+env->envp_idx because the array index is -1:
+
+ if (add_uevent_var(env, "MODALIAS="))
+ return -ENOMEM;
+ len = input_print_modalias(&env->buf[env->buflen - 1],
+ sizeof(env->buf) - env->buflen,
+ dev, 0);
+
+Don't know what the best action is, given that there seem to be a *lot*
+of this around the kernel. This patch "fixes" the problem for me, but I
+don't know if it can be considered an appropriate fix.
+
+[ It is the correct fix for now, for 3.7 forcing CONFIG_HOTPLUG to
+always be on is the longterm fix, but it's too late for 3.6 and older
+kernels to resolve this that way - gregkh ]
+
+Reported-by: Fengguang Wu <fengguang.wu at intel.com>
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Tested-by: Fengguang Wu <fengguang.wu at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/linux/kobject.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/kobject.h
++++ b/include/linux/kobject.h
+@@ -224,7 +224,7 @@ static inline int kobject_uevent_env(str
+
+ static inline __printf(2, 3)
+ int add_uevent_var(struct kobj_uevent_env *env, const char *format, ...)
+-{ return 0; }
++{ return -ENOMEM; }
+
+ static inline int kobject_action_type(const char *buf, size_t count,
+ enum kobject_action *type)
+From ebdc82899ec5ed35af1c79ed6a4eeda69dad9b90 Mon Sep 17 00:00:00 2001
+From: Markus Trippelsdorf <markus at trippelsdorf.de>
+Date: Sat, 18 Aug 2012 18:35:51 -0600
+Subject: dyndbg: fix for SOH in logging messages
+
+From: Markus Trippelsdorf <markus at trippelsdorf.de>
+
+commit ebdc82899ec5ed35af1c79ed6a4eeda69dad9b90 upstream.
+
+commit af7f2158fde was done against master, and clashed with structured
+logging's change of KERN_LEVEL to SOH.
+
+Bisected and fixed by Markus Trippelsdorf.
+
+Reported-by: Markus Trippelsdorf <markus at trippelsdorf.de>
+Signed-off-by: Jim Cromie <jim.cromie at gmail.com>
+Cc: Linus Torvalds <torvalds at linux-foundation.org>
+Cc: Andrew Morton <akpm at linux-foundation.org>
+Cc: Jason Baron <jbaron at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/base/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1895,8 +1895,8 @@ int __dev_printk(const char *level, cons
+ "DEVICE=+%s:%s", subsys, dev_name(dev));
+ }
+ skip:
+- if (level[3])
+- level_extra = &level[3]; /* skip past "<L>" */
++ if (level[2])
++ level_extra = &level[2]; /* skip past KERN_SOH "L" */
+
+ return printk_emit(0, level[1] - '0',
+ dictlen ? dict : NULL, dictlen,
+From 67a806d9499353fabd5b5ff07337f3aa88a1c3ba Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman at suse.de>
+Date: Sun, 19 Aug 2012 14:41:03 +1200
+Subject: Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
+
+From: Mel Gorman <mgorman at suse.de>
+
+commit 67a806d9499353fabd5b5ff07337f3aa88a1c3ba upstream.
+
+The following build error occurred during an alpha build:
+
+ net/core/sock.c:274:36: error: initializer element is not constant
+
+Dave Anglin says:
+> Here is the line in sock.i:
+>
+> struct static_key memalloc_socks = ((struct static_key) { .enabled =
+> ((atomic_t) { (0) }) });
+
+The above line contains two compound literals. It also uses a designated
+initializer to initialize the field enabled. A compound literal is not a
+constant expression.
+
+The location of the above statement isn't fully clear, but if a compound
+literal occurs outside the body of a function, the initializer list must
+consist of constant expressions.
+
+Signed-off-by: Mel Gorman <mgorman at suse.de>
+Signed-off-by: Fengguang Wu <fengguang.wu at intel.com>
+Signed-off-by: Michael Cree <mcree at orcon.net.nz>
+Acked-by: Matt Turner <mattst88 at gmail.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/alpha/include/asm/atomic.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/alpha/include/asm/atomic.h
++++ b/arch/alpha/include/asm/atomic.h
+@@ -14,8 +14,8 @@
+ */
+
+
+-#define ATOMIC_INIT(i) ( (atomic_t) { (i) } )
+-#define ATOMIC64_INIT(i) ( (atomic64_t) { (i) } )
++#define ATOMIC_INIT(i) { (i) }
++#define ATOMIC64_INIT(i) { (i) }
+
+ #define atomic_read(v) (*(volatile int *)&(v)->counter)
+ #define atomic64_read(v) (*(volatile long *)&(v)->counter)
+From bc01637a80f5b670bd70a0279d3f93fa8de1c96d Mon Sep 17 00:00:00 2001
+From: Dmitry Kasatkin <dmitry.kasatkin at intel.com>
+Date: Wed, 12 Sep 2012 13:26:55 +0300
+Subject: digsig: add hash size comparision on signature verification
+
+From: Dmitry Kasatkin <dmitry.kasatkin at intel.com>
+
+commit bc01637a80f5b670bd70a0279d3f93fa8de1c96d upstream.
+
+When pkcs_1_v1_5_decode_emsa() returns without error and hash sizes do
+not match, hash comparision is not done and digsig_verify_rsa() returns
+no error. This is a bug and this patch fixes it.
+
+The bug was introduced in v3.3 by commit b35e286a640f ("lib/digsig:
+pkcs_1_v1_5_decode_emsa cleanup").
+
+Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin at intel.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ lib/digsig.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/lib/digsig.c
++++ b/lib/digsig.c
+@@ -163,9 +163,11 @@ static int digsig_verify_rsa(struct key
+ memcpy(out1 + head, p, l);
+
+ err = pkcs_1_v1_5_decode_emsa(out1, len, mblen, out2, &len);
++ if (err)
++ goto err;
+
+- if (!err && len == hlen)
+- err = memcmp(out2, h, hlen);
++ if (len != hlen || memcmp(out2, h, hlen))
++ err = -EINVAL;
+
+ err:
+ mpi_free(in);
+From f39c1bfb5a03e2d255451bff05be0d7255298fa4 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <Trond.Myklebust at netapp.com>
+Date: Fri, 7 Sep 2012 11:08:50 -0400
+Subject: SUNRPC: Fix a UDP transport regression
+
+From: Trond Myklebust <Trond.Myklebust at netapp.com>
+
+commit f39c1bfb5a03e2d255451bff05be0d7255298fa4 upstream.
+
+Commit 43cedbf0e8dfb9c5610eb7985d5f21263e313802 (SUNRPC: Ensure that
+we grab the XPRT_LOCK before calling xprt_alloc_slot) is causing
+hangs in the case of NFS over UDP mounts.
+
+Since neither the UDP or the RDMA transport mechanism use dynamic slot
+allocation, we can skip grabbing the socket lock for those transports.
+Add a new rpc_xprt_op to allow switching between the TCP and UDP/RDMA
+case.
+
+Note that the NFSv4.1 back channel assigns the slot directly
+through rpc_run_bc_task, so we can ignore that case.
+
+Reported-by: Dick Streefland <dick.streefland at altium.nl>
+Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/linux/sunrpc/xprt.h | 3 +++
+ net/sunrpc/xprt.c | 34 ++++++++++++++++++++--------------
+ net/sunrpc/xprtrdma/transport.c | 1 +
+ net/sunrpc/xprtsock.c | 3 +++
+ 4 files changed, 27 insertions(+), 14 deletions(-)
+
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -114,6 +114,7 @@ struct rpc_xprt_ops {
+ void (*set_buffer_size)(struct rpc_xprt *xprt, size_t sndsize, size_t rcvsize);
+ int (*reserve_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
+ void (*release_xprt)(struct rpc_xprt *xprt, struct rpc_task *task);
++ void (*alloc_slot)(struct rpc_xprt *xprt, struct rpc_task *task);
+ void (*rpcbind)(struct rpc_task *task);
+ void (*set_port)(struct rpc_xprt *xprt, unsigned short port);
+ void (*connect)(struct rpc_task *task);
+@@ -279,6 +280,8 @@ void xprt_connect(struct rpc_task *tas
+ void xprt_reserve(struct rpc_task *task);
+ int xprt_reserve_xprt(struct rpc_xprt *xprt, struct rpc_task *task);
+ int xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task);
++void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
++void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task);
+ int xprt_prepare_transmit(struct rpc_task *task);
+ void xprt_transmit(struct rpc_task *task);
+ void xprt_end_transmit(struct rpc_task *task);
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -969,11 +969,11 @@ static bool xprt_dynamic_free_slot(struc
+ return false;
+ }
+
+-static void xprt_alloc_slot(struct rpc_task *task)
++void xprt_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
+ {
+- struct rpc_xprt *xprt = task->tk_xprt;
+ struct rpc_rqst *req;
+
++ spin_lock(&xprt->reserve_lock);
+ if (!list_empty(&xprt->free)) {
+ req = list_entry(xprt->free.next, struct rpc_rqst, rq_list);
+ list_del(&req->rq_list);
+@@ -994,12 +994,29 @@ static void xprt_alloc_slot(struct rpc_t
+ default:
+ task->tk_status = -EAGAIN;
+ }
++ spin_unlock(&xprt->reserve_lock);
+ return;
+ out_init_req:
+ task->tk_status = 0;
+ task->tk_rqstp = req;
+ xprt_request_init(task, xprt);
++ spin_unlock(&xprt->reserve_lock);
++}
++EXPORT_SYMBOL_GPL(xprt_alloc_slot);
++
++void xprt_lock_and_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task)
++{
++ /* Note: grabbing the xprt_lock_write() ensures that we throttle
++ * new slot allocation if the transport is congested (i.e. when
++ * reconnecting a stream transport or when out of socket write
++ * buffer space).
++ */
++ if (xprt_lock_write(xprt, task)) {
++ xprt_alloc_slot(xprt, task);
++ xprt_release_write(xprt, task);
++ }
+ }
++EXPORT_SYMBOL_GPL(xprt_lock_and_alloc_slot);
+
+ static void xprt_free_slot(struct rpc_xprt *xprt, struct rpc_rqst *req)
+ {
+@@ -1083,20 +1100,9 @@ void xprt_reserve(struct rpc_task *task)
+ if (task->tk_rqstp != NULL)
+ return;
+
+- /* Note: grabbing the xprt_lock_write() here is not strictly needed,
+- * but ensures that we throttle new slot allocation if the transport
+- * is congested (e.g. if reconnecting or if we're out of socket
+- * write buffer space).
+- */
+ task->tk_timeout = 0;
+ task->tk_status = -EAGAIN;
+- if (!xprt_lock_write(xprt, task))
+- return;
+-
+- spin_lock(&xprt->reserve_lock);
+- xprt_alloc_slot(task);
+- spin_unlock(&xprt->reserve_lock);
+- xprt_release_write(xprt, task);
++ xprt->ops->alloc_slot(xprt, task);
+ }
+
+ static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -713,6 +713,7 @@ static void xprt_rdma_print_stats(struct
+ static struct rpc_xprt_ops xprt_rdma_procs = {
+ .reserve_xprt = xprt_rdma_reserve_xprt,
+ .release_xprt = xprt_release_xprt_cong, /* sunrpc/xprt.c */
++ .alloc_slot = xprt_alloc_slot,
+ .release_request = xprt_release_rqst_cong, /* ditto */
+ .set_retrans_timeout = xprt_set_retrans_timeout_def, /* ditto */
+ .rpcbind = rpcb_getport_async, /* sunrpc/rpcb_clnt.c */
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2433,6 +2433,7 @@ static void bc_destroy(struct rpc_xprt *
+ static struct rpc_xprt_ops xs_local_ops = {
+ .reserve_xprt = xprt_reserve_xprt,
+ .release_xprt = xs_tcp_release_xprt,
++ .alloc_slot = xprt_alloc_slot,
+ .rpcbind = xs_local_rpcbind,
+ .set_port = xs_local_set_port,
+ .connect = xs_connect,
+@@ -2449,6 +2450,7 @@ static struct rpc_xprt_ops xs_udp_ops =
+ .set_buffer_size = xs_udp_set_buffer_size,
+ .reserve_xprt = xprt_reserve_xprt_cong,
+ .release_xprt = xprt_release_xprt_cong,
++ .alloc_slot = xprt_alloc_slot,
+ .rpcbind = rpcb_getport_async,
+ .set_port = xs_set_port,
+ .connect = xs_connect,
+@@ -2466,6 +2468,7 @@ static struct rpc_xprt_ops xs_udp_ops =
+ static struct rpc_xprt_ops xs_tcp_ops = {
+ .reserve_xprt = xprt_reserve_xprt,
+ .release_xprt = xs_tcp_release_xprt,
++ .alloc_slot = xprt_lock_and_alloc_slot,
+ .rpcbind = rpcb_getport_async,
+ .set_port = xs_set_port,
+ .connect = xs_connect,
+From 667a5313ecd7308d79629c0738b0db588b0b0a4e Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Thu, 16 Aug 2012 16:46:12 +1000
+Subject: md: Don't truncate size at 4TB for RAID0 and Linear
+
+From: NeilBrown <neilb at suse.de>
+
+commit 667a5313ecd7308d79629c0738b0db588b0b0a4e upstream.
+
+commit 27a7b260f71439c40546b43588448faac01adb93
+ md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
+
+changed 0.90 metadata handling to truncated size to 4TB as that is
+all that 0.90 can record.
+However for RAID0 and Linear, 0.90 doesn't need to record the size, so
+this truncation is not needed and causes working arrays to become too small.
+
+So avoid the truncation for RAID0 and Linear
+
+This bug was introduced in 3.1 and is suitable for any stable kernels
+from then onwards.
+As the offending commit was tagged for 'stable', any stable kernel
+that it was applied to should also get this patch. That includes
+at least 2.6.32, 2.6.33 and 3.0. (Thanks to Ben Hutchings for
+providing that list).
+
+Signed-off-by: Neil Brown <neilb at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/md/md.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1157,8 +1157,11 @@ static int super_90_load(struct md_rdev
+ ret = 0;
+ }
+ rdev->sectors = rdev->sb_start;
+- /* Limit to 4TB as metadata cannot record more than that */
+- if (rdev->sectors >= (2ULL << 32))
++ /* Limit to 4TB as metadata cannot record more than that.
++ * (not needed for Linear and RAID0 as metadata doesn't
++ * record this size)
++ */
++ if (rdev->sectors >= (2ULL << 32) && sb->level >= 1)
+ rdev->sectors = (2ULL << 32) - 2;
+
+ if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1)
+@@ -1449,7 +1452,7 @@ super_90_rdev_size_change(struct md_rdev
+ /* Limit to 4TB as metadata cannot record more than that.
+ * 4TB == 2^32 KB, or 2*2^32 sectors.
+ */
+- if (num_sectors >= (2ULL << 32))
++ if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1)
+ num_sectors = (2ULL << 32) - 2;
+ md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size,
+ rdev->sb_page);
+From e0ee778528bbaad28a5c69d2e219269a3a096607 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Sat, 18 Aug 2012 09:51:42 +1000
+Subject: md/raid10: fix problem with on-stack allocation of r10bio structure.
+
+From: NeilBrown <neilb at suse.de>
+
+commit e0ee778528bbaad28a5c69d2e219269a3a096607 upstream.
+
+A 'struct r10bio' has an array of per-copy information at the end.
+This array is declared with size [0] and r10bio_pool_alloc allocates
+enough extra space to store the per-copy information depending on the
+number of copies needed.
+
+So declaring a 'struct r10bio on the stack isn't going to work. It
+won't allocate enough space, and memory corruption will ensue.
+
+So in the two places where this is done, declare a sufficiently large
+structure and use that instead.
+
+The two call-sites of this bug were introduced in 3.4 and 3.5
+so this is suitable for both those kernels. The patch will have to
+be modified for 3.4 as it only has one bug.
+
+Reported-by: Ivan Vasilyev <ivan.vasilyev at gmail.com>
+Tested-by: Ivan Vasilyev <ivan.vasilyev at gmail.com>
+Signed-off-by: NeilBrown <neilb at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 30 +++++++++++++++++++-----------
+ drivers/md/raid10.h | 2 +-
+ 2 files changed, 20 insertions(+), 12 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -645,7 +645,11 @@ static int raid10_mergeable_bvec(struct
+ max = biovec->bv_len;
+
+ if (mddev->merge_check_needed) {
+- struct r10bio r10_bio;
++ struct {
++ struct r10bio r10_bio;
++ struct r10dev devs[conf->copies];
++ } on_stack;
++ struct r10bio *r10_bio = &on_stack.r10_bio;
+ int s;
+ if (conf->reshape_progress != MaxSector) {
+ /* Cannot give any guidance during reshape */
+@@ -653,18 +657,18 @@ static int raid10_mergeable_bvec(struct
+ return biovec->bv_len;
+ return 0;
+ }
+- r10_bio.sector = sector;
+- raid10_find_phys(conf, &r10_bio);
++ r10_bio->sector = sector;
++ raid10_find_phys(conf, r10_bio);
+ rcu_read_lock();
+ for (s = 0; s < conf->copies; s++) {
+- int disk = r10_bio.devs[s].devnum;
++ int disk = r10_bio->devs[s].devnum;
+ struct md_rdev *rdev = rcu_dereference(
+ conf->mirrors[disk].rdev);
+ if (rdev && !test_bit(Faulty, &rdev->flags)) {
+ struct request_queue *q =
+ bdev_get_queue(rdev->bdev);
+ if (q->merge_bvec_fn) {
+- bvm->bi_sector = r10_bio.devs[s].addr
++ bvm->bi_sector = r10_bio->devs[s].addr
+ + rdev->data_offset;
+ bvm->bi_bdev = rdev->bdev;
+ max = min(max, q->merge_bvec_fn(
+@@ -676,7 +680,7 @@ static int raid10_mergeable_bvec(struct
+ struct request_queue *q =
+ bdev_get_queue(rdev->bdev);
+ if (q->merge_bvec_fn) {
+- bvm->bi_sector = r10_bio.devs[s].addr
++ bvm->bi_sector = r10_bio->devs[s].addr
+ + rdev->data_offset;
+ bvm->bi_bdev = rdev->bdev;
+ max = min(max, q->merge_bvec_fn(
+@@ -4389,14 +4393,18 @@ static int handle_reshape_read_error(str
+ {
+ /* Use sync reads to get the blocks from somewhere else */
+ int sectors = r10_bio->sectors;
+- struct r10bio r10b;
+ struct r10conf *conf = mddev->private;
++ struct {
++ struct r10bio r10_bio;
++ struct r10dev devs[conf->copies];
++ } on_stack;
++ struct r10bio *r10b = &on_stack.r10_bio;
+ int slot = 0;
+ int idx = 0;
+ struct bio_vec *bvec = r10_bio->master_bio->bi_io_vec;
+
+- r10b.sector = r10_bio->sector;
+- __raid10_find_phys(&conf->prev, &r10b);
++ r10b->sector = r10_bio->sector;
++ __raid10_find_phys(&conf->prev, r10b);
+
+ while (sectors) {
+ int s = sectors;
+@@ -4407,7 +4415,7 @@ static int handle_reshape_read_error(str
+ s = PAGE_SIZE >> 9;
+
+ while (!success) {
+- int d = r10b.devs[slot].devnum;
++ int d = r10b->devs[slot].devnum;
+ struct md_rdev *rdev = conf->mirrors[d].rdev;
+ sector_t addr;
+ if (rdev == NULL ||
+@@ -4415,7 +4423,7 @@ static int handle_reshape_read_error(str
+ !test_bit(In_sync, &rdev->flags))
+ goto failed;
+
+- addr = r10b.devs[slot].addr + idx * PAGE_SIZE;
++ addr = r10b->devs[slot].addr + idx * PAGE_SIZE;
+ success = sync_page_io(rdev,
+ addr,
+ s << 9,
+--- a/drivers/md/raid10.h
++++ b/drivers/md/raid10.h
+@@ -110,7 +110,7 @@ struct r10bio {
+ * We choose the number when they are allocated.
+ * We sometimes need an extra bio to write to the replacement.
+ */
+- struct {
++ struct r10dev {
+ struct bio *bio;
+ union {
+ struct bio *repl_bio; /* used for resync and
+From 6dafab6b1383e912cd252fa809570b484eb6e0dc Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Wed, 19 Sep 2012 12:54:22 +1000
+Subject: md: make sure metadata is updated when spares are activated or removed.
+
+From: NeilBrown <neilb at suse.de>
+
+commit 6dafab6b1383e912cd252fa809570b484eb6e0dc upstream.
+
+It isn't always necessary to update the metadata when spares are
+removed as the presence-or-not of a spare isn't really important to
+the integrity of an array.
+Also activating a spare doesn't always require updating the metadata
+as the update on 'recovery-completed' is usually sufficient.
+
+However the introduction of 'replacement' devices have made these
+transitions sometimes more important. For example the 'Replacement'
+flag isn't cleared until the original device is removed, so we need
+to ensure a metadata update after that 'spare' is removed.
+
+So set MD_CHANGE_DEVS whenever a spare is activated or removed, to
+complement the current situation where it is set when a spare is added
+or a device is failed (or a number of other less common situations).
+
+This is suitable for -stable as out-of-data metadata could lead
+to data corruption.
+This is only relevant for 3.3 and later 9when 'replacement' as
+introduced.
+
+Signed-off-by: NeilBrown <neilb at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/md/md.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7672,6 +7672,8 @@ static int remove_and_add_spares(struct
+ }
+ }
+ }
++ if (removed)
++ set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ return spares;
+ }
+
+@@ -7685,9 +7687,11 @@ static void reap_sync_thread(struct mdde
+ !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
+ /* success...*/
+ /* activate any spares */
+- if (mddev->pers->spare_active(mddev))
++ if (mddev->pers->spare_active(mddev)) {
+ sysfs_notify(&mddev->kobj, NULL,
+ "degraded");
++ set_bit(MD_CHANGE_DEVS, &mddev->flags);
++ }
+ }
+ if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ mddev->pers->finish_reshape)
+From e5c86471f933608db5d43679f84cb4346c32033e Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb at suse.de>
+Date: Wed, 19 Sep 2012 12:52:30 +1000
+Subject: md/raid5: fix calculate of 'degraded' when a replacement becomes active.
+
+From: NeilBrown <neilb at suse.de>
+
+commit e5c86471f933608db5d43679f84cb4346c32033e upstream.
+
+When a replacement device becomes active, we mark the device that it
+replaces as 'faulty' so that it can subsequently get removed.
+However 'calc_degraded' only pays attention to the primary device, not
+the replacement, so the array appears to become degraded, which is
+wrong.
+
+So teach 'calc_degraded' to consider any replacement if a primary
+device is faulty.
+
+This is suitable for -stable as an incorrect 'degraded' value can
+confuse md and could lead to data corruption.
+This is only relevant for 3.3 and later.
+
+Reported-by: Robin Hill <robin at robinhill.me.uk>
+Reported-by: John Drescher <drescherjm at gmail.com>
+Signed-off-by: NeilBrown <neilb at suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/md/raid5.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -380,6 +380,8 @@ static int calc_degraded(struct r5conf *
+ degraded = 0;
+ for (i = 0; i < conf->previous_raid_disks; i++) {
+ struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
++ if (rdev && test_bit(Faulty, &rdev->flags))
++ rdev = rcu_dereference(conf->disks[i].replacement);
+ if (!rdev || test_bit(Faulty, &rdev->flags))
+ degraded++;
+ else if (test_bit(In_sync, &rdev->flags))
+@@ -404,6 +406,8 @@ static int calc_degraded(struct r5conf *
+ degraded2 = 0;
+ for (i = 0; i < conf->raid_disks; i++) {
+ struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
++ if (rdev && test_bit(Faulty, &rdev->flags))
++ rdev = rcu_dereference(conf->disks[i].replacement);
+ if (!rdev || test_bit(Faulty, &rdev->flags))
+ degraded2++;
+ else if (test_bit(In_sync, &rdev->flags))
+From fded4e090c60100d709318896c79816d68d5b47d Mon Sep 17 00:00:00 2001
+From: Paul Clements <paul.clements at steeleye.com>
+Date: Mon, 17 Sep 2012 14:09:02 -0700
+Subject: nbd: clear waiting_queue on shutdown
+
+From: Paul Clements <paul.clements at steeleye.com>
+
+commit fded4e090c60100d709318896c79816d68d5b47d upstream.
+
+Fix a serious but uncommon bug in nbd which occurs when there is heavy
+I/O going to the nbd device while, at the same time, a failure (server,
+network) or manual disconnect of the nbd connection occurs.
+
+There is a small window between the time that the nbd_thread is stopped
+and the socket is shutdown where requests can continue to be queued to
+nbd's internal waiting_queue. When this happens, those requests are
+never completed or freed.
+
+The fix is to clear the waiting_queue on shutdown of the nbd device, in
+the same way that the nbd request queue (queue_head) is already being
+cleared.
+
+Signed-off-by: Paul Clements <paul.clements at steeleye.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/block/nbd.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -445,6 +445,14 @@ static void nbd_clear_que(struct nbd_dev
+ req->errors++;
+ nbd_end_request(req);
+ }
++
++ while (!list_empty(&nbd->waiting_queue)) {
++ req = list_entry(nbd->waiting_queue.next, struct request,
++ queuelist);
++ list_del_init(&req->queuelist);
++ req->errors++;
++ nbd_end_request(req);
++ }
+ }
+
+
+@@ -594,6 +602,7 @@ static int __nbd_ioctl(struct block_devi
+ nbd->file = NULL;
+ nbd_clear_que(nbd);
+ BUG_ON(!list_empty(&nbd->queue_head));
++ BUG_ON(!list_empty(&nbd->waiting_queue));
+ if (file)
+ fput(file);
+ return 0;
+From 57b2d68863f281737d8596cb3d76d89d9cc54fd8 Mon Sep 17 00:00:00 2001
+From: Dylan Reid <dgreid at chromium.org>
+Date: Sat, 1 Sep 2012 01:38:19 -0700
+Subject: ASoC: samsung dma - Don't indicate support for pause/resume.
+
+From: Dylan Reid <dgreid at chromium.org>
+
+commit 57b2d68863f281737d8596cb3d76d89d9cc54fd8 upstream.
+
+The pause and resume operations indicate that the stream can be
+un-paused/resumed from the exact location they were paused/suspended.
+This is not true for this driver, the pause and suspend triggers share
+the same code path with stop, they flush all pending DMA transfers.
+This drops all pending samples. The pause_release/resume triggers are
+the same as start, except that prepare won't be called beforehand,
+nothing will be enqueued to the DMA engine and nothing will happen (no
+audio). Removing the pause flag will let apps know that it isn't
+supported. Removing the resume flag will cause user space to call
+prepare and start instead of resume, so audio will continue playing when
+the system wakes up.
+
+Before removing the pause and resume flags, I tested this on an exynos
+5250, using 'aplay -i'. Pause/un-pause leads to silence followed by a
+write error. Suspend/resume testing led to the same result. Removing
+the two flags fixes suspend/resume (since snd_pcm_prepare is called
+again). And leads to a proper reporting of pause not supported.
+
+Signed-off-by: Dylan Reid <dgreid at chromium.org>
+Signed-off-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ sound/soc/samsung/dma.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/sound/soc/samsung/dma.c
++++ b/sound/soc/samsung/dma.c
+@@ -34,9 +34,7 @@ static const struct snd_pcm_hardware dma
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_BLOCK_TRANSFER |
+ SNDRV_PCM_INFO_MMAP |
+- SNDRV_PCM_INFO_MMAP_VALID |
+- SNDRV_PCM_INFO_PAUSE |
+- SNDRV_PCM_INFO_RESUME,
++ SNDRV_PCM_INFO_MMAP_VALID,
+ .formats = SNDRV_PCM_FMTBIT_S16_LE |
+ SNDRV_PCM_FMTBIT_U16_LE |
+ SNDRV_PCM_FMTBIT_U8 |
+@@ -246,15 +244,11 @@ static int dma_trigger(struct snd_pcm_su
+
+ switch (cmd) {
+ case SNDRV_PCM_TRIGGER_START:
+- case SNDRV_PCM_TRIGGER_RESUME:
+- case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+ prtd->state |= ST_RUNNING;
+ prtd->params->ops->trigger(prtd->params->ch);
+ break;
+
+ case SNDRV_PCM_TRIGGER_STOP:
+- case SNDRV_PCM_TRIGGER_SUSPEND:
+- case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+ prtd->state &= ~ST_RUNNING;
+ prtd->params->ops->stop(prtd->params->ch);
+ break;
+From 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac Mon Sep 17 00:00:00 2001
+From: Li Haifeng <omycle at gmail.com>
+Date: Mon, 17 Sep 2012 14:09:21 -0700
+Subject: mm/page_alloc: fix the page address of higher page's buddy calculation
+
+From: Li Haifeng <omycle at gmail.com>
+
+commit 0ba8f2d59304dfe69b59c034de723ad80f7ab9ac upstream.
+
+The heuristic method for buddy has been introduced since commit
+43506fad21ca ("mm/page_alloc.c: simplify calculation of combined index
+of adjacent buddy lists"). But the page address of higher page's buddy
+was wrongly calculated, which will lead page_is_buddy to fail for ever.
+IOW, the heuristic method would be disabled with the wrong page address
+of higher page's buddy.
+
+Calculating the page address of higher page's buddy should be based
+higher_page with the offset between index of higher page and index of
+higher page's buddy.
+
+Signed-off-by: Haifeng Li <omycle at gmail.com>
+Signed-off-by: Gavin Shan <shangw at linux.vnet.ibm.com>
+Reviewed-by: Michal Hocko <mhocko at suse.cz>
+Cc: KyongHo Cho <pullip.cho at samsung.com>
+Cc: Mel Gorman <mgorman at suse.de>
+Cc: Minchan Kim <minchan.kim at gmail.com>
+Cc: Johannes Weiner <jweiner at redhat.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -580,7 +580,7 @@ static inline void __free_one_page(struc
+ combined_idx = buddy_idx & page_idx;
+ higher_page = page + (combined_idx - page_idx);
+ buddy_idx = __find_buddy_index(combined_idx, order + 1);
+- higher_buddy = page + (buddy_idx - combined_idx);
++ higher_buddy = higher_page + (buddy_idx - combined_idx);
+ if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
+ list_add_tail(&page->lru,
+ &zone->free_area[order].free_list[migratetype]);
+From 8dcebaa9a0ae8a0487f4342f3d56d2cb1c980860 Mon Sep 17 00:00:00 2001
+From: Kevin Hilman <khilman at ti.com>
+Date: Mon, 17 Sep 2012 14:09:17 -0700
+Subject: drivers/rtc/rtc-twl.c: ensure all interrupts are disabled during probe
+
+From: Kevin Hilman <khilman at ti.com>
+
+commit 8dcebaa9a0ae8a0487f4342f3d56d2cb1c980860 upstream.
+
+On some platforms, bootloaders are known to do some interesting RTC
+programming. Without going into the obscurities as to why this may be
+the case, suffice it to say the the driver should not make any
+assumptions about the state of the RTC when the driver loads. In
+particular, the driver probe should be sure that all interrupts are
+disabled until otherwise programmed.
+
+This was discovered when finding bursty I2C traffic every second on
+Overo platforms. This I2C overhead was keeping the SoC from hitting
+deep power states. The cause was found to be the RTC firing every
+second on the I2C-connected TWL PMIC.
+
+Special thanks to Felipe Balbi for suggesting to look for a rogue driver
+as the source of the I2C traffic rather than the I2C driver itself.
+
+Special thanks to Steve Sakoman for helping track down the source of the
+continuous RTC interrups on the Overo boards.
+
+Signed-off-by: Kevin Hilman <khilman at ti.com>
+Cc: Felipe Balbi <balbi at ti.com>
+Tested-by: Steve Sakoman <steve at sakoman.com>
+Cc: Alessandro Zummo <a.zummo at towertech.it>
+Tested-by: Shubhrajyoti Datta <omaplinuxkernel at gmail.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-twl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rtc/rtc-twl.c
++++ b/drivers/rtc/rtc-twl.c
+@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struc
+ if (ret < 0)
+ goto out1;
+
++ /* ensure interrupts are disabled, bootloaders can be strange */
++ ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
++ if (ret < 0)
++ dev_warn(&pdev->dev, "unable to disable interrupt\n");
++
+ /* init cached IRQ enable bits */
+ ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
+ if (ret < 0)
+From 73d7c119255615a26070f9d6cdb722a166a29015 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux at roeck-us.net>
+Date: Tue, 19 Jun 2012 08:00:00 -0700
+Subject: hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements
+
+From: Guenter Roeck <linux at roeck-us.net>
+
+commit 73d7c119255615a26070f9d6cdb722a166a29015 upstream.
+
+twl4030_madc_conversion uses do_avg and type structure elements of
+twl4030_madc_request. Initialize structure to avoid random operation.
+
+Fix for: Coverity CID 200794 Uninitialized scalar variable.
+
+Cc: Keerthy <j-keerthy at ti.com>
+Signed-off-by: Guenter Roeck <linux at roeck-us.net>
+Acked-by: Jean Delvare <khali at linux-fr.org>
+Acked-by: Keerthy <j-keerthy at ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hwmon/twl4030-madc-hwmon.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/twl4030-madc-hwmon.c
++++ b/drivers/hwmon/twl4030-madc-hwmon.c
+@@ -44,12 +44,13 @@ static ssize_t madc_read(struct device *
+ struct device_attribute *devattr, char *buf)
+ {
+ struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+- struct twl4030_madc_request req;
++ struct twl4030_madc_request req = {
++ .channels = 1 << attr->index,
++ .method = TWL4030_MADC_SW2,
++ .type = TWL4030_MADC_WAIT,
++ };
+ long val;
+
+- req.channels = (1 << attr->index);
+- req.method = TWL4030_MADC_SW2;
+- req.func_cb = NULL;
+ val = twl4030_madc_conversion(&req);
+ if (val < 0)
+ return val;
+From 080b98e9ab30734bda2f1b8b33cd55a4c4ef406a Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux at roeck-us.net>
+Date: Tue, 11 Sep 2012 08:22:14 -0700
+Subject: hwmon: (ina2xx) Fix word size register read and write operations
+
+From: Guenter Roeck <linux at roeck-us.net>
+
+commit 080b98e9ab30734bda2f1b8b33cd55a4c4ef406a upstream.
+
+The driver uses be16_to_cpu and cpu_to_be16 to convert data in SMBus word
+operations from chip to host byte order. However, the data passed from and to
+the SMBus word API functions is in host byte order, not in chip byte order.
+Conversion should therefore use swab16 instead of be16 to change the byte order.
+
+Replace driver internal word conversion functions with SMBus API functions to
+solve the problem.
+
+Signed-off-by: Guenter Roeck <linux at roeck-us.net>
+Acked-by: Jean Delvare <khali at linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hwmon/ina2xx.c | 30 +++++++++---------------------
+ 1 file changed, 9 insertions(+), 21 deletions(-)
+
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -69,22 +69,6 @@ struct ina2xx_data {
+ u16 regs[INA2XX_MAX_REGISTERS];
+ };
+
+-int ina2xx_read_word(struct i2c_client *client, int reg)
+-{
+- int val = i2c_smbus_read_word_data(client, reg);
+- if (unlikely(val < 0)) {
+- dev_dbg(&client->dev,
+- "Failed to read register: %d\n", reg);
+- return val;
+- }
+- return be16_to_cpu(val);
+-}
+-
+-void ina2xx_write_word(struct i2c_client *client, int reg, int data)
+-{
+- i2c_smbus_write_word_data(client, reg, cpu_to_be16(data));
+-}
+-
+ static struct ina2xx_data *ina2xx_update_device(struct device *dev)
+ {
+ struct i2c_client *client = to_i2c_client(dev);
+@@ -102,7 +86,7 @@ static struct ina2xx_data *ina2xx_update
+
+ /* Read all registers */
+ for (i = 0; i < data->registers; i++) {
+- int rv = ina2xx_read_word(client, i);
++ int rv = i2c_smbus_read_word_swapped(client, i);
+ if (rv < 0) {
+ ret = ERR_PTR(rv);
+ goto abort;
+@@ -279,22 +263,26 @@ static int ina2xx_probe(struct i2c_clien
+ switch (data->kind) {
+ case ina219:
+ /* device configuration */
+- ina2xx_write_word(client, INA2XX_CONFIG, INA219_CONFIG_DEFAULT);
++ i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
++ INA219_CONFIG_DEFAULT);
+
+ /* set current LSB to 1mA, shunt is in uOhms */
+ /* (equation 13 in datasheet) */
+- ina2xx_write_word(client, INA2XX_CALIBRATION, 40960000 / shunt);
++ i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
++ 40960000 / shunt);
+ dev_info(&client->dev,
+ "power monitor INA219 (Rshunt = %li uOhm)\n", shunt);
+ data->registers = INA219_REGISTERS;
+ break;
+ case ina226:
+ /* device configuration */
+- ina2xx_write_word(client, INA2XX_CONFIG, INA226_CONFIG_DEFAULT);
++ i2c_smbus_write_word_swapped(client, INA2XX_CONFIG,
++ INA226_CONFIG_DEFAULT);
+
+ /* set current LSB to 1mA, shunt is in uOhms */
+ /* (equation 1 in datasheet)*/
+- ina2xx_write_word(client, INA2XX_CALIBRATION, 5120000 / shunt);
++ i2c_smbus_write_word_swapped(client, INA2XX_CALIBRATION,
++ 5120000 / shunt);
+ dev_info(&client->dev,
+ "power monitor INA226 (Rshunt = %li uOhm)\n", shunt);
+ data->registers = INA226_REGISTERS;
+From 749c8814f08f12baa4a9c2812a7c6ede7d69507d Mon Sep 17 00:00:00 2001
+From: Charles Wang <muming.wq at taobao.com>
+Date: Mon, 20 Aug 2012 16:02:33 +0800
+Subject: sched: Add missing call to calc_load_exit_idle()
+
+From: Charles Wang <muming.wq at taobao.com>
+
+commit 749c8814f08f12baa4a9c2812a7c6ede7d69507d upstream.
+
+Azat Khuzhin reported high loadavg in Linux v3.6
+
+After checking the upstream scheduler code, I found Peter's commit:
+
+ 5167e8d5417b sched/nohz: Rewrite and fix load-avg computation -- again
+
+not fully applied, missing the call to calc_load_exit_idle().
+
+After that idle exit in sampling window will always be calculated
+to non-idle, and the load will be higher than normal.
+
+This patch adds the missing call to calc_load_exit_idle().
+
+Signed-off-by: Charles Wang <muming.wq at taobao.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
+Link: http://lkml.kernel.org/r/1345449754-27130-1-git-send-email-muming.wq@gmail.com
+Signed-off-by: Ingo Molnar <mingo at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ kernel/time/tick-sched.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -145,6 +145,7 @@ static void tick_nohz_update_jiffies(kti
+ tick_do_update_jiffies64(now);
+ local_irq_restore(flags);
+
++ calc_load_exit_idle();
+ touch_softlockup_watchdog();
+ }
+
+From 26df641eac05abe1a3276eea441359b4d1120816 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan at linux.intel.com>
+Date: Wed, 12 Sep 2012 10:05:04 +0000
+Subject: gma500: Fix regression on Oaktrail devices
+
+From: Alan Cox <alan at linux.intel.com>
+
+commit 26df641eac05abe1a3276eea441359b4d1120816 upstream.
+
+The register map patches didn't set one value for the GMA600 which
+means the Fujitsu Q550 dies on boot with the GMA500 driver enabled.
+
+Add the map entry so we don't read from the device MMIO + 0 by mistake.
+
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/oaktrail_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/gma500/oaktrail_device.c
++++ b/drivers/gpu/drm/gma500/oaktrail_device.c
+@@ -476,6 +476,7 @@ static const struct psb_offset oaktrail_
+ .pos = DSPAPOS,
+ .surf = DSPASURF,
+ .addr = MRST_DSPABASE,
++ .base = MRST_DSPABASE,
+ .status = PIPEASTAT,
+ .linoff = DSPALINOFF,
+ .tileoff = DSPATILEOFF,
+@@ -499,6 +500,7 @@ static const struct psb_offset oaktrail_
+ .pos = DSPBPOS,
+ .surf = DSPBSURF,
+ .addr = DSPBBASE,
++ .base = DSPBBASE,
+ .status = PIPEBSTAT,
+ .linoff = DSPBLINOFF,
+ .tileoff = DSPBTILEOFF,
+From 4b921eda53366b319602351ff4d7256fafa4bd1b Mon Sep 17 00:00:00 2001
+From: Karsten Keil <keil at b1-systems.de>
+Date: Thu, 13 Sep 2012 04:36:20 +0000
+Subject: mISDN: Fix wrong usage of flush_work_sync while holding locks
+
+From: Karsten Keil <keil at b1-systems.de>
+
+commit 4b921eda53366b319602351ff4d7256fafa4bd1b upstream.
+
+It is a bad idea to hold a spinlock and call flush_work_sync.
+Move the workqueue cleanup outside the spinlock and use cancel_work_sync,
+on closing the channel this seems to be the more correct function.
+Remove the never used and constant return value of mISDN_freebchannel.
+
+Signed-off-by: Karsten Keil <keil at b1-systems.de>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/isdn/hardware/mISDN/avmfritz.c | 3 ++-
+ drivers/isdn/hardware/mISDN/mISDNipac.c | 3 ++-
+ drivers/isdn/hardware/mISDN/mISDNisar.c | 3 ++-
+ drivers/isdn/hardware/mISDN/netjet.c | 3 ++-
+ drivers/isdn/hardware/mISDN/w6692.c | 3 ++-
+ drivers/isdn/mISDN/hwchannel.c | 9 ++++-----
+ include/linux/mISDNhw.h | 2 +-
+ 7 files changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/isdn/hardware/mISDN/avmfritz.c
++++ b/drivers/isdn/hardware/mISDN/avmfritz.c
+@@ -857,8 +857,9 @@ avm_bctrl(struct mISDNchannel *ch, u32 c
+ switch (cmd) {
+ case CLOSE_CHANNEL:
+ test_and_clear_bit(FLG_OPEN, &bch->Flags);
++ cancel_work_sync(&bch->workq);
+ spin_lock_irqsave(&fc->lock, flags);
+- mISDN_freebchannel(bch);
++ mISDN_clear_bchannel(bch);
+ modehdlc(bch, ISDN_P_NONE);
+ spin_unlock_irqrestore(&fc->lock, flags);
+ ch->protocol = ISDN_P_NONE;
+--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
++++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
+@@ -1406,8 +1406,9 @@ hscx_bctrl(struct mISDNchannel *ch, u32
+ switch (cmd) {
+ case CLOSE_CHANNEL:
+ test_and_clear_bit(FLG_OPEN, &bch->Flags);
++ cancel_work_sync(&bch->workq);
+ spin_lock_irqsave(hx->ip->hwlock, flags);
+- mISDN_freebchannel(bch);
++ mISDN_clear_bchannel(bch);
+ hscx_mode(hx, ISDN_P_NONE);
+ spin_unlock_irqrestore(hx->ip->hwlock, flags);
+ ch->protocol = ISDN_P_NONE;
+--- a/drivers/isdn/hardware/mISDN/mISDNisar.c
++++ b/drivers/isdn/hardware/mISDN/mISDNisar.c
+@@ -1588,8 +1588,9 @@ isar_bctrl(struct mISDNchannel *ch, u32
+ switch (cmd) {
+ case CLOSE_CHANNEL:
+ test_and_clear_bit(FLG_OPEN, &bch->Flags);
++ cancel_work_sync(&bch->workq);
+ spin_lock_irqsave(ich->is->hwlock, flags);
+- mISDN_freebchannel(bch);
++ mISDN_clear_bchannel(bch);
+ modeisar(ich, ISDN_P_NONE);
+ spin_unlock_irqrestore(ich->is->hwlock, flags);
+ ch->protocol = ISDN_P_NONE;
+--- a/drivers/isdn/hardware/mISDN/netjet.c
++++ b/drivers/isdn/hardware/mISDN/netjet.c
+@@ -812,8 +812,9 @@ nj_bctrl(struct mISDNchannel *ch, u32 cm
+ switch (cmd) {
+ case CLOSE_CHANNEL:
+ test_and_clear_bit(FLG_OPEN, &bch->Flags);
++ cancel_work_sync(&bch->workq);
+ spin_lock_irqsave(&card->lock, flags);
+- mISDN_freebchannel(bch);
++ mISDN_clear_bchannel(bch);
+ mode_tiger(bc, ISDN_P_NONE);
+ spin_unlock_irqrestore(&card->lock, flags);
+ ch->protocol = ISDN_P_NONE;
+--- a/drivers/isdn/hardware/mISDN/w6692.c
++++ b/drivers/isdn/hardware/mISDN/w6692.c
+@@ -1054,8 +1054,9 @@ w6692_bctrl(struct mISDNchannel *ch, u32
+ switch (cmd) {
+ case CLOSE_CHANNEL:
+ test_and_clear_bit(FLG_OPEN, &bch->Flags);
++ cancel_work_sync(&bch->workq);
+ spin_lock_irqsave(&card->lock, flags);
+- mISDN_freebchannel(bch);
++ mISDN_clear_bchannel(bch);
+ w6692_mode(bc, ISDN_P_NONE);
+ spin_unlock_irqrestore(&card->lock, flags);
+ ch->protocol = ISDN_P_NONE;
+--- a/drivers/isdn/mISDN/hwchannel.c
++++ b/drivers/isdn/mISDN/hwchannel.c
+@@ -148,17 +148,16 @@ mISDN_clear_bchannel(struct bchannel *ch
+ ch->next_minlen = ch->init_minlen;
+ ch->maxlen = ch->init_maxlen;
+ ch->next_maxlen = ch->init_maxlen;
++ skb_queue_purge(&ch->rqueue);
++ ch->rcount = 0;
+ }
+ EXPORT_SYMBOL(mISDN_clear_bchannel);
+
+-int
++void
+ mISDN_freebchannel(struct bchannel *ch)
+ {
++ cancel_work_sync(&ch->workq);
+ mISDN_clear_bchannel(ch);
+- skb_queue_purge(&ch->rqueue);
+- ch->rcount = 0;
+- flush_work_sync(&ch->workq);
+- return 0;
+ }
+ EXPORT_SYMBOL(mISDN_freebchannel);
+
+--- a/include/linux/mISDNhw.h
++++ b/include/linux/mISDNhw.h
+@@ -183,7 +183,7 @@ extern int mISDN_initbchannel(struct bch
+ unsigned short);
+ extern int mISDN_freedchannel(struct dchannel *);
+ extern void mISDN_clear_bchannel(struct bchannel *);
+-extern int mISDN_freebchannel(struct bchannel *);
++extern void mISDN_freebchannel(struct bchannel *);
+ extern int mISDN_ctrl_bchannel(struct bchannel *, struct mISDN_ctrl_req *);
+ extern void queue_ch_frame(struct mISDNchannel *, u_int,
+ int, struct sk_buff *);
+From cab32f39dcc5b35db96497dc0a026b5dea76e4e7 Mon Sep 17 00:00:00 2001
+From: Benoît Locher <Benoit.Locher at skf.com>
+Date: Mon, 27 Aug 2012 15:02:45 +0200
+Subject: can: mcp251x: avoid repeated frame bug
+
+From: Benoît Locher <Benoit.Locher at skf.com>
+
+commit cab32f39dcc5b35db96497dc0a026b5dea76e4e7 upstream.
+
+The MCP2515 has a silicon bug causing repeated frame transmission, see section
+5 of MCP2515 Rev. B Silicon Errata Revision G (March 2007).
+
+Basically, setting TXBnCTRL.TXREQ in either SPI mode (00 or 11) will eventually
+cause the bug. The workaround proposed by Microchip is to use mode 00 and send
+a RTS command on the SPI bus to initiate the transmission.
+
+Signed-off-by: Benoît Locher <Benoit.Locher at skf.com>
+Signed-off-by: Marc Kleine-Budde <mkl at pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/can/mcp251x.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/can/mcp251x.c
++++ b/drivers/net/can/mcp251x.c
+@@ -83,6 +83,11 @@
+ #define INSTRUCTION_LOAD_TXB(n) (0x40 + 2 * (n))
+ #define INSTRUCTION_READ_RXB(n) (((n) == 0) ? 0x90 : 0x94)
+ #define INSTRUCTION_RESET 0xC0
++#define RTS_TXB0 0x01
++#define RTS_TXB1 0x02
++#define RTS_TXB2 0x04
++#define INSTRUCTION_RTS(n) (0x80 | ((n) & 0x07))
++
+
+ /* MPC251x registers */
+ #define CANSTAT 0x0e
+@@ -397,6 +402,7 @@ static void mcp251x_hw_tx_frame(struct s
+ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame,
+ int tx_buf_idx)
+ {
++ struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
+ u32 sid, eid, exide, rtr;
+ u8 buf[SPI_TRANSFER_BUF_LEN];
+
+@@ -418,7 +424,10 @@ static void mcp251x_hw_tx(struct spi_dev
+ buf[TXBDLC_OFF] = (rtr << DLC_RTR_SHIFT) | frame->can_dlc;
+ memcpy(buf + TXBDAT_OFF, frame->data, frame->can_dlc);
+ mcp251x_hw_tx_frame(spi, buf, frame->can_dlc, tx_buf_idx);
+- mcp251x_write_reg(spi, TXBCTRL(tx_buf_idx), TXBCTRL_TXREQ);
++
++ /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */
++ priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx);
++ mcp251x_spi_trans(priv->spi, 1);
+ }
+
+ static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf,
+From 05cf96398e1b6502f9e191291b715c7463c9d5dd Mon Sep 17 00:00:00 2001
+From: Jianguo Wu <wujianguo at huawei.com>
+Date: Mon, 17 Sep 2012 14:08:56 -0700
+Subject: mm/ia64: fix a memory block size bug
+
+From: Jianguo Wu <wujianguo at huawei.com>
+
+commit 05cf96398e1b6502f9e191291b715c7463c9d5dd upstream.
+
+I found following definition in include/linux/memory.h, in my IA64
+platform, SECTION_SIZE_BITS is equal to 32, and MIN_MEMORY_BLOCK_SIZE
+will be 0.
+
+ #define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS)
+
+Because MIN_MEMORY_BLOCK_SIZE is int type and length of 32bits,
+so MIN_MEMORY_BLOCK_SIZE(1 << 32) will will equal to 0.
+Actually when SECTION_SIZE_BITS >= 31, MIN_MEMORY_BLOCK_SIZE will be wrong.
+This will cause wrong system memory infomation in sysfs.
+I think it should be:
+
+ #define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)
+
+And "echo offline > memory0/state" will cause following call trace:
+
+ kernel BUG at mm/memory_hotplug.c:885!
+ sh[6455]: bugcheck! 0 [1]
+ Pid: 6455, CPU 0, comm: sh
+ psr : 0000101008526030 ifs : 8000000000000fa4 ip : [<a0000001008c40f0>] Not tainted (3.6.0-rc1)
+ ip is at offline_pages+0x210/0xee0
+ Call Trace:
+ show_stack+0x80/0xa0
+ show_regs+0x640/0x920
+ die+0x190/0x2c0
+ die_if_kernel+0x50/0x80
+ ia64_bad_break+0x3d0/0x6e0
+ ia64_native_leave_kernel+0x0/0x270
+ offline_pages+0x210/0xee0
+ alloc_pages_current+0x180/0x2a0
+
+Signed-off-by: Jianguo Wu <wujianguo at huawei.com>
+Signed-off-by: Jiang Liu <jiang.liu at huawei.com>
+Cc: "Luck, Tony" <tony.luck at intel.com>
+Reviewed-by: Michal Hocko <mhocko at suse.cz>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/linux/memory.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/memory.h
++++ b/include/linux/memory.h
+@@ -19,7 +19,7 @@
+ #include <linux/compiler.h>
+ #include <linux/mutex.h>
+
+-#define MIN_MEMORY_BLOCK_SIZE (1 << SECTION_SIZE_BITS)
++#define MIN_MEMORY_BLOCK_SIZE (1UL << SECTION_SIZE_BITS)
+
+ struct memory_block {
+ unsigned long start_section_nr;
+From f14851af0ebb32745c6c5a2e400aa0549f9d20df Mon Sep 17 00:00:00 2001
+From: qiuxishi <qiuxishi at gmail.com>
+Date: Mon, 17 Sep 2012 14:09:24 -0700
+Subject: memory hotplug: fix section info double registration bug
+
+From: qiuxishi <qiuxishi at gmail.com>
+
+commit f14851af0ebb32745c6c5a2e400aa0549f9d20df upstream.
+
+There may be a bug when registering section info. For example, on my
+Itanium platform, the pfn range of node0 includes the other nodes, so
+other nodes' section info will be double registered, and memmap's page
+count will equal to 3.
+
+ node0: start_pfn=0x100, spanned_pfn=0x20fb00, present_pfn=0x7f8a3, => 0x000100-0x20fc00
+ node1: start_pfn=0x80000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x080000-0x100000
+ node2: start_pfn=0x100000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x100000-0x180000
+ node3: start_pfn=0x180000, spanned_pfn=0x80000, present_pfn=0x80000, => 0x180000-0x200000
+
+ free_all_bootmem_node()
+ register_page_bootmem_info_node()
+ register_page_bootmem_info_section()
+
+When hot remove memory, we can't free the memmap's page because
+page_count() is 2 after put_page_bootmem().
+
+ sparse_remove_one_section()
+ free_section_usemap()
+ free_map_bootmem()
+ put_page_bootmem()
+
+[akpm at linux-foundation.org: add code comment]
+Signed-off-by: Xishi Qiu <qiuxishi at huawei.com>
+Signed-off-by: Jiang Liu <jiang.liu at huawei.com>
+Acked-by: Mel Gorman <mgorman at suse.de>
+Cc: "Luck, Tony" <tony.luck at intel.com>
+Cc: Yasuaki Ishimatsu <isimatu.yasuaki at jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ mm/memory_hotplug.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -126,9 +126,6 @@ static void register_page_bootmem_info_s
+ struct mem_section *ms;
+ struct page *page, *memmap;
+
+- if (!pfn_valid(start_pfn))
+- return;
+-
+ section_nr = pfn_to_section_nr(start_pfn);
+ ms = __nr_to_section(section_nr);
+
+@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(str
+ end_pfn = pfn + pgdat->node_spanned_pages;
+
+ /* register_section info */
+- for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
+- register_page_bootmem_info_section(pfn);
+-
++ for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
++ /*
++ * Some platforms can assign the same pfn to multiple nodes - on
++ * node0 as well as nodeN. To avoid registering a pfn against
++ * multiple nodes we check that this pfn does not already
++ * reside in some other node.
++ */
++ if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
++ register_page_bootmem_info_section(pfn);
++ }
+ }
+ #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
+
+From 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 Mon Sep 17 00:00:00 2001
+From: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
+Date: Wed, 12 Sep 2012 12:44:30 +0100
+Subject: xen/m2p: do not reuse kmap_op->dev_bus_addr
+
+From: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
+
+commit 2fc136eecd0c647a6b13fcd00d0c41a1a28f35a5 upstream.
+
+If the caller passes a valid kmap_op to m2p_add_override, we use
+kmap_op->dev_bus_addr to store the original mfn, but dev_bus_addr is
+part of the interface with Xen and if we are batching the hypercalls it
+might not have been written by the hypervisor yet. That means that later
+on Xen will write to it and we'll think that the original mfn is
+actually what Xen has written to it.
+
+Rather than "stealing" struct members from kmap_op, keep using
+page->index to store the original mfn and add another parameter to
+m2p_remove_override to get the corresponding kmap_op instead.
+It is now responsibility of the caller to keep track of which kmap_op
+corresponds to a particular page in the m2p_override (gntdev, the only
+user of this interface that passes a valid kmap_op, is already doing that).
+
+Reported-and-Tested-By: Sander Eikelenboom <linux at eikelenboom.it>
+Signed-off-by: Stefano Stabellini <stefano.stabellini at eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/x86/include/asm/xen/page.h | 3 ++-
+ arch/x86/xen/p2m.c | 27 +++++++++++----------------
+ drivers/block/xen-blkback/blkback.c | 2 +-
+ drivers/xen/gntdev.c | 5 +++--
+ drivers/xen/grant-table.c | 6 ++++--
+ include/xen/grant_table.h | 3 ++-
+ 6 files changed, 23 insertions(+), 23 deletions(-)
+
+--- a/arch/x86/include/asm/xen/page.h
++++ b/arch/x86/include/asm/xen/page.h
+@@ -51,7 +51,8 @@ extern unsigned long set_phys_range_iden
+
+ extern int m2p_add_override(unsigned long mfn, struct page *page,
+ struct gnttab_map_grant_ref *kmap_op);
+-extern int m2p_remove_override(struct page *page, bool clear_pte);
++extern int m2p_remove_override(struct page *page,
++ struct gnttab_map_grant_ref *kmap_op);
+ extern struct page *m2p_find_override(unsigned long mfn);
+ extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
+
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -828,9 +828,6 @@ int m2p_add_override(unsigned long mfn,
+
+ xen_mc_issue(PARAVIRT_LAZY_MMU);
+ }
+- /* let's use dev_bus_addr to record the old mfn instead */
+- kmap_op->dev_bus_addr = page->index;
+- page->index = (unsigned long) kmap_op;
+ }
+ spin_lock_irqsave(&m2p_override_lock, flags);
+ list_add(&page->lru, &m2p_overrides[mfn_hash(mfn)]);
+@@ -857,7 +854,8 @@ int m2p_add_override(unsigned long mfn,
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(m2p_add_override);
+-int m2p_remove_override(struct page *page, bool clear_pte)
++int m2p_remove_override(struct page *page,
++ struct gnttab_map_grant_ref *kmap_op)
+ {
+ unsigned long flags;
+ unsigned long mfn;
+@@ -887,10 +885,8 @@ int m2p_remove_override(struct page *pag
+ WARN_ON(!PagePrivate(page));
+ ClearPagePrivate(page);
+
+- if (clear_pte) {
+- struct gnttab_map_grant_ref *map_op =
+- (struct gnttab_map_grant_ref *) page->index;
+- set_phys_to_machine(pfn, map_op->dev_bus_addr);
++ set_phys_to_machine(pfn, page->index);
++ if (kmap_op != NULL) {
+ if (!PageHighMem(page)) {
+ struct multicall_space mcs;
+ struct gnttab_unmap_grant_ref *unmap_op;
+@@ -902,13 +898,13 @@ int m2p_remove_override(struct page *pag
+ * issued. In this case handle is going to -1 because
+ * it hasn't been modified yet.
+ */
+- if (map_op->handle == -1)
++ if (kmap_op->handle == -1)
+ xen_mc_flush();
+ /*
+- * Now if map_op->handle is negative it means that the
++ * Now if kmap_op->handle is negative it means that the
+ * hypercall actually returned an error.
+ */
+- if (map_op->handle == GNTST_general_error) {
++ if (kmap_op->handle == GNTST_general_error) {
+ printk(KERN_WARNING "m2p_remove_override: "
+ "pfn %lx mfn %lx, failed to modify kernel mappings",
+ pfn, mfn);
+@@ -918,8 +914,8 @@ int m2p_remove_override(struct page *pag
+ mcs = xen_mc_entry(
+ sizeof(struct gnttab_unmap_grant_ref));
+ unmap_op = mcs.args;
+- unmap_op->host_addr = map_op->host_addr;
+- unmap_op->handle = map_op->handle;
++ unmap_op->host_addr = kmap_op->host_addr;
++ unmap_op->handle = kmap_op->handle;
+ unmap_op->dev_bus_addr = 0;
+
+ MULTI_grant_table_op(mcs.mc,
+@@ -930,10 +926,9 @@ int m2p_remove_override(struct page *pag
+ set_pte_at(&init_mm, address, ptep,
+ pfn_pte(pfn, PAGE_KERNEL));
+ __flush_tlb_single(address);
+- map_op->host_addr = 0;
++ kmap_op->host_addr = 0;
+ }
+- } else
+- set_phys_to_machine(pfn, page->index);
++ }
+
+ /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
+ * somewhere in this domain, even before being added to the
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pendi
+ invcount++;
+ }
+
+- ret = gnttab_unmap_refs(unmap, pages, invcount, false);
++ ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
+ BUG_ON(ret);
+ }
+
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct gr
+ }
+ }
+
+- err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
+- pages, true);
++ err = gnttab_unmap_refs(map->unmap_ops + offset,
++ use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
++ pages);
+ if (err)
+ return err;
+
+--- a/drivers/xen/grant-table.c
++++ b/drivers/xen/grant-table.c
+@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_gr
+ EXPORT_SYMBOL_GPL(gnttab_map_refs);
+
+ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
+- struct page **pages, unsigned int count, bool clear_pte)
++ struct gnttab_map_grant_ref *kmap_ops,
++ struct page **pages, unsigned int count)
+ {
+ int i, ret;
+ bool lazy = false;
+@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unma
+ }
+
+ for (i = 0; i < count; i++) {
+- ret = m2p_remove_override(pages[i], clear_pte);
++ ret = m2p_remove_override(pages[i], kmap_ops ?
++ &kmap_ops[i] : NULL);
+ if (ret)
+ return ret;
+ }
+--- a/include/xen/grant_table.h
++++ b/include/xen/grant_table.h
+@@ -187,6 +187,7 @@ int gnttab_map_refs(struct gnttab_map_gr
+ struct gnttab_map_grant_ref *kmap_ops,
+ struct page **pages, unsigned int count);
+ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
+- struct page **pages, unsigned int count, bool clear_pte);
++ struct gnttab_map_grant_ref *kunmap_ops,
++ struct page **pages, unsigned int count);
+
+ #endif /* __ASM_GNTTAB_H__ */
+From bd49940a35ec7d488ae63bd625639893b3385b97 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Date: Wed, 19 Sep 2012 08:30:55 -0400
+Subject: xen/boot: Disable BIOS SMP MP table search.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+
+commit bd49940a35ec7d488ae63bd625639893b3385b97 upstream.
+
+As the initial domain we are able to search/map certain regions
+of memory to harvest configuration data. For all low-level we
+use ACPI tables - for interrupts we use exclusively ACPI _PRT
+(so DSDT) and MADT for INT_SRC_OVR.
+
+The SMP MP table is not used at all. As a matter of fact we do
+not even support machines that only have SMP MP but no ACPI tables.
+
+Lets follow how Moorestown does it and just disable searching
+for BIOS SMP tables.
+
+This also fixes an issue on HP Proliant BL680c G5 and DL380 G6:
+
+9f->100 for 1:1 PTE
+Freeing 9f-100 pfn range: 97 pages freed
+1-1 mapping on 9f->100
+.. snip..
+e820: BIOS-provided physical RAM map:
+Xen: [mem 0x0000000000000000-0x000000000009efff] usable
+Xen: [mem 0x000000000009f400-0x00000000000fffff] reserved
+Xen: [mem 0x0000000000100000-0x00000000cfd1dfff] usable
+.. snip..
+Scan for SMP in [mem 0x00000000-0x000003ff]
+Scan for SMP in [mem 0x0009fc00-0x0009ffff]
+Scan for SMP in [mem 0x000f0000-0x000fffff]
+found SMP MP-table at [mem 0x000f4fa0-0x000f4faf] mapped at [ffff8800000f4fa0]
+(XEN) mm.c:908:d0 Error getting mfn 100 (pfn 5555555555555555) from L1 entry 0000000000100461 for l1e_owner=0, pg_owner=0
+(XEN) mm.c:4995:d0 ptwr_emulate: could not get_page_from_l1e()
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff81ac07e2>] xen_set_pte_init+0x66/0x71
+. snip..
+Pid: 0, comm: swapper Not tainted 3.6.0-rc6upstream-00188-gb6fb969-dirty #2 HP ProLiant BL680c G5
+.. snip..
+Call Trace:
+ [<ffffffff81ad31c6>] __early_ioremap+0x18a/0x248
+ [<ffffffff81624731>] ? printk+0x48/0x4a
+ [<ffffffff81ad32ac>] early_ioremap+0x13/0x15
+ [<ffffffff81acc140>] get_mpc_size+0x2f/0x67
+ [<ffffffff81acc284>] smp_scan_config+0x10c/0x136
+ [<ffffffff81acc2e4>] default_find_smp_config+0x36/0x5a
+ [<ffffffff81ac3085>] setup_arch+0x5b3/0xb5b
+ [<ffffffff81624731>] ? printk+0x48/0x4a
+ [<ffffffff81abca7f>] start_kernel+0x90/0x390
+ [<ffffffff81abc356>] x86_64_start_reservations+0x131/0x136
+ [<ffffffff81abfa83>] xen_start_kernel+0x65f/0x661
+(XEN) Domain 0 crashed: 'noreboot' set - not rebooting.
+
+which is that ioremap would end up mapping 0xff using _PAGE_IOMAP
+(which is what early_ioremap sticks as a flag) - which meant
+we would get MFN 0xFF (pte ff461, which is OK), and then it would
+also map 0x100 (b/c ioremap tries to get page aligned request, and
+it was trying to map 0xf4fa0 + PAGE_SIZE - so it mapped the next page)
+as _PAGE_IOMAP. Since 0x100 is actually a RAM page, and the _PAGE_IOMAP
+bypasses the P2M lookup we would happily set the PTE to 1000461.
+Xen would deny the request since we do not have access to the
+Machine Frame Number (MFN) of 0x100. The P2M[0x100] is for example
+0x80140.
+
+Fixes-Oracle-Bugzilla: https://bugzilla.oracle.com/bugzilla/show_bug.cgi?id=13665
+Acked-by: Jan Beulich <jbeulich at suse.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/x86/xen/enlighten.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1422,6 +1422,10 @@ asmlinkage void __init xen_start_kernel(
+ pci_request_acs();
+
+ xen_acpi_sleep_register();
++
++ /* Avoid searching for BIOS MP tables */
++ x86_init.mpparse.find_smp_config = x86_init_noop;
++ x86_init.mpparse.get_smp_config = x86_init_uint_noop;
+ }
+ #ifdef CONFIG_PCI
+ /* PCI BIOS service won't work from a PV guest. */
+From 8d54db795dfb1049d45dc34f0dddbc5347ec5642 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Date: Fri, 17 Aug 2012 10:22:37 -0400
+Subject: xen/boot: Disable NUMA for PV guests.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+
+commit 8d54db795dfb1049d45dc34f0dddbc5347ec5642 upstream.
+
+The hypervisor is in charge of allocating the proper "NUMA" memory
+and dealing with the CPU scheduler to keep them bound to the proper
+NUMA node. The PV guests (and PVHVM) have no inkling of where they
+run and do not need to know that right now. In the future we will
+need to inject NUMA configuration data (if a guest spans two or more
+NUMA nodes) so that the kernel can make the right choices. But those
+patches are not yet present.
+
+In the meantime, disable the NUMA capability in the PV guest, which
+also fixes a bootup issue. Andre says:
+
+"we see Dom0 crashes due to the kernel detecting the NUMA topology not
+by ACPI, but directly from the northbridge (CONFIG_AMD_NUMA).
+
+This will detect the actual NUMA config of the physical machine, but
+will crash about the mismatch with Dom0's virtual memory. Variation of
+the theme: Dom0 sees what it's not supposed to see.
+
+This happens with the said config option enabled and on a machine where
+this scanning is still enabled (K8 and Fam10h, not Bulldozer class)
+
+We have this dump then:
+NUMA: Warning: node ids are out of bound, from=-1 to=-1 distance=10
+Scanning NUMA topology in Northbridge 24
+Number of physical nodes 4
+Node 0 MemBase 0000000000000000 Limit 0000000040000000
+Node 1 MemBase 0000000040000000 Limit 0000000138000000
+Node 2 MemBase 0000000138000000 Limit 00000001f8000000
+Node 3 MemBase 00000001f8000000 Limit 0000000238000000
+Initmem setup node 0 0000000000000000-0000000040000000
+ NODE_DATA [000000003ffd9000 - 000000003fffffff]
+Initmem setup node 1 0000000040000000-0000000138000000
+ NODE_DATA [0000000137fd9000 - 0000000137ffffff]
+Initmem setup node 2 0000000138000000-00000001f8000000
+ NODE_DATA [00000001f095e000 - 00000001f0984fff]
+Initmem setup node 3 00000001f8000000-0000000238000000
+Cannot find 159744 bytes in node 3
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96
+Pid: 0, comm: swapper Not tainted 3.3.6 #1 AMD Dinar/Dinar
+RIP: e030:[<ffffffff81d220e6>] [<ffffffff81d220e6>] __alloc_bootmem_node+0x43/0x96
+.. snip..
+ [<ffffffff81d23024>] sparse_early_usemaps_alloc_node+0x64/0x178
+ [<ffffffff81d23348>] sparse_init+0xe4/0x25a
+ [<ffffffff81d16840>] paging_init+0x13/0x22
+ [<ffffffff81d07fbb>] setup_arch+0x9c6/0xa9b
+ [<ffffffff81683954>] ? printk+0x3c/0x3e
+ [<ffffffff81d01a38>] start_kernel+0xe5/0x468
+ [<ffffffff81d012cf>] x86_64_start_reservations+0xba/0xc1
+ [<ffffffff81007153>] ? xen_setup_runstate_info+0x2c/0x36
+ [<ffffffff81d050ee>] xen_start_kernel+0x565/0x56c
+"
+
+so we just disable NUMA scanning by setting numa_off=1.
+
+Reported-and-Tested-by: Andre Przywara <andre.przywara at amd.com>
+Acked-by: Andre Przywara <andre.przywara at amd.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/x86/xen/setup.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -17,6 +17,7 @@
+ #include <asm/e820.h>
+ #include <asm/setup.h>
+ #include <asm/acpi.h>
++#include <asm/numa.h>
+ #include <asm/xen/hypervisor.h>
+ #include <asm/xen/hypercall.h>
+
+@@ -549,4 +550,7 @@ void __init xen_arch_setup(void)
+ disable_cpufreq();
+ WARN_ON(set_pm_idle_to_default());
+ fiddle_vdso();
++#ifdef CONFIG_NUMA
++ numa_off = 1;
++#endif
+ }
+From 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 Mon Sep 17 00:00:00 2001
+From: Andreas Herrmann <andreas.herrmann3 at amd.com>
+Date: Sun, 23 Sep 2012 20:27:32 +0200
+Subject: hwmon: (fam15h_power) Tweak runavg_range on resume
+
+From: Andreas Herrmann <andreas.herrmann3 at amd.com>
+
+commit 5f0ecb907deb1e6f28071ee3bd568903b9da1be4 upstream.
+
+The quirk introduced with commit
+00250ec90963b7ef6678438888f3244985ecde14 (hwmon: fam15h_power: fix
+bogus values with current BIOSes) is not only required during driver
+load but also when system resumes from suspend. The BIOS might set the
+previously recommended (but unsuitable) initilization value for the
+running average range register during resume.
+
+Signed-off-by: Andreas Herrmann <andreas.herrmann3 at amd.com>
+Tested-by: Andreas Hartmann <andihartmann at 01019freenet.de>
+Signed-off-by: Jean Delvare <khali at linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hwmon/fam15h_power.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -128,12 +128,12 @@ static bool __devinit fam15h_power_is_in
+ * counter saturations resulting in bogus power readings.
+ * We correct this value ourselves to cope with older BIOSes.
+ */
+-static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
++static const struct pci_device_id affected_device[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
+ { 0 }
+ };
+
+-static void __devinit tweak_runavg_range(struct pci_dev *pdev)
++static void tweak_runavg_range(struct pci_dev *pdev)
+ {
+ u32 val;
+
+@@ -157,6 +157,16 @@ static void __devinit tweak_runavg_range
+ REG_TDP_RUNNING_AVERAGE, val);
+ }
+
++#ifdef CONFIG_PM
++static int fam15h_power_resume(struct pci_dev *pdev)
++{
++ tweak_runavg_range(pdev);
++ return 0;
++}
++#else
++#define fam15h_power_resume NULL
++#endif
++
+ static void __devinit fam15h_power_init_data(struct pci_dev *f4,
+ struct fam15h_power_data *data)
+ {
+@@ -255,6 +265,7 @@ static struct pci_driver fam15h_power_dr
+ .id_table = fam15h_power_id_table,
+ .probe = fam15h_power_probe,
+ .remove = __devexit_p(fam15h_power_remove),
++ .resume = fam15h_power_resume,
+ };
+
+ module_pci_driver(fam15h_power_driver);
+From 4e21f4eaa49f78d3e977e316514c941053871c76 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux at roeck-us.net>
+Date: Tue, 11 Sep 2012 13:39:08 -0700
+Subject: hwmon: (ads7871) Add 'name' sysfs attribute
+
+From: Guenter Roeck <linux at roeck-us.net>
+
+commit 4e21f4eaa49f78d3e977e316514c941053871c76 upstream.
+
+The 'name' sysfs attribute is mandatory for hwmon devices, but was missing
+in this driver.
+
+Cc: Paul Thomas <pthomas8589 at gmail.com>
+Signed-off-by: Guenter Roeck <linux at roeck-us.net>
+Acked-by: Jean Delvare <khali at linux-fr.org>
+Acked-by: Paul Thomas <pthomas8589 at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hwmon/ads7871.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/hwmon/ads7871.c
++++ b/drivers/hwmon/ads7871.c
+@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct devic
+ }
+ }
+
++static ssize_t ads7871_show_name(struct device *dev,
++ struct device_attribute *devattr, char *buf)
++{
++ return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
++}
++
+ static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
+ static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
+ static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
+@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_I
+ static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
+ static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
+
++static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
++
+ static struct attribute *ads7871_attributes[] = {
+ &sensor_dev_attr_in0_input.dev_attr.attr,
+ &sensor_dev_attr_in1_input.dev_attr.attr,
+@@ -157,6 +165,7 @@ static struct attribute *ads7871_attribu
+ &sensor_dev_attr_in5_input.dev_attr.attr,
+ &sensor_dev_attr_in6_input.dev_attr.attr,
+ &sensor_dev_attr_in7_input.dev_attr.attr,
++ &dev_attr_name.attr,
+ NULL
+ };
+
+From 3ceefe4319636d89d4bdf40dca9471970f942e4f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux at roeck-us.net>
+Date: Tue, 11 Sep 2012 13:43:17 -0700
+Subject: hwmon: (ad7314) Add 'name' sysfs attribute
+
+From: Guenter Roeck <linux at roeck-us.net>
+
+commit 3ceefe4319636d89d4bdf40dca9471970f942e4f upstream.
+
+The 'name' sysfs attribute is mandatory for hwmon devices, but was missing
+in this driver.
+
+Cc: Jonathan Cameron <jic23 at cam.ac.uk>
+Signed-off-by: Guenter Roeck <linux at roeck-us.net>
+Acked-by: Jean Delvare <khali at linux-fr.org>
+Acked-by: Jonathan Cameron <jic23 at cam.ac.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hwmon/ad7314.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hwmon/ad7314.c
++++ b/drivers/hwmon/ad7314.c
+@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(s
+ }
+ }
+
++static ssize_t ad7314_show_name(struct device *dev,
++ struct device_attribute *devattr, char *buf)
++{
++ return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
++}
++
++static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
+ static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
+ ad7314_show_temperature, NULL, 0);
+
+ static struct attribute *ad7314_attributes[] = {
++ &dev_attr_name.attr,
+ &sensor_dev_attr_temp1_input.dev_attr.attr,
+ NULL,
+ };
+From 8a55ade76551e3927b4e41ee9e7751875d18bc25 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan at linux.intel.com>
+Date: Tue, 4 Sep 2012 15:10:08 +0100
+Subject: dj: memory scribble in logi_dj
+
+From: Alan Cox <alan at linux.intel.com>
+
+commit 8a55ade76551e3927b4e41ee9e7751875d18bc25 upstream.
+
+Allocate a structure not a pointer to it !
+
+Signed-off-by: Alan Cox <alan at linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hid/hid-logitech-dj.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -439,7 +439,7 @@ static int logi_dj_recv_query_paired_dev
+ struct dj_report *dj_report;
+ int retval;
+
+- dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
++ dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
+ if (!dj_report)
+ return -ENOMEM;
+ dj_report->report_id = REPORT_ID_DJ_SHORT;
+@@ -456,7 +456,7 @@ static int logi_dj_recv_switch_to_dj_mod
+ struct dj_report *dj_report;
+ int retval;
+
+- dj_report = kzalloc(sizeof(dj_report), GFP_KERNEL);
++ dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
+ if (!dj_report)
+ return -ENOMEM;
+ dj_report->report_id = REPORT_ID_DJ_SHORT;
+From 596264082f10dd4a567c43d4526b2f54ac5520bc Mon Sep 17 00:00:00 2001
+From: Nestor Lopez Casado <nlopezcasad at logitech.com>
+Date: Fri, 21 Sep 2012 12:21:34 +0200
+Subject: HID: Fix logitech-dj: missing Unifying device issue
+
+From: Nestor Lopez Casado <nlopezcasad at logitech.com>
+
+commit 596264082f10dd4a567c43d4526b2f54ac5520bc upstream.
+
+This patch fixes an issue introduced after commit 4ea5454203d991ec
+("HID: Fix race condition between driver core and ll-driver").
+
+After that commit, hid-core discards any incoming packet that arrives while
+hid driver's probe function is being executed.
+
+This broke the enumeration process of hid-logitech-dj, that must receive
+control packets in-band with the mouse and keyboard packets. Discarding mouse
+or keyboard data at the very begining is usually fine, but it is not the case
+for control packets.
+
+This patch forces a re-enumeration of the paired devices when a packet arrives
+that comes from an unknown device.
+
+Based on a patch originally written by Benjamin Tissoires.
+
+Signed-off-by: Nestor Lopez Casado <nlopezcasad at logitech.com>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/hid/hid-logitech-dj.c | 45 ++++++++++++++++++++++++++++++++++++++++++
+ drivers/hid/hid-logitech-dj.h | 1
+ 2 files changed, 46 insertions(+)
+
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_d
+ static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
+ size_t count,
+ unsigned char report_type);
++static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
+
+ static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ struct dj_report *dj_report)
+@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_devic
+ if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
+ SPFUNCTION_DEVICE_LIST_EMPTY) {
+ dbg_hid("%s: device list is empty\n", __func__);
++ djrcv_dev->querying_devices = false;
+ return;
+ }
+
+@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_devic
+ return;
+ }
+
++ if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
++ /* The device is already known. No need to reallocate it. */
++ dbg_hid("%s: device is already known\n", __func__);
++ return;
++ }
++
+ dj_hiddev = hid_allocate_device();
+ if (IS_ERR(dj_hiddev)) {
+ dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
+@@ -306,6 +314,7 @@ static void delayedwork_callback(struct
+ struct dj_report dj_report;
+ unsigned long flags;
+ int count;
++ int retval;
+
+ dbg_hid("%s\n", __func__);
+
+@@ -338,6 +347,25 @@ static void delayedwork_callback(struct
+ logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
+ break;
+ default:
++ /* A normal report (i. e. not belonging to a pair/unpair notification)
++ * arriving here, means that the report arrived but we did not have a
++ * paired dj_device associated to the report's device_index, this
++ * means that the original "device paired" notification corresponding
++ * to this dj_device never arrived to this driver. The reason is that
++ * hid-core discards all packets coming from a device while probe() is
++ * executing. */
++ if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
++ /* ok, we don't know the device, just re-ask the
++ * receiver for the list of connected devices. */
++ retval = logi_dj_recv_query_paired_devices(djrcv_dev);
++ if (!retval) {
++ /* everything went fine, so just leave */
++ break;
++ }
++ dev_err(&djrcv_dev->hdev->dev,
++ "%s:logi_dj_recv_query_paired_devices "
++ "error:%d\n", __func__, retval);
++ }
+ dbg_hid("%s: unexpected report type\n", __func__);
+ }
+ }
+@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_re
+ if (!djdev) {
+ dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
+ " is NULL, index %d\n", dj_report->device_index);
++ kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
++
++ if (schedule_work(&djrcv_dev->work) == 0) {
++ dbg_hid("%s: did not schedule the work item, was already "
++ "queued\n", __func__);
++ }
+ return;
+ }
+
+@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(
+ if (dj_device == NULL) {
+ dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
+ " is NULL, index %d\n", dj_report->device_index);
++ kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
++
++ if (schedule_work(&djrcv_dev->work) == 0) {
++ dbg_hid("%s: did not schedule the work item, was already "
++ "queued\n", __func__);
++ }
+ return;
+ }
+
+@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_dev
+ struct dj_report *dj_report;
+ int retval;
+
++ /* no need to protect djrcv_dev->querying_devices */
++ if (djrcv_dev->querying_devices)
++ return 0;
++
+ dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
+ if (!dj_report)
+ return -ENOMEM;
+@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_dev
+ return retval;
+ }
+
++
+ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
+ unsigned timeout)
+ {
+--- a/drivers/hid/hid-logitech-dj.h
++++ b/drivers/hid/hid-logitech-dj.h
+@@ -101,6 +101,7 @@ struct dj_receiver_dev {
+ struct work_struct work;
+ struct kfifo notif_fifo;
+ spinlock_t lock;
++ bool querying_devices;
+ };
+
+ struct dj_device {
+From c73f693989d7a7d99ec66a7065295a0c93d0b127 Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton at redhat.com>
+Date: Tue, 18 Sep 2012 14:21:01 -0400
+Subject: cifs: fix return value in cifsConvertToUTF16
+
+From: Jeff Layton <jlayton at redhat.com>
+
+commit c73f693989d7a7d99ec66a7065295a0c93d0b127 upstream.
+
+This function returns the wrong value, which causes the callers to get
+the length of the resulting pathname wrong when it contains non-ASCII
+characters.
+
+This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767
+
+Reported-by: Baldvin Kovacs <baldvin.kovacs at gmail.com>
+Reported-and-Tested-by: Nicolas Lefebvre <nico.lefebvre at gmail.com>
+Signed-off-by: Jeff Layton <jlayton at redhat.com>
+Signed-off-by: Steve French <smfrench at gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ fs/cifs/cifs_unicode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -328,6 +328,6 @@ cifsConvertToUTF16(__le16 *target, const
+ }
+
+ ctoUTF16_out:
+- return i;
++ return j;
+ }
+
+From 5e1782d224c79b26ab7d5c31e3f87657000714fb Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied at redhat.com>
+Date: Tue, 28 Aug 2012 01:53:54 +0000
+Subject: vmwgfx: add dumb ioctl support
+
+From: Dave Airlie <airlied at redhat.com>
+
+commit 5e1782d224c79b26ab7d5c31e3f87657000714fb upstream.
+
+Testing and works with the -modesetting driver,
+
+Reviewed-by: Jakob Bornecrantz <jakob at vmware.com>
+Signed-off-by: Dave Airlie <airlied at redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 5 ++
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 10 ++++
+ drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 73 +++++++++++++++++++++++++++++++
+ 3 files changed, 88 insertions(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -1159,6 +1159,11 @@ static struct drm_driver driver = {
+ .open = vmw_driver_open,
+ .preclose = vmw_preclose,
+ .postclose = vmw_postclose,
++
++ .dumb_create = vmw_dumb_create,
++ .dumb_map_offset = vmw_dumb_map_offset,
++ .dumb_destroy = vmw_dumb_destroy,
++
+ .fops = &vmwgfx_driver_fops,
+ .name = VMWGFX_DRIVER_NAME,
+ .desc = VMWGFX_DRIVER_DESC,
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+@@ -645,6 +645,16 @@ int vmw_kms_readback(struct vmw_private
+ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file_priv);
+
++int vmw_dumb_create(struct drm_file *file_priv,
++ struct drm_device *dev,
++ struct drm_mode_create_dumb *args);
++
++int vmw_dumb_map_offset(struct drm_file *file_priv,
++ struct drm_device *dev, uint32_t handle,
++ uint64_t *offset);
++int vmw_dumb_destroy(struct drm_file *file_priv,
++ struct drm_device *dev,
++ uint32_t handle);
+ /**
+ * Overlay control - vmwgfx_overlay.c
+ */
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+@@ -1917,3 +1917,76 @@ err_ref:
+ vmw_resource_unreference(&res);
+ return ret;
+ }
++
++
++int vmw_dumb_create(struct drm_file *file_priv,
++ struct drm_device *dev,
++ struct drm_mode_create_dumb *args)
++{
++ struct vmw_private *dev_priv = vmw_priv(dev);
++ struct vmw_master *vmaster = vmw_master(file_priv->master);
++ struct vmw_user_dma_buffer *vmw_user_bo;
++ struct ttm_buffer_object *tmp;
++ int ret;
++
++ args->pitch = args->width * ((args->bpp + 7) / 8);
++ args->size = args->pitch * args->height;
++
++ vmw_user_bo = kzalloc(sizeof(*vmw_user_bo), GFP_KERNEL);
++ if (vmw_user_bo == NULL)
++ return -ENOMEM;
++
++ ret = ttm_read_lock(&vmaster->lock, true);
++ if (ret != 0) {
++ kfree(vmw_user_bo);
++ return ret;
++ }
++
++ ret = vmw_dmabuf_init(dev_priv, &vmw_user_bo->dma, args->size,
++ &vmw_vram_sys_placement, true,
++ &vmw_user_dmabuf_destroy);
++ if (ret != 0)
++ goto out_no_dmabuf;
++
++ tmp = ttm_bo_reference(&vmw_user_bo->dma.base);
++ ret = ttm_base_object_init(vmw_fpriv(file_priv)->tfile,
++ &vmw_user_bo->base,
++ false,
++ ttm_buffer_type,
++ &vmw_user_dmabuf_release, NULL);
++ if (unlikely(ret != 0))
++ goto out_no_base_object;
++
++ args->handle = vmw_user_bo->base.hash.key;
++
++out_no_base_object:
++ ttm_bo_unref(&tmp);
++out_no_dmabuf:
++ ttm_read_unlock(&vmaster->lock);
++ return ret;
++}
++
++int vmw_dumb_map_offset(struct drm_file *file_priv,
++ struct drm_device *dev, uint32_t handle,
++ uint64_t *offset)
++{
++ struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
++ struct vmw_dma_buffer *out_buf;
++ int ret;
++
++ ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
++ if (ret != 0)
++ return -EINVAL;
++
++ *offset = out_buf->base.addr_space_offset;
++ vmw_dmabuf_unreference(&out_buf);
++ return 0;
++}
++
++int vmw_dumb_destroy(struct drm_file *file_priv,
++ struct drm_device *dev,
++ uint32_t handle)
++{
++ return ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile,
++ handle, TTM_REF_USAGE);
++}
+From 85e87870fa18ec9f5df98e2d3b48f3699560a570 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn at mork.no>
+Date: Sun, 2 Sep 2012 22:26:18 +0000
+Subject: net: usbnet: fix softirq storm on suspend
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn at mork.no>
+
+commit 85e87870fa18ec9f5df98e2d3b48f3699560a570 upstream.
+
+Suspending an open usbnet device results in constant
+rescheduling of usbnet_bh.
+
+commit 65841fd5 "usbnet: handle remote wakeup asap"
+refactored the usbnet_bh code to allow sharing the
+urb allocate and submit code with usbnet_resume. In
+this process, a test for, and immediate return on,
+ENOLINK from rx_submit was unintentionally dropped.
+
+The rx queue will not grow if rx_submit fails,
+making usbnet_bh reschedule itself. This results
+in a softirq storm if the error is persistent.
+rx_submit translates the usb_submit_urb error
+EHOSTUNREACH into ENOLINK, so this is an expected
+and persistent error for a suspended device. The
+old code tested for this condition and avoided
+rescheduling. Putting this test back.
+
+Cc: Ming Lei <ming.lei at canonical.com>
+Cc: Oliver Neukum <oneukum at suse.de>
+Signed-off-by: Bjørn Mork <bjorn at mork.no>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/usb/usbnet.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1204,19 +1204,26 @@ deferred:
+ }
+ EXPORT_SYMBOL_GPL(usbnet_start_xmit);
+
+-static void rx_alloc_submit(struct usbnet *dev, gfp_t flags)
++static int rx_alloc_submit(struct usbnet *dev, gfp_t flags)
+ {
+ struct urb *urb;
+ int i;
++ int ret = 0;
+
+ /* don't refill the queue all at once */
+ for (i = 0; i < 10 && dev->rxq.qlen < RX_QLEN(dev); i++) {
+ urb = usb_alloc_urb(0, flags);
+ if (urb != NULL) {
+- if (rx_submit(dev, urb, flags) == -ENOLINK)
+- return;
++ ret = rx_submit(dev, urb, flags);
++ if (ret)
++ goto err;
++ } else {
++ ret = -ENOMEM;
++ goto err;
+ }
+ }
++err:
++ return ret;
+ }
+
+ /*-------------------------------------------------------------------------*/
+@@ -1260,7 +1267,8 @@ static void usbnet_bh (unsigned long par
+ int temp = dev->rxq.qlen;
+
+ if (temp < RX_QLEN(dev)) {
+- rx_alloc_submit(dev, GFP_ATOMIC);
++ if (rx_alloc_submit(dev, GFP_ATOMIC) == -ENOLINK)
++ return;
+ if (temp != dev->rxq.qlen)
+ netif_dbg(dev, link, dev->net,
+ "rxqlen %d --> %d\n",
+From d90c92fee89ccd75ef2646f3bde0b4c0450666c3 Mon Sep 17 00:00:00 2001
+From: Santiago Leon <santil at linux.vnet.ibm.com>
+Date: Tue, 4 Sep 2012 14:41:37 +0000
+Subject: ibmveth: Fix alignment of rx queue bug
+
+From: Santiago Leon <santil at linux.vnet.ibm.com>
+
+commit d90c92fee89ccd75ef2646f3bde0b4c0450666c3 upstream.
+
+This patch fixes a bug found by Nish Aravamudan
+(https://lkml.org/lkml/2012/5/15/220) where the driver is not following
+the spec (it is not aligning the rx buffer on a 16-byte boundary) and the
+hypervisor aborts the registration, making the device unusable.
+
+The fix follows BenH's recommendation (https://lkml.org/lkml/2012/7/20/461)
+to replace the kmalloc+map for a single call to dma_alloc_coherent()
+because that function always aligns to a 16-byte boundary.
+
+The stable trees will run into this bug whenever the rx buffer kmalloc call
+returns something not aligned on a 16-byte boundary.
+
+Signed-off-by: Santiago Leon <santil at linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ibm/ibmveth.c | 26 +++++++++-----------------
+ 1 file changed, 9 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -472,14 +472,9 @@ static void ibmveth_cleanup(struct ibmve
+ }
+
+ if (adapter->rx_queue.queue_addr != NULL) {
+- if (!dma_mapping_error(dev, adapter->rx_queue.queue_dma)) {
+- dma_unmap_single(dev,
+- adapter->rx_queue.queue_dma,
+- adapter->rx_queue.queue_len,
+- DMA_BIDIRECTIONAL);
+- adapter->rx_queue.queue_dma = DMA_ERROR_CODE;
+- }
+- kfree(adapter->rx_queue.queue_addr);
++ dma_free_coherent(dev, adapter->rx_queue.queue_len,
++ adapter->rx_queue.queue_addr,
++ adapter->rx_queue.queue_dma);
+ adapter->rx_queue.queue_addr = NULL;
+ }
+
+@@ -556,10 +551,13 @@ static int ibmveth_open(struct net_devic
+ goto err_out;
+ }
+
++ dev = &adapter->vdev->dev;
++
+ adapter->rx_queue.queue_len = sizeof(struct ibmveth_rx_q_entry) *
+ rxq_entries;
+- adapter->rx_queue.queue_addr = kmalloc(adapter->rx_queue.queue_len,
+- GFP_KERNEL);
++ adapter->rx_queue.queue_addr =
++ dma_alloc_coherent(dev, adapter->rx_queue.queue_len,
++ &adapter->rx_queue.queue_dma, GFP_KERNEL);
+
+ if (!adapter->rx_queue.queue_addr) {
+ netdev_err(netdev, "unable to allocate rx queue pages\n");
+@@ -567,19 +565,13 @@ static int ibmveth_open(struct net_devic
+ goto err_out;
+ }
+
+- dev = &adapter->vdev->dev;
+-
+ adapter->buffer_list_dma = dma_map_single(dev,
+ adapter->buffer_list_addr, 4096, DMA_BIDIRECTIONAL);
+ adapter->filter_list_dma = dma_map_single(dev,
+ adapter->filter_list_addr, 4096, DMA_BIDIRECTIONAL);
+- adapter->rx_queue.queue_dma = dma_map_single(dev,
+- adapter->rx_queue.queue_addr,
+- adapter->rx_queue.queue_len, DMA_BIDIRECTIONAL);
+
+ if ((dma_mapping_error(dev, adapter->buffer_list_dma)) ||
+- (dma_mapping_error(dev, adapter->filter_list_dma)) ||
+- (dma_mapping_error(dev, adapter->rx_queue.queue_dma))) {
++ (dma_mapping_error(dev, adapter->filter_list_dma))) {
+ netdev_err(netdev, "unable to map filter or buffer list "
+ "pages\n");
+ rc = -ENOMEM;
+From 3d2abdfdf14f4d6decc2023708211e19b096f4ca Mon Sep 17 00:00:00 2001
+From: Eliad Peller <eliad at wizery.com>
+Date: Tue, 4 Sep 2012 17:44:45 +0300
+Subject: mac80211: clear bssid on auth/assoc failure
+
+From: Eliad Peller <eliad at wizery.com>
+
+commit 3d2abdfdf14f4d6decc2023708211e19b096f4ca upstream.
+
+ifmgd->bssid wasn't cleared properly in some
+auth/assoc failure cases, causing mac80211 and
+the low-level driver to go out of sync.
+
+Clear ifmgd->bssid on failure, and notify the driver.
+
+Signed-off-by: Eliad Peller <eliad at wizery.com>
+Signed-off-by: Johannes Berg <johannes.berg at intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ net/mac80211/mlme.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3270,6 +3270,8 @@ int ieee80211_mgd_auth(struct ieee80211_
+ goto out_unlock;
+
+ err_clear:
++ memset(ifmgd->bssid, 0, ETH_ALEN);
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
+ ifmgd->auth_data = NULL;
+ err_free:
+ kfree(auth_data);
+@@ -3449,6 +3451,8 @@ int ieee80211_mgd_assoc(struct ieee80211
+ err = 0;
+ goto out;
+ err_clear:
++ memset(ifmgd->bssid, 0, ETH_ALEN);
++ ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
+ ifmgd->assoc_data = NULL;
+ err_free:
+ kfree(assoc_data);
+From ed205b361956c96e0d8c09a8c9135a6a79cd9541 Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman at broadcom.com>
+Date: Tue, 11 Sep 2012 21:16:47 +0200
+Subject: brcmfmac: fix big endian bug in i-scan.
+
+From: Hante Meuleman <meuleman at broadcom.com>
+
+commit ed205b361956c96e0d8c09a8c9135a6a79cd9541 upstream.
+
+ssid len is 32 bit and needs endian conversion for big endian systems.
+
+Signed-off-by: Hante Meuleman <meuleman at broadcom.com>
+Signed-off-by: Arend van Spriel <arend at broadcom.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_s
+ params_le->active_time = cpu_to_le32(-1);
+ params_le->passive_time = cpu_to_le32(-1);
+ params_le->home_time = cpu_to_le32(-1);
+- if (ssid && ssid->SSID_len)
+- memcpy(¶ms_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
++ if (ssid && ssid->SSID_len) {
++ params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
++ memcpy(¶ms_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
++ }
+ }
+
+ static s32
+From e020a83d0942a5aceac35986500c9834efc8707d Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman at broadcom.com>
+Date: Tue, 11 Sep 2012 21:16:48 +0200
+Subject: brcmfmac: Fix big endian host configuration data.
+
+From: Hante Meuleman <meuleman at broadcom.com>
+
+commit e020a83d0942a5aceac35986500c9834efc8707d upstream.
+
+Fixes big endian host configuration parameters.
+
+Reviewed-by: Arend Van Spriel <arend at broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman at broadcom.com>
+Signed-off-by: Arend van Spriel <arend at broadcom.com>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c | 26 +++++++++++--------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(stru
+ {
+ char iovbuf[32];
+ int retcode;
++ __le32 arp_mode_le;
+
+- brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
++ arp_mode_le = cpu_to_le32(arp_mode);
++ brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
++ sizeof(iovbuf));
+ retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
+ iovbuf, sizeof(iovbuf));
+ retcode = retcode >= 0 ? 0 : retcode;
+@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(s
+ {
+ char iovbuf[32];
+ int retcode;
++ __le32 arp_enable_le;
+
+- brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
++ arp_enable_le = cpu_to_le32(arp_enable);
++
++ brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
+ iovbuf, sizeof(iovbuf));
+ retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
+ iovbuf, sizeof(iovbuf));
+@@ -802,10 +808,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
+ char buf[128], *ptr;
+ u32 dongle_align = drvr->bus_if->align;
+ u32 glom = 0;
+- u32 roaming = 1;
+- uint bcn_timeout = 3;
+- int scan_assoc_time = 40;
+- int scan_unassoc_time = 40;
++ __le32 roaming_le = cpu_to_le32(1);
++ __le32 bcn_timeout_le = cpu_to_le32(3);
++ __le32 scan_assoc_time_le = cpu_to_le32(40);
++ __le32 scan_unassoc_time_le = cpu_to_le32(40);
+ int i;
+
+ mutex_lock(&drvr->proto_block);
+@@ -840,14 +846,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
+
+ /* Setup timeout if Beacons are lost and roam is off to report
+ link down */
+- brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
++ brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
+ sizeof(iovbuf));
+ brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+ sizeof(iovbuf));
+
+ /* Enable/Disable build-in roaming to allowed ext supplicant to take
+ of romaing */
+- brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
++ brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
+ iovbuf, sizeof(iovbuf));
+ brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
+ sizeof(iovbuf));
+@@ -859,9 +865,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_p
+ sizeof(iovbuf));
+
+ brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+- (char *)&scan_assoc_time, sizeof(scan_assoc_time));
++ (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
+ brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
+- (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
++ (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
+
+ /* Set and enable ARP offload feature */
+ brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
+From 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 Mon Sep 17 00:00:00 2001
+From: James Bottomley <jbottomley at parallels.com>
+Date: Thu, 21 Jun 2012 07:50:02 +0000
+Subject: SCSI: lpfc: fix problems with -Werror
+
+From: James Bottomley <jbottomley at parallels.com>
+
+commit 4bdd03e61b7a5c4c6bc2b25d46fcd491788fdfb3 upstream.
+
+Commit d38bd3aef ("Add -Werror compilation flag") is causing build breakage
+with random gcc incarnations. These look like gcc problems, but we shouldn't
+break the build because of a bad gcc. Fix this by adding a make flag
+
+WARNINGS_BECOME_ERRORS=1
+
+which is the same as aic7xxx uses so ordinarily the build doesn't use -Werror
+
+Reported-by: Fengguang Wu <fengguang.wu at intel.com>
+Cc: Alex Iannicelli <alex.iannicelli at emulex.com>
+Cc: James Smart <james.smart at emulex.com>
+Cc: Jonathan Nieder <jrnieder at gmail.com>
+Cc: Mike Pagano <mpagano at gentoo.org>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+
+---
+ drivers/scsi/lpfc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/lpfc/Makefile
++++ b/drivers/scsi/lpfc/Makefile
+@@ -22,7 +22,9 @@
+ ccflags-$(GCOV) := -fprofile-arcs -ftest-coverage
+ ccflags-$(GCOV) += -O0
+
++ifdef WARNINGS_BECOME_ERRORS
+ ccflags-y += -Werror
++endif
+
+ obj-$(CONFIG_SCSI_LPFC) := lpfc.o
+
+From 10cce6d8b5af0b32bc4254ae4a28423a74c0921c Mon Sep 17 00:00:00 2001
+From: "sreekanth.reddy at lsi.com" <sreekanth.reddy at lsi.com>
+Date: Wed, 22 Aug 2012 16:55:13 +0530
+Subject: SCSI: mpt2sas: Fix for issue - Unable to boot from the drive connected to HBA
+
+From: "sreekanth.reddy at lsi.com" <sreekanth.reddy at lsi.com>
+
+commit 10cce6d8b5af0b32bc4254ae4a28423a74c0921c upstream.
+
+This patch checks whether HBA is SAS2008 B0 controller.
+if it is a SAS2008 B0 controller then it use IO-APIC interrupt instead of MSIX,
+as SAS2008 B0 controller doesn't support MSIX interrupts.
+
+[jejb: fix whitespace problems]
+Signed-off-by: Sreekanth Reddy <sreekanth.reddy at lsi.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/scsi/mpt2sas/mpt2sas_base.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
+@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_A
+ u16 message_control;
+
+
++ /* Check whether controller SAS2008 B0 controller,
++ if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
++ if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
++ ioc->pdev->revision == 0x01) {
++ return -EINVAL;
++ }
++
+ base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
+ if (!base) {
+ dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
+From d6532207116307eb7ecbfa7b9e02c53230096a50 Mon Sep 17 00:00:00 2001
+From: Eddie Wai <eddie.wai at broadcom.com>
+Date: Tue, 21 Aug 2012 10:35:53 -0700
+Subject: SCSI: bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload
+
+From: Eddie Wai <eddie.wai at broadcom.com>
+
+commit d6532207116307eb7ecbfa7b9e02c53230096a50 upstream.
+
+This patch fixes the following kernel panic invoked by uninitialized fields
+in the chip initialization for the 1G bnx2 iSCSI offload.
+
+One of the bits in the chip initialization is being used by the latest
+firmware to control overflow packets. When this control bit gets enabled
+erroneously, it would ultimately result in a bad packet placement which would
+cause the bnx2 driver to dereference a NULL ptr in the placement handler.
+
+This can happen under certain stress I/O environment under the Linux
+iSCSI offload operation.
+
+This change only affects Broadcom's 5709 chipset.
+
+Unable to handle kernel NULL pointer dereference at 0000000000000008 RIP:
+ [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
+Pid: 0, comm: swapper Tainted: G ---- 2.6.18-333.el5debug #2
+RIP: 0010:[<ffffffff881f0e7d>] [<ffffffff881f0e7d>] :bnx2:bnx2_poll_work+0xd0d/0x13c5
+RSP: 0018:ffff8101b575bd50 EFLAGS: 00010216
+RAX: 0000000000000005 RBX: ffff81007c5fb180 RCX: 0000000000000000
+RDX: 0000000000000ffc RSI: 00000000817e8000 RDI: 0000000000000220
+RBP: ffff81015bbd7ec0 R08: ffff8100817e9000 R09: 0000000000000000
+R10: ffff81007c5fb180 R11: 00000000000000c8 R12: 000000007a25a010
+R13: 0000000000000000 R14: 0000000000000005 R15: ffff810159f80558
+FS: 0000000000000000(0000) GS:ffff8101afebc240(0000) knlGS:0000000000000000
+CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+CR2: 0000000000000008 CR3: 0000000000201000 CR4: 00000000000006a0
+Process swapper (pid: 0, threadinfo ffff8101b5754000, task ffff8101afebd820)
+Stack: 000000000000000b ffff810159f80000 0000000000000040 ffff810159f80520
+ ffff810159f80500 00cf00cf8008e84b ffffc200100939e0 ffff810009035b20
+ 0000502900000000 000000be00000001 ffff8100817e7810 00d08101b575bea8
+Call Trace:
+ <IRQ> [<ffffffff8008e0d0>] show_schedstat+0x1c2/0x25b
+ [<ffffffff881f1886>] :bnx2:bnx2_poll+0xf6/0x231
+ [<ffffffff8000c9b9>] net_rx_action+0xac/0x1b1
+ [<ffffffff800125a0>] __do_softirq+0x89/0x133
+ [<ffffffff8005e30c>] call_softirq+0x1c/0x28
+ [<ffffffff8006d5de>] do_softirq+0x2c/0x7d
+ [<ffffffff8006d46e>] do_IRQ+0xee/0xf7
+ [<ffffffff8005d625>] ret_from_intr+0x0/0xa
+ <EOI> [<ffffffff801a5780>] acpi_processor_idle_simple+0x1c5/0x341
+ [<ffffffff801a573d>] acpi_processor_idle_simple+0x182/0x341
+ [<ffffffff801a55bb>] acpi_processor_idle_simple+0x0/0x341
+ [<ffffffff80049560>] cpu_idle+0x95/0xb8
+ [<ffffffff80078b1c>] start_secondary+0x479/0x488
+
+Signed-off-by: Eddie Wai <eddie.wai at broadcom.com>
+Reviewed-by: Mike Christie <michaelc at cs.wisc.edu>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/scsi/bnx2i/bnx2i_hwi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
+@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct
+ int rc = 0;
+ u64 mask64;
+
++ memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
++ memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
++
+ bnx2i_adjust_qp_size(hba);
+
+ iscsi_init.flags =
+From 256d0eaac87da1e993190846064f339f4c7a63f5 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron at beardog.cce.hp.com>
+Date: Fri, 14 Sep 2012 16:34:25 -0500
+Subject: SCSI: hpsa: fix handling of protocol error
+
+From: "Stephen M. Cameron" <scameron at beardog.cce.hp.com>
+
+commit 256d0eaac87da1e993190846064f339f4c7a63f5 upstream.
+
+If a command status of CMD_PROTOCOL_ERR is received, this
+information should be conveyed to the SCSI mid layer, not
+dropped on the floor. CMD_PROTOCOL_ERR may be received
+from the Smart Array for any commands destined for an external
+RAID controller such as a P2000, or commands destined for tape
+drives or CD/DVD-ROM drives, if for instance a cable is
+disconnected. This mostly affects multipath configurations, as
+disconnecting a cable on a non-multipath configuration is not
+going to do anything good regardless of whether CMD_PROTOCOL_ERR
+is handled correctly or not. Not handling CMD_PROTOCOL_ERR
+correctly in a multipath configaration involving external RAID
+controllers may cause data corruption, so this is quite a serious
+bug. This bug should not normally cause a problem for direct
+attached disk storage.
+
+Signed-off-by: Stephen M. Cameron <scameron at beardog.cce.hp.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/scsi/hpsa.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct
+ }
+ break;
+ case CMD_PROTOCOL_ERR:
++ cmd->result = DID_ERROR << 16;
+ dev_warn(&h->pdev->dev, "cp %p has "
+- "protocol error \n", cp);
++ "protocol error\n", cp);
+ break;
+ case CMD_HARDWARE_ERR:
+ cmd->result = DID_ERROR << 16;
+From 27e99ade81368e6fdda3212bff9345177cf9e57a Mon Sep 17 00:00:00 2001
+From: Wang Sen <senwang at linux.vnet.ibm.com>
+Date: Mon, 30 Jul 2012 14:25:06 +0800
+Subject: SCSI: scsi: virtio-scsi: Fix address translation failure of HighMem pages used by sg list
+
+From: Wang Sen <senwang at linux.vnet.ibm.com>
+
+commit 27e99ade81368e6fdda3212bff9345177cf9e57a upstream.
+
+When using the commands below to write some data to a virtio-scsi LUN of the
+QEMU guest(32-bit) with 1G physical memory(qemu -m 1024), the qemu will crash.
+
+ # sudo mkfs.ext4 /dev/sdb (/dev/sdb is the virtio-scsi LUN.)
+ # sudo mount /dev/sdb /mnt
+ # dd if=/dev/zero of=/mnt/file bs=1M count=1024
+
+In current implementation, sg_set_buf is called to add buffers to sg list which
+is put into the virtqueue eventually. But if there are some HighMem pages in
+table->sgl you can not get virtual address by sg_virt. So, sg_virt(sg_elem) may
+return NULL value. This will cause QEMU exit when virtqueue_map_sg is called
+in QEMU because an invalid GPA is passed by virtqueue.
+
+Two solutions are discussed here:
+http://lkml.indiana.edu/hypermail/linux/kernel/1207.3/00675.html
+
+Finally, value assignment approach was adopted because:
+
+Value assignment creates a well-formed scatterlist, because the termination
+marker in source sg_list has been set in blk_rq_map_sg(). The last entry of the
+source sg_list is just copied to the the last entry in destination list. Note
+that, for now, virtio_ring does not care about the form of the scatterlist and
+simply processes the first out_num + in_num consecutive elements of the sg[]
+array.
+
+I have tested the patch on my workstation. QEMU would not crash any more.
+
+Signed-off-by: Wang Sen <senwang at linux.vnet.ibm.com>
+Acked-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: James Bottomley <JBottomley at Parallels.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/scsi/virtio_scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/virtio_scsi.c
++++ b/drivers/scsi/virtio_scsi.c
+@@ -198,7 +198,7 @@ static void virtscsi_map_sgl(struct scat
+ int i;
+
+ for_each_sg(table->sgl, sg_elem, table->nents, i)
+- sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
++ sg[idx++] = *sg_elem;
+
+ *p_idx = idx;
+ }
+From 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 Mon Sep 17 00:00:00 2001
+From: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+Date: Wed, 29 Aug 2012 10:02:08 +0200
+Subject: Bluetooth: mgmt: Fix enabling SSP while powered off
+
+From: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+
+commit 3d1cbdd6aefff711bcf389fdabc4af9bc22e8201 upstream.
+
+When new BT USB adapter is plugged in it's configured while still being powered
+off (HCI_AUTO_OFF flag is set), thus Set SSP will only set dev_flags but won't
+write changes to controller. As a result remote devices won't use Secure Simple
+Pairing with our device due to SSP Host Support flag disabled in extended
+features and may also reject SSP attempt from our side (with possible fallback
+to legacy pairing).
+
+This patch ensures HCI Write Simple Pairing Mode is sent when Set Powered is
+called to power on controller and clear HCI_AUTO_OFF flag.
+
+Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+Acked-by: Johan Hedberg <johan.hedberg at intel.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan at collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -2879,6 +2879,12 @@ int mgmt_powered(struct hci_dev *hdev, u
+ if (scan)
+ hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
+
++ if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
++ u8 ssp = 1;
++
++ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
++ }
++
+ update_class(hdev);
+ update_name(hdev, hdev->dev_name);
+ update_eir(hdev);
+From 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a Mon Sep 17 00:00:00 2001
+From: Vinicius Costa Gomes <vinicius.gomes at openbossa.org>
+Date: Fri, 14 Sep 2012 16:34:46 -0300
+Subject: Bluetooth: Fix not removing power_off delayed work
+
+From: Vinicius Costa Gomes <vinicius.gomes at openbossa.org>
+
+commit 78c04c0bf52360dc2f7185e99c8e9aa05d73ae5a upstream.
+
+For example, when a usb reset is received (I could reproduce it
+running something very similar to this[1] in a loop) it could be
+that the device is unregistered while the power_off delayed work
+is still scheduled to run.
+
+Backtrace:
+
+WARNING: at lib/debugobjects.c:261 debug_print_object+0x7c/0x8d()
+Hardware name: To Be Filled By O.E.M.
+ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x26
+Modules linked in: nouveau mxm_wmi btusb wmi bluetooth ttm coretemp drm_kms_helper
+Pid: 2114, comm: usb-reset Not tainted 3.5.0bt-next #2
+Call Trace:
+ [<ffffffff8124cc00>] ? free_obj_work+0x57/0x91
+ [<ffffffff81058f88>] warn_slowpath_common+0x7e/0x97
+ [<ffffffff81059035>] warn_slowpath_fmt+0x41/0x43
+ [<ffffffff8124ccb6>] debug_print_object+0x7c/0x8d
+ [<ffffffff8106e3ec>] ? __queue_work+0x259/0x259
+ [<ffffffff8124d63e>] ? debug_check_no_obj_freed+0x6f/0x1b5
+ [<ffffffff8124d667>] debug_check_no_obj_freed+0x98/0x1b5
+ [<ffffffffa00aa031>] ? bt_host_release+0x10/0x1e [bluetooth]
+ [<ffffffff810fc035>] kfree+0x90/0xe6
+ [<ffffffffa00aa031>] bt_host_release+0x10/0x1e [bluetooth]
+ [<ffffffff812ec2f9>] device_release+0x4a/0x7e
+ [<ffffffff8123ef57>] kobject_release+0x11d/0x154
+ [<ffffffff8123ed98>] kobject_put+0x4a/0x4f
+ [<ffffffff812ec0d9>] put_device+0x12/0x14
+ [<ffffffffa009472b>] hci_free_dev+0x22/0x26 [bluetooth]
+ [<ffffffffa0280dd0>] btusb_disconnect+0x96/0x9f [btusb]
+ [<ffffffff813581b4>] usb_unbind_interface+0x57/0x106
+ [<ffffffff812ef988>] __device_release_driver+0x83/0xd6
+ [<ffffffff812ef9fb>] device_release_driver+0x20/0x2d
+ [<ffffffff813582a7>] usb_driver_release_interface+0x44/0x7b
+ [<ffffffff81358795>] usb_forced_unbind_intf+0x45/0x4e
+ [<ffffffff8134f959>] usb_reset_device+0xa6/0x12e
+ [<ffffffff8135df86>] usbdev_do_ioctl+0x319/0xe20
+ [<ffffffff81203244>] ? avc_has_perm_flags+0xc9/0x12e
+ [<ffffffff812031a0>] ? avc_has_perm_flags+0x25/0x12e
+ [<ffffffff81050101>] ? do_page_fault+0x31e/0x3a1
+ [<ffffffff8135eaa6>] usbdev_ioctl+0x9/0xd
+ [<ffffffff811126b1>] vfs_ioctl+0x21/0x34
+ [<ffffffff81112f7b>] do_vfs_ioctl+0x408/0x44b
+ [<ffffffff81208d45>] ? file_has_perm+0x76/0x81
+ [<ffffffff8111300f>] sys_ioctl+0x51/0x76
+ [<ffffffff8158db22>] system_call_fastpath+0x16/0x1b
+
+[1] http://cpansearch.perl.org/src/DPAVLIN/Biblio-RFID-0.03/examples/usbreset.c
+
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes at openbossa.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan at collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ net/bluetooth/hci_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -753,6 +753,8 @@ static int hci_dev_do_close(struct hci_d
+
+ cancel_work_sync(&hdev->le_scan);
+
++ cancel_delayed_work(&hdev->power_off);
++
+ hci_req_cancel(hdev, ENODEV);
+ hci_req_lock(hdev);
+
+From 562fcc246ebe31ade6e1be08585673b9b2785498 Mon Sep 17 00:00:00 2001
+From: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+Date: Wed, 29 Aug 2012 10:02:09 +0200
+Subject: Bluetooth: mgmt: Fix enabling LE while powered off
+
+From: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+
+commit 562fcc246ebe31ade6e1be08585673b9b2785498 upstream.
+
+When new BT USB adapter is plugged in it's configured while still being powered
+off (HCI_AUTO_OFF flag is set), thus Set LE will only set dev_flags but won't
+write changes to controller. As a result it's not possible to start device
+discovery session on LE controller as it uses interleaved discovery which
+requires LE Supported Host flag in extended features.
+
+This patch ensures HCI Write LE Host Supported is sent when Set Powered is
+called to power on controller and clear HCI_AUTO_OFF flag.
+
+Signed-off-by: Andrzej Kaczmarek <andrzej.kaczmarek at tieto.com>
+Acked-by: Johan Hedberg <johan.hedberg at intel.com>
+Signed-off-by: Gustavo Padovan <gustavo.padovan at collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -2885,6 +2885,16 @@ int mgmt_powered(struct hci_dev *hdev, u
+ hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+ }
+
++ if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
++ struct hci_cp_write_le_host_supported cp;
++
++ cp.le = 1;
++ cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
++
++ hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
++ sizeof(cp), &cp);
++ }
++
+ update_class(hdev);
+ update_name(hdev, hdev->dev_name);
+ update_eir(hdev);
+From be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a Mon Sep 17 00:00:00 2001
+From: Mark Salter <msalter at redhat.com>
+Date: Mon, 24 Sep 2012 17:17:38 -0700
+Subject: c/r: prctl: fix build error for no-MMU case
+
+From: Mark Salter <msalter at redhat.com>
+
+commit be8cfc4af15cf611dfeb66a1fb5df43d5f1e280a upstream.
+
+Commit 1ad75b9e1628 ("c/r: prctl: add minimal address test to
+PR_SET_MM") added some address checking to prctl_set_mm() used by
+checkpoint-restore. This causes a build error for no-MMU systems:
+
+ kernel/sys.c: In function 'prctl_set_mm':
+ kernel/sys.c:1868:34: error: 'mmap_min_addr' undeclared (first use in this function)
+
+The test for mmap_min_addr doesn't make a lot of sense for no-MMU code
+as noted in commit 6e1415467614 ("NOMMU: Optimise away the
+{dac_,}mmap_min_addr tests").
+
+This patch defines mmap_min_addr as 0UL in the no-MMU case so that the
+compiler will optimize away tests for "addr < mmap_min_addr".
+
+Signed-off-by: Mark Salter <msalter at redhat.com>
+Reviewed-by: Cyrill Gorcunov <gorcunov at openvz.org>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/linux/security.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -118,6 +118,7 @@ void reset_security_ops(void);
+ extern unsigned long mmap_min_addr;
+ extern unsigned long dac_mmap_min_addr;
+ #else
++#define mmap_min_addr 0UL
+ #define dac_mmap_min_addr 0UL
+ #endif
+
+From 308b135e4fcc00c80c07e0e04e7afa8edf78583c Mon Sep 17 00:00:00 2001
+From: Toshi Kani <toshi.kani at hp.com>
+Date: Mon, 27 Aug 2012 12:52:24 -0600
+Subject: hpwdt: Fix kdump issue in hpwdt
+
+From: Toshi Kani <toshi.kani at hp.com>
+
+commit 308b135e4fcc00c80c07e0e04e7afa8edf78583c upstream.
+
+kdump can be interrupted by watchdog timer when the timer is left
+activated on the crash kernel. Changed the hpwdt driver to disable
+watchdog timer at boot-time. This assures that watchdog timer is
+disabled until /dev/watchdog is opened, and prevents watchdog timer
+to be left running on the crash kernel.
+
+Signed-off-by: Toshi Kani <toshi.kani at hp.com>
+Tested-by: Lisa Mitchell <lisa.mitchell at hp.com>
+Signed-off-by: Thomas Mingarelli <Thomas.Mingarelli at hp.com>
+Signed-off-by: Wim Van Sebroeck <wim at iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/watchdog/hpwdt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/watchdog/hpwdt.c
++++ b/drivers/watchdog/hpwdt.c
+@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(stru
+ hpwdt_timer_reg = pci_mem_addr + 0x70;
+ hpwdt_timer_con = pci_mem_addr + 0x72;
+
++ /* Make sure that timer is disabled until /dev/watchdog is opened */
++ hpwdt_stop();
++
+ /* Make sure that we have a valid soft_margin */
+ if (hpwdt_change_timer(soft_margin))
+ hpwdt_change_timer(DEFAULT_MARGIN);
+From 35495173e1df621dff0e9a244accbe32cd28a98f Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam at freescale.com>
+Date: Sun, 16 Sep 2012 22:28:35 -0300
+Subject: ARM: imx: armadillo5x0: Fix illegal register access
+
+From: Fabio Estevam <fabio.estevam at freescale.com>
+
+commit 35495173e1df621dff0e9a244accbe32cd28a98f upstream.
+
+Since commit eb92044eb (ARM i.MX3: Make ccm base address a variable )
+it is necessary to pass the CCM register base as a variable.
+
+Fix the CCM register access in mach-armadillo5x0 by passing mx3_ccm_base and
+avoid illegal accesses.
+
+Also applies to v3.5
+
+Reported-by: Arnd Bergmann <arnd at arndb.de>
+Signed-off-by: Fabio Estevam <fabio.estevam at freescale.com>
+Acked-by: Arnd Bergmann <arnd at arndb.de>
+Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/mach-armadillo5x0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/mach-armadillo5x0.c
++++ b/arch/arm/mach-imx/mach-armadillo5x0.c
+@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(voi
+ imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
+
+ /* set NAND page size to 2k if not configured via boot mode pins */
+- __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
++ __raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
++ (1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
+
+ /* RTC */
+ /* Get RTC IRQ and register the chip */
+From e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 Mon Sep 17 00:00:00 2001
+From: Matthew Leach <matthew.leach at arm.com>
+Date: Tue, 11 Sep 2012 17:56:57 +0100
+Subject: ARM: 7532/1: decompressor: reset SCTLR.TRE for VMSA ARMv7 cores
+
+From: Matthew Leach <matthew.leach at arm.com>
+
+commit e1e5b7e4251c7538ca08c2c5545b0c2fbd8a6635 upstream.
+
+This patch zeroes the SCTLR.TRE bit prior to setting the mapping as
+cacheable for ARMv7 cores in the decompressor, ensuring that the
+memory region attributes are obtained from the C and B bits, not from
+the page tables.
+
+Cc: Nicolas Pitre <nico at fluxnic.net>
+Reviewed-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Matthew Leach <matthew.leach at arm.com>
+Signed-off-by: Will Deacon <will.deacon at arm.com>
+Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/arm/boot/compressed/head.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -653,6 +653,7 @@ __armv7_mmu_cache_on:
+ mcrne p15, 0, r0, c8, c7, 0 @ flush I,D TLBs
+ #endif
+ mrc p15, 0, r0, c1, c0, 0 @ read control reg
++ bic r0, r0, #1 << 28 @ clear SCTLR.TRE
+ orr r0, r0, #0x5000 @ I-cache enable, RR cache replacement
+ orr r0, r0, #0x003c @ write buffer
+ #ifdef CONFIG_MMU
+From 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa Mon Sep 17 00:00:00 2001
+From: Wen Congyang <wency at cn.fujitsu.com>
+Date: Thu, 20 Sep 2012 14:04:47 +0800
+Subject: tracing: Don't call page_to_pfn() if page is NULL
+
+From: Wen Congyang <wency at cn.fujitsu.com>
+
+commit 85f2a2ef1d0ab99523e0b947a2b723f5650ed6aa upstream.
+
+When allocating memory fails, page is NULL. page_to_pfn() will
+cause the kernel panicked if we don't use sparsemem vmemmap.
+
+Link: http://lkml.kernel.org/r/505AB1FF.8020104@cn.fujitsu.com
+
+Cc: Frederic Weisbecker <fweisbec at gmail.com>
+Cc: Ingo Molnar <mingo at redhat.com>
+Cc: Andrew Morton <akpm at linux-foundation.org>
+Acked-by: Mel Gorman <mel at csn.ul.ie>
+Reviewed-by: Minchan Kim <minchan at kernel.org>
+Signed-off-by: Wen Congyang <wency at cn.fujitsu.com>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ include/trace/events/kmem.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/trace/events/kmem.h
++++ b/include/trace/events/kmem.h
+@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
+
+ TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
+ __entry->page,
+- page_to_pfn(__entry->page),
++ __entry->page ? page_to_pfn(__entry->page) : 0,
+ __entry->order,
+ __entry->migratetype,
+ show_gfp_flags(__entry->gfp_flags))
+@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
+
+ TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
+ __entry->page,
+- page_to_pfn(__entry->page),
++ __entry->page ? page_to_pfn(__entry->page) : 0,
+ __entry->order,
+ __entry->migratetype,
+ __entry->order == 0)
+From 8669cf6793bb38307a30fb6b9565ddc8840ebd3f Mon Sep 17 00:00:00 2001
+From: Anisse Astier <anisse at astier.eu>
+Date: Wed, 19 Sep 2012 11:10:48 -0700
+Subject: Input: i8042 - disable mux on Toshiba C850D
+
+From: Anisse Astier <anisse at astier.eu>
+
+commit 8669cf6793bb38307a30fb6b9565ddc8840ebd3f upstream.
+
+On Toshiba Satellite C850D, the touchpad and the keyboard might randomly
+not work at boot. Preventing MUX mode activation solves this issue.
+
+Signed-off-by: Anisse Astier <anisse at astier.eu>
+Signed-off-by: Dmitry Torokhov <dtor at mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -335,6 +335,12 @@ static const struct dmi_system_id __init
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
++ },
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+ },
+From af89fa3986b9d034a286544ab1ed95096496a2f9 Mon Sep 17 00:00:00 2001
+From: Jovi Zhang <bookjovi at gmail.com>
+Date: Wed, 22 Aug 2012 10:34:08 +0800
+Subject: MIPS: mm: Add compound tail page _mapcount when mapped
+
+From: Jovi Zhang <bookjovi at gmail.com>
+
+commit af89fa3986b9d034a286544ab1ed95096496a2f9 upstream.
+
+See commit b6999b191 which did the same modification for x86's mm/gup,
+
+Quote from commit b6999b191:
+ "If compound pages are used and the page is a
+ tail page, gup_huge_pmd() increases _mapcount to record tail page are
+ mapped while gup_huge_pud does not do that."
+
+[ralf at linux-mips.org: fixed rejects caused by the original patch getting
+linewrapped.]
+
+Signed-off-by: Jovi Zhang <boojovi at gmail.com>
+Cc: Youquan Song <youquan.song at intel.com>
+Cc: Andi Kleen <andi at firstfloor.org>
+Patchwork: https://patchwork.linux-mips.org/patch/4291/
+Signed-off-by: Ralf Baechle <ralf at linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/mips/mm/gup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/mips/mm/gup.c
++++ b/arch/mips/mm/gup.c
+@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsig
+ do {
+ VM_BUG_ON(compound_head(page) != head);
+ pages[*nr] = page;
++ if (PageTail(page))
++ get_huge_page_tail(page);
+ (*nr)++;
+ page++;
+ refs++;
+From bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb Mon Sep 17 00:00:00 2001
+From: Robert Richter <robert.richter at amd.com>
+Date: Wed, 25 Jul 2012 19:12:45 +0200
+Subject: perf/x86/ibs: Check syscall attribute flags
+
+From: Robert Richter <robert.richter at amd.com>
+
+commit bad9ac2d7f878a31cf1ae8c1ee3768077d222bcb upstream.
+
+Current implementation simply ignores attribute flags. Thus, there is
+no notification to userland of unsupported features. Check syscall's
+attribute flags to let userland know if a feature is supported by the
+kernel. This is also needed to distinguish between future kernels what
+might support a feature.
+
+Signed-off-by: Robert Richter <robert.richter at amd.com>
+Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
+Link: http://lkml.kernel.org/r/20120910093018.GO8285@erda.amd.com
+Signed-off-by: Ingo Molnar <mingo at kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_amd_ibs.c | 12 ++++++++++++
+ include/linux/perf_event.h | 2 ++
+ 2 files changed, 14 insertions(+)
+
+--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
++++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+@@ -207,6 +207,15 @@ static int perf_ibs_precise_event(struct
+ return -EOPNOTSUPP;
+ }
+
++static const struct perf_event_attr ibs_notsupp = {
++ .exclude_user = 1,
++ .exclude_kernel = 1,
++ .exclude_hv = 1,
++ .exclude_idle = 1,
++ .exclude_host = 1,
++ .exclude_guest = 1,
++};
++
+ static int perf_ibs_init(struct perf_event *event)
+ {
+ struct hw_perf_event *hwc = &event->hw;
+@@ -227,6 +236,9 @@ static int perf_ibs_init(struct perf_eve
+ if (event->pmu != &perf_ibs->pmu)
+ return -ENOENT;
+
++ if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
++ return -EINVAL;
++
+ if (config & ~perf_ibs->config_mask)
+ return -EINVAL;
+
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -274,6 +274,8 @@ struct perf_event_attr {
+ __u64 branch_sample_type; /* enum branch_sample_type */
+ };
+
++#define perf_flags(attr) (*(&(attr)->read_format + 1))
++
+ /*
+ * Ioctls that can be done on a perf event fd:
+ */
+From 022e1d0680c7b4366017393417b8758be5abcee8 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger at lwfinger.net>
+Date: Tue, 11 Sep 2012 11:11:13 -0500
+Subject: rtlwifi: rtl8192ce: Log message that B_CUT device may not work
+
+From: Larry Finger <Larry.Finger at lwfinger.net>
+
+commit 022e1d0680c7b4366017393417b8758be5abcee8 upstream.
+
+There are a number of problems that occur for the latest version
+of the Realtek RTL8188CE device with the in-kernel driver. These
+include selection of the wrong firmware, and system lockup. A full
+fix is known, but is too invasive for inclusion in stable. This patch
+fixes the problem with loading the wrong firmware, and logs a message
+that the device may not work for kernels 3.6 and older.
+
+Signed-off-by: Larry Finger <Larry.Finger at lwfinger.net>
+Cc: Anisse Astier <anisse at astier.eu>
+Cc: Li Chaoming <chaoming_li at realsil.com.cn>
+Tested-by: Anisse Astier <anisse at astier.eu>
+Signed-off-by: John W. Linville <linville at tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192ce/def.h | 1 +
+ drivers/net/wireless/rtlwifi/rtl8192ce/hw.c | 12 ++++++++++--
+ drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 6 ++++--
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+@@ -117,6 +117,7 @@
+
+ #define CHIP_VER_B BIT(4)
+ #define CHIP_92C_BITMASK BIT(0)
++#define CHIP_UNKNOWN BIT(7)
+ #define CHIP_92C_1T2R 0x03
+ #define CHIP_92C 0x01
+ #define CHIP_88C 0x00
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -995,8 +995,16 @@ static enum version_8192c _rtl92ce_read_
+ version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
+ VERSION_A_CHIP_88C;
+ } else {
+- version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
+- VERSION_B_CHIP_88C;
++ version = (enum version_8192c) (CHIP_VER_B |
++ ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
++ ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
++ if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
++ CHIP_VER_RTL_MASK)) {
++ version = (enum version_8192c)(version |
++ ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
++ ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
++ CHIP_VENDOR_UMC));
++ }
+ }
+
+ switch (version) {
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211
+
+ /* request fw */
+ if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
+- !IS_92C_SERIAL(rtlhal->version))
++ !IS_92C_SERIAL(rtlhal->version)) {
+ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
+- else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
++ } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
+ rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
++ pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
++ }
+
+ rtlpriv->max_fw_size = 0x4000;
+ pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
diff --git a/xen-pciback-restore-pci-config-space-after-FLR.patch b/xen-pciback-restore-pci-config-space-after-FLR.patch
new file mode 100644
index 0000000..dece616
--- /dev/null
+++ b/xen-pciback-restore-pci-config-space-after-FLR.patch
@@ -0,0 +1,54 @@
+When we do an FLR, or D0->D3_hot we may lose the BARs as the
+device has turned itself off (and on). This means the device cannot
+function unless the pci_restore_state is called - which it is
+when the PCI device is unbound from the Xen PCI backend driver.
+For PV guests it ends up calling pci_enable_device / pci_enable_msi[x]
+which does the proper steps
+
+That however is not happening if a HVM guest is run as QEMU
+deals with PCI configuration space. QEMU also requires that the
+device be "parked" under the ownership of a pci-stub driver to
+guarantee that the PCI device is not being used. Hence we
+follow the same incantation as pci_reset_function does - by
+doing an FLR, then restoring the PCI configuration space.
+
+The result of this patch is that when you run lspci, you get
+now this:
+
+- Region 0: [virtual] Memory at fe8c0000 (32-bit, non-prefetchable) [size=128K]
+- Region 1: [virtual] Memory at fe800000 (32-bit, non-prefetchable) [size=512K]
++ Region 0: Memory at fe8c0000 (32-bit, non-prefetchable) [size=128K]
++ Region 1: Memory at fe800000 (32-bit, non-prefetchable) [size=512K]
+ Region 2: I/O ports at c000 [size=32]
+- Region 3: [virtual] Memory at fe8e0000 (32-bit, non-prefetchable) [size=16K]
++ Region 3: Memory at fe8e0000 (32-bit, non-prefetchable) [size=16K]
+
+The [virtual] means that lspci read those entries from SysFS but when
+it read them from the device it got a different value (0xfffffff).
+
+CC: stable at vger.kernel.org # only for v3.4 and v3.5
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk at oracle.com>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index acec6fa..e5a0c13 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -362,6 +362,7 @@ static int __devinit pcistub_init_device(struct pci_dev *dev)
+ else {
+ dev_dbg(&dev->dev, "reseting (FLR, D3, etc) the device\n");
+ __pci_reset_function_locked(dev);
++ pci_restore_state(dev);
+ }
+ /* Now disable the device (this also ensures some private device
+ * data is setup before we export)
+--
+1.7.7.6
+
+--
+To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
+Please read the FAQ at http://www.tux.org/lkml/
More information about the scm-commits
mailing list