--- /dev/null
+From ab548d2dba63ba947287965e525cc02a15d9853d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 6 Sep 2012 10:10:11 +0200
+Subject: ALSA: hda - Fix missing Master volume for STAC9200/925x
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ab548d2dba63ba947287965e525cc02a15d9853d upstream.
+
+With the commit [2faa3bf: ALSA: hda - Rewrite the mute-LED hook with
+vmaster hook in patch_sigmatel.c], the former Master volume control
+was converted to PCM. This was supposed to be covered by the vmaster
+control. But due to the lack of "PCM" slave definition, this didn't
+happen properly. The patch fixes the missing entry.
+
+Reported-by: Andrew Shadura <bugzilla@tut.by>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_sigmatel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -1075,7 +1075,7 @@ static struct snd_kcontrol_new stac_smux
+
+ static const char * const slave_pfxs[] = {
+ "Front", "Surround", "Center", "LFE", "Side",
+- "Headphone", "Speaker", "IEC958",
++ "Headphone", "Speaker", "IEC958", "PCM",
+ NULL
+ };
+
--- /dev/null
+From 07dc59f0988cb54fd87bd373b3b27eb2401dd811 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 10 Sep 2012 09:39:31 +0200
+Subject: ALSA: hda - Fix Oops at codec reset/reconfig
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 07dc59f0988cb54fd87bd373b3b27eb2401dd811 upstream.
+
+snd_hda_codec_reset() calls restore_pincfgs() where the codec is
+powered up again, which eventually tries to resume and initialize via
+the callbacks of the codec. However, it's the place just after codec
+free callback, thus no codec callbacks should be called after that.
+On a codec like CS4206, it results in Oops due to the access in init
+callback.
+
+This patch fixes the issue by clearing the codec callbacks properly
+after freeing codec.
+
+Reported-by: Daniel J Blueman <daniel@quora.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2325,6 +2325,7 @@ int snd_hda_codec_reset(struct hda_codec
+ }
+ if (codec->patch_ops.free)
+ codec->patch_ops.free(codec);
++ memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
+ snd_hda_jack_tbl_clear(codec);
+ codec->proc_widget_hook = NULL;
+ codec->spec = NULL;
+@@ -2340,7 +2341,6 @@ int snd_hda_codec_reset(struct hda_codec
+ codec->num_pcms = 0;
+ codec->pcm_info = NULL;
+ codec->preset = NULL;
+- memset(&codec->patch_ops, 0, sizeof(codec->patch_ops));
+ codec->slave_dig_outs = NULL;
+ codec->spdif_status_reset = 0;
+ module_put(codec->owner);
--- /dev/null
+From tiwai@suse.de Fri Sep 21 10:24:28 2012
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 20 Sep 2012 07:44:11 +0200
+Subject: ALSA: hda - Workaround for silent output on VAIO Z with ALC889
+To: stable@vger.kernel.org
+Cc: Adam Williamson <awilliam@redhat.com>
+Message-ID: <s5h4nmtnt90.wl%tiwai@suse.de>
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit e427c2375646789ecd0ccaef1a1e41458559ab2d upstream.
+
+On recent kernels, Realtek codec parser tries to optimize the routing
+aggressively and take the headphone output as primary at first. This
+caused a regression on VAIO Z with ALC889, the silent output from the
+speaker.
+
+The problem seems that the speaker pin must be connected to the first
+DAC (0x02) on this machine by some reason although the codec itself
+advertises the flexible routing with any DACs.
+
+This patch adds a fix-up for choosing the speaker pin as the primary
+so that the right DAC is assigned on this device.
+
+Reported-and-tested-by: Adam Williamson <awilliam@redhat.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+
+---
+ Documentation/sound/alsa/HD-Audio-Models.txt | 1 +
+ sound/pci/hda/patch_realtek.c | 22 +++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/Documentation/sound/alsa/HD-Audio-Models.txt
++++ b/Documentation/sound/alsa/HD-Audio-Models.txt
+@@ -47,6 +47,7 @@ ALC882/883/885/888/889
+ acer-aspire-4930g Acer Aspire 4930G/5930G/6530G/6930G/7730G
+ acer-aspire-8930g Acer Aspire 8330G/6935G
+ acer-aspire Acer Aspire others
++ no-primary-hp VAIO Z workaround (for fixed speaker DAC)
+
+ ALC861/660
+ ==========
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -201,6 +201,7 @@ struct alc_spec {
+ unsigned int vol_in_capsrc:1; /* use capsrc volume (ADC has no vol) */
+ unsigned int parse_flags; /* passed to snd_hda_parse_pin_defcfg() */
+ unsigned int shared_mic_hp:1; /* HP/Mic-in sharing */
++ unsigned int no_primary_hp:1; /* Don't prefer HP pins to speaker pins */
+
+ /* auto-mute control */
+ int automute_mode;
+@@ -4182,7 +4183,8 @@ static int alc_parse_auto_config(struct
+ return 0; /* can't find valid BIOS pin config */
+ }
+
+- if (cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
++ if (!spec->no_primary_hp &&
++ cfg->line_out_type == AUTO_PIN_SPEAKER_OUT &&
+ cfg->line_outs <= cfg->hp_outs) {
+ /* use HP as primary out */
+ cfg->speaker_outs = cfg->line_outs;
+@@ -4909,6 +4911,7 @@ enum {
+ ALC889_FIXUP_DAC_ROUTE,
+ ALC889_FIXUP_MBP_VREF,
+ ALC889_FIXUP_IMAC91_VREF,
++ ALC882_FIXUP_NO_PRIMARY_HP,
+ };
+
+ static void alc889_fixup_coef(struct hda_codec *codec,
+@@ -5030,6 +5033,17 @@ static void alc889_fixup_imac91_vref(str
+ spec->keep_vref_in_automute = 1;
+ }
+
++/* Don't take HP output as primary
++ * strangely, the speaker output doesn't work on VAIO Z through DAC 0x05
++ */
++static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
++ const struct alc_fixup *fix, int action)
++{
++ struct alc_spec *spec = codec->spec;
++ if (action == ALC_FIXUP_ACT_PRE_PROBE)
++ spec->no_primary_hp = 1;
++}
++
+ static const struct alc_fixup alc882_fixups[] = {
+ [ALC882_FIXUP_ABIT_AW9D_MAX] = {
+ .type = ALC_FIXUP_PINS,
+@@ -5212,6 +5226,10 @@ static const struct alc_fixup alc882_fix
+ .chained = true,
+ .chain_id = ALC882_FIXUP_GPIO1,
+ },
++ [ALC882_FIXUP_NO_PRIMARY_HP] = {
++ .type = ALC_FIXUP_FUNC,
++ .v.func = alc882_fixup_no_primary_hp,
++ },
+ };
+
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+@@ -5246,6 +5264,7 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
+ SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
+ SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
++ SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
+
+ /* All Apple entries are in codec SSIDs */
+ SND_PCI_QUIRK(0x106b, 0x00a0, "MacBookPro 3,1", ALC889_FIXUP_MBP_VREF),
+@@ -5286,6 +5305,7 @@ static const struct alc_model_fixup alc8
+ {.id = ALC882_FIXUP_ACER_ASPIRE_4930G, .name = "acer-aspire-4930g"},
+ {.id = ALC882_FIXUP_ACER_ASPIRE_8930G, .name = "acer-aspire-8930g"},
+ {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
++ {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
+ {}
+ };
+
--- /dev/null
+From 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 Mon Sep 17 00:00:00 2001
+From: Matteo Frigo <athena@fftw.org>
+Date: Wed, 12 Sep 2012 10:12:06 -0400
+Subject: ALSA: ice1724: Use linear scale for AK4396 volume control.
+
+From: Matteo Frigo <athena@fftw.org>
+
+commit 3737e2be505d872bf2b3c1cd4151b2d2b413d7b5 upstream.
+
+The AK4396 DAC has a linear-scale attentuator, but
+sound/pci/ice1712/prodigy_hifi.c used a log scale instead, which is
+not quite right. This patch restores the correct scale, borrowing
+from the ak4396 code in sound/pci/oxygen/oxygen.c.
+
+Signed-off-by: Matteo Frigo <athena@fftw.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/ice1712/prodigy_hifi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -297,6 +297,7 @@ static int ak4396_dac_vol_put(struct snd
+ }
+
+ static const DECLARE_TLV_DB_SCALE(db_scale_wm_dac, -12700, 100, 1);
++static const DECLARE_TLV_DB_LINEAR(ak4396_db_scale, TLV_DB_GAIN_MUTE, 0);
+
+ static struct snd_kcontrol_new prodigy_hd2_controls[] __devinitdata = {
+ {
+@@ -307,7 +308,7 @@ static struct snd_kcontrol_new prodigy_h
+ .info = ak4396_dac_vol_info,
+ .get = ak4396_dac_vol_get,
+ .put = ak4396_dac_vol_put,
+- .tlv = { .p = db_scale_wm_dac },
++ .tlv = { .p = ak4396_db_scale },
+ },
+ };
+
--- /dev/null
+From 1213a205f9ed27d97de3d5bed28fb085ef4853e2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 6 Sep 2012 14:58:00 +0200
+Subject: ALSA: usb-audio: Fix bogus error messages for delay accounting
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 1213a205f9ed27d97de3d5bed28fb085ef4853e2 upstream.
+
+The recent fix for the missing fine delayed time adjustment gives
+strange error messages at each start of the playback stream, such as
+ delay: estimated 0, actual 352
+ delay: estimated 353, actual 705
+
+These come from the sanity check in retire_playback_urb(). Before the
+stream is activated via start_endpoints(), a few silent packets have
+been already sent. And at this point the delay account is still in
+the state as if the new packets are just queued, so the driver gets
+confused and spews the bogus error messages.
+
+For fixing the issue, we just need to check whether the received
+packet is valid, whether it's zero sized or not.
+
+Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1140,6 +1140,12 @@ static void retire_playback_urb(struct s
+ int processed = urb->transfer_buffer_length / stride;
+ int est_delay;
+
++ /* ignore the delay accounting when procssed=0 is given, i.e.
++ * silent payloads are procssed before handling the actual data
++ */
++ if (!processed)
++ return;
++
+ spin_lock_irqsave(&subs->lock, flags);
+ est_delay = snd_usb_pcm_delay(subs, runtime->rate);
+ /* update delay with exact number of samples played */
--- /dev/null
+From bf8801145c01ab600f8df66e8c879ac642fa5846 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 16 Aug 2012 18:55:44 +0100
+Subject: ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint access type
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit bf8801145c01ab600f8df66e8c879ac642fa5846 upstream.
+
+From ARM debug architecture v7.1 onwards, a watchpoint exception causes
+the DFAR to be updated with the faulting data address. However, DFSR.WnR
+takes an UNKNOWN value and therefore cannot be used in general to
+determine the access type that triggered the watchpoint.
+
+This patch forbids watchpoints without an overflow handler from
+specifying a specific access type (load/store). Those with overflow
+handlers must be able to handle false positives potentially triggered by
+a watchpoint of a different access type on the same address. For
+SIGTRAP-based handlers (i.e. ptrace), this should have no impact.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/hw_breakpoint.c | 55 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 40 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/kernel/hw_breakpoint.c
++++ b/arch/arm/kernel/hw_breakpoint.c
+@@ -159,6 +159,12 @@ static int debug_arch_supported(void)
+ arch >= ARM_DEBUG_ARCH_V7_1;
+ }
+
++/* Can we determine the watchpoint access type from the fsr? */
++static int debug_exception_updates_fsr(void)
++{
++ return 0;
++}
++
+ /* Determine number of WRP registers available. */
+ static int get_num_wrp_resources(void)
+ {
+@@ -619,18 +625,35 @@ int arch_validate_hwbkpt_settings(struct
+ info->address &= ~alignment_mask;
+ info->ctrl.len <<= offset;
+
+- /*
+- * Currently we rely on an overflow handler to take
+- * care of single-stepping the breakpoint when it fires.
+- * In the case of userspace breakpoints on a core with V7 debug,
+- * we can use the mismatch feature as a poor-man's hardware
+- * single-step, but this only works for per-task breakpoints.
+- */
+- if (!bp->overflow_handler && (arch_check_bp_in_kernelspace(bp) ||
+- !core_has_mismatch_brps() || !bp->hw.bp_target)) {
+- pr_warning("overflow handler required but none found\n");
+- ret = -EINVAL;
++ if (!bp->overflow_handler) {
++ /*
++ * Mismatch breakpoints are required for single-stepping
++ * breakpoints.
++ */
++ if (!core_has_mismatch_brps())
++ return -EINVAL;
++
++ /* We don't allow mismatch breakpoints in kernel space. */
++ if (arch_check_bp_in_kernelspace(bp))
++ return -EPERM;
++
++ /*
++ * Per-cpu breakpoints are not supported by our stepping
++ * mechanism.
++ */
++ if (!bp->hw.bp_target)
++ return -EINVAL;
++
++ /*
++ * We only support specific access types if the fsr
++ * reports them.
++ */
++ if (!debug_exception_updates_fsr() &&
++ (info->ctrl.type == ARM_BREAKPOINT_LOAD ||
++ info->ctrl.type == ARM_BREAKPOINT_STORE))
++ return -EINVAL;
+ }
++
+ out:
+ return ret;
+ }
+@@ -706,10 +729,12 @@ static void watchpoint_handler(unsigned
+ goto unlock;
+
+ /* Check that the access type matches. */
+- access = (fsr & ARM_FSR_ACCESS_MASK) ? HW_BREAKPOINT_W :
+- HW_BREAKPOINT_R;
+- if (!(access & hw_breakpoint_type(wp)))
+- goto unlock;
++ if (debug_exception_updates_fsr()) {
++ access = (fsr & ARM_FSR_ACCESS_MASK) ?
++ HW_BREAKPOINT_W : HW_BREAKPOINT_R;
++ if (!(access & hw_breakpoint_type(wp)))
++ goto unlock;
++ }
+
+ /* We have a winner. */
+ info->trigger = addr;
--- /dev/null
+From dbece45894d3ab1baac15a96dc4e1e8e23f64a93 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 24 Aug 2012 15:20:59 +0100
+Subject: ARM: 7501/1: decompressor: reset ttbcr for VMSA ARMv7 cores
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit dbece45894d3ab1baac15a96dc4e1e8e23f64a93 upstream.
+
+When enabling the MMU for ARMv7 CPUs, the decompressor does not touch
+the ttbcr register, assuming that it will be zeroed (N == 0, EAE == 0).
+Given that only EAE is defined as 0 for non-secure copies of the
+register (and a bootloader such as kexec may leave it set to 1 anyway),
+we should ensure that we reset the register ourselves before turning on
+the MMU.
+
+This patch zeroes TTBCR.EAE and TTBCR.N prior to enabling the MMU for
+ARMv7 cores in the decompressor, configuring us exclusively for 32-bit
+translation tables via TTBR0.
+
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Matthew Leach <matthew.leach@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/compressed/head.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -659,10 +659,14 @@ __armv7_mmu_cache_on:
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+ orr r0, r0, #1 << 25 @ big-endian page tables
+ #endif
++ mrcne p15, 0, r6, c2, c0, 2 @ read ttb control reg
+ orrne r0, r0, #1 @ MMU enabled
+ movne r1, #0xfffffffd @ domain 0 = client
++ bic r6, r6, #1 << 31 @ 32-bit translation system
++ bic r6, r6, #3 << 0 @ use only ttbr0
+ mcrne p15, 0, r3, c2, c0, 0 @ load page table pointer
+ mcrne p15, 0, r1, c3, c0, 0 @ load domain access control
++ mcrne p15, 0, r6, c2, c0, 2 @ load ttb control
+ #endif
+ mcr p15, 0, r0, c7, c5, 4 @ ISB
+ mcr p15, 0, r0, c1, c0, 0 @ load control register
--- /dev/null
+From 70b0476a2394de4f4e32e0b67288d80ff71ca963 Mon Sep 17 00:00:00 2001
+From: David Brown <davidb@codeaurora.org>
+Date: Tue, 4 Sep 2012 21:36:37 +0100
+Subject: ARM: 7513/1: Make sure dtc is built before running it
+
+From: David Brown <davidb@codeaurora.org>
+
+commit 70b0476a2394de4f4e32e0b67288d80ff71ca963 upstream.
+
+'make dtbs' in a clean tree will try running the dtc before actually
+building it. Make these rules depend upon the scripts to build it.
+
+Signed-off-by: David Brown <davidb@codeaurora.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -279,10 +279,10 @@ zImage Image xipImage bootpImage uImage:
+ zinstall uinstall install: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $@
+
+-%.dtb:
++%.dtb: scripts
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
+
+-dtbs:
++dtbs: scripts
+ $(Q)$(MAKE) $(build)=$(boot) MACHINE=$(MACHINE) $(boot)/$@
+
+ # We use MRPROPER_FILES and CLEAN_FILES now
--- /dev/null
+From 2b2040af0b64cd93e5d4df2494c4486cf604090d Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 7 Sep 2012 18:21:44 +0100
+Subject: ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling path
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 2b2040af0b64cd93e5d4df2494c4486cf604090d upstream.
+
+get_user may fail to load from the provided __user address due to an
+unhandled fault generated by the access.
+
+In the case of the undefined instruction trap, this results in failure
+to load the faulting instruction, in which case we should send SIGILL to
+the task rather than continue with potentially uninitialised data.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/traps.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/kernel/traps.c
++++ b/arch/arm/kernel/traps.c
+@@ -388,20 +388,23 @@ asmlinkage void __exception do_undefinst
+ #endif
+ instr = *(u32 *) pc;
+ } else if (thumb_mode(regs)) {
+- get_user(instr, (u16 __user *)pc);
++ if (get_user(instr, (u16 __user *)pc))
++ goto die_sig;
+ if (is_wide_instruction(instr)) {
+ unsigned int instr2;
+- get_user(instr2, (u16 __user *)pc+1);
++ if (get_user(instr2, (u16 __user *)pc+1))
++ goto die_sig;
+ instr <<= 16;
+ instr |= instr2;
+ }
+- } else {
+- get_user(instr, (u32 __user *)pc);
++ } else if (get_user(instr, (u32 __user *)pc)) {
++ goto die_sig;
+ }
+
+ if (call_undef_hook(regs, instr) == 0)
+ return;
+
++die_sig:
+ #ifdef CONFIG_DEBUG_USER
+ if (user_debug & UDBG_UNDEFINED) {
+ printk(KERN_INFO "%s (%d): undefined instruction: pc=%p\n",
--- /dev/null
+From 8404663f81d212918ff85f493649a7991209fa04 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 7 Sep 2012 18:22:28 +0100
+Subject: ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 8404663f81d212918ff85f493649a7991209fa04 upstream.
+
+The {get,put}_user macros don't perform range checking on the provided
+__user address when !CPU_HAS_DOMAINS.
+
+This patch reworks the out-of-line assembly accessors to check the user
+address against a specified limit, returning -EFAULT if is is out of
+range.
+
+[will: changed get_user register allocation to match put_user]
+[rmk: fixed building on older ARM architectures]
+
+Reported-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/assembler.h | 8 +++++++
+ arch/arm/include/asm/uaccess.h | 40 ++++++++++++++++++++++++++-------------
+ arch/arm/lib/getuser.S | 23 ++++++++++++++--------
+ arch/arm/lib/putuser.S | 6 +++++
+ 4 files changed, 56 insertions(+), 21 deletions(-)
+
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -320,4 +320,12 @@
+ .size \name , . - \name
+ .endm
+
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcccs \tmp, \tmp, \limit
++ bcs \bad
++#endif
++ .endm
++
+ #endif /* __ASM_ASSEMBLER_H__ */
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -101,28 +101,39 @@ extern int __get_user_1(void *);
+ extern int __get_user_2(void *);
+ extern int __get_user_4(void *);
+
+-#define __get_user_x(__r2,__p,__e,__s,__i...) \
++#define __GUP_CLOBBER_1 "lr", "cc"
++#ifdef CONFIG_CPU_USE_DOMAINS
++#define __GUP_CLOBBER_2 "ip", "lr", "cc"
++#else
++#define __GUP_CLOBBER_2 "lr", "cc"
++#endif
++#define __GUP_CLOBBER_4 "lr", "cc"
++
++#define __get_user_x(__r2,__p,__e,__l,__s) \
+ __asm__ __volatile__ ( \
+ __asmeq("%0", "r0") __asmeq("%1", "r2") \
++ __asmeq("%3", "r1") \
+ "bl __get_user_" #__s \
+ : "=&r" (__e), "=r" (__r2) \
+- : "0" (__p) \
+- : __i, "cc")
++ : "0" (__p), "r" (__l) \
++ : __GUP_CLOBBER_##__s)
+
+ #define get_user(x,p) \
+ ({ \
++ unsigned long __limit = current_thread_info()->addr_limit - 1; \
+ register const typeof(*(p)) __user *__p asm("r0") = (p);\
+ register unsigned long __r2 asm("r2"); \
++ register unsigned long __l asm("r1") = __limit; \
+ register int __e asm("r0"); \
+ switch (sizeof(*(__p))) { \
+ case 1: \
+- __get_user_x(__r2, __p, __e, 1, "lr"); \
+- break; \
++ __get_user_x(__r2, __p, __e, __l, 1); \
++ break; \
+ case 2: \
+- __get_user_x(__r2, __p, __e, 2, "r3", "lr"); \
++ __get_user_x(__r2, __p, __e, __l, 2); \
+ break; \
+ case 4: \
+- __get_user_x(__r2, __p, __e, 4, "lr"); \
++ __get_user_x(__r2, __p, __e, __l, 4); \
+ break; \
+ default: __e = __get_user_bad(); break; \
+ } \
+@@ -135,31 +146,34 @@ extern int __put_user_2(void *, unsigned
+ extern int __put_user_4(void *, unsigned int);
+ extern int __put_user_8(void *, unsigned long long);
+
+-#define __put_user_x(__r2,__p,__e,__s) \
++#define __put_user_x(__r2,__p,__e,__l,__s) \
+ __asm__ __volatile__ ( \
+ __asmeq("%0", "r0") __asmeq("%2", "r2") \
++ __asmeq("%3", "r1") \
+ "bl __put_user_" #__s \
+ : "=&r" (__e) \
+- : "0" (__p), "r" (__r2) \
++ : "0" (__p), "r" (__r2), "r" (__l) \
+ : "ip", "lr", "cc")
+
+ #define put_user(x,p) \
+ ({ \
++ unsigned long __limit = current_thread_info()->addr_limit - 1; \
+ register const typeof(*(p)) __r2 asm("r2") = (x); \
+ register const typeof(*(p)) __user *__p asm("r0") = (p);\
++ register unsigned long __l asm("r1") = __limit; \
+ register int __e asm("r0"); \
+ switch (sizeof(*(__p))) { \
+ case 1: \
+- __put_user_x(__r2, __p, __e, 1); \
++ __put_user_x(__r2, __p, __e, __l, 1); \
+ break; \
+ case 2: \
+- __put_user_x(__r2, __p, __e, 2); \
++ __put_user_x(__r2, __p, __e, __l, 2); \
+ break; \
+ case 4: \
+- __put_user_x(__r2, __p, __e, 4); \
++ __put_user_x(__r2, __p, __e, __l, 4); \
+ break; \
+ case 8: \
+- __put_user_x(__r2, __p, __e, 8); \
++ __put_user_x(__r2, __p, __e, __l, 8); \
+ break; \
+ default: __e = __put_user_bad(); break; \
+ } \
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -16,8 +16,9 @@
+ * __get_user_X
+ *
+ * Inputs: r0 contains the address
++ * r1 contains the address limit, which must be preserved
+ * Outputs: r0 is the error code
+- * r2, r3 contains the zero-extended value
++ * r2 contains the zero-extended value
+ * lr corrupted
+ *
+ * No other registers must be altered. (see <asm/uaccess.h>
+@@ -27,33 +28,39 @@
+ * Note also that it is intended that __get_user_bad is not global.
+ */
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+ #include <asm/errno.h>
+ #include <asm/domain.h>
+
+ ENTRY(__get_user_1)
++ check_uaccess r0, 1, r1, r2, __get_user_bad
+ 1: TUSER(ldrb) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__get_user_1)
+
+ ENTRY(__get_user_2)
+-#ifdef CONFIG_THUMB2_KERNEL
+-2: TUSER(ldrb) r2, [r0]
+-3: TUSER(ldrb) r3, [r0, #1]
++ check_uaccess r0, 2, r1, r2, __get_user_bad
++#ifdef CONFIG_CPU_USE_DOMAINS
++rb .req ip
++2: ldrbt r2, [r0], #1
++3: ldrbt rb, [r0], #0
+ #else
+-2: TUSER(ldrb) r2, [r0], #1
+-3: TUSER(ldrb) r3, [r0]
++rb .req r0
++2: ldrb r2, [r0]
++3: ldrb rb, [r0, #1]
+ #endif
+ #ifndef __ARMEB__
+- orr r2, r2, r3, lsl #8
++ orr r2, r2, rb, lsl #8
+ #else
+- orr r2, r3, r2, lsl #8
++ orr r2, rb, r2, lsl #8
+ #endif
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__get_user_2)
+
+ ENTRY(__get_user_4)
++ check_uaccess r0, 4, r1, r2, __get_user_bad
+ 4: TUSER(ldr) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -16,6 +16,7 @@
+ * __put_user_X
+ *
+ * Inputs: r0 contains the address
++ * r1 contains the address limit, which must be preserved
+ * r2, r3 contains the value
+ * Outputs: r0 is the error code
+ * lr corrupted
+@@ -27,16 +28,19 @@
+ * Note also that it is intended that __put_user_bad is not global.
+ */
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+ #include <asm/errno.h>
+ #include <asm/domain.h>
+
+ ENTRY(__put_user_1)
++ check_uaccess r0, 1, r1, ip, __put_user_bad
+ 1: TUSER(strb) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
++ check_uaccess r0, 2, r1, ip, __put_user_bad
+ mov ip, r2, lsr #8
+ #ifdef CONFIG_THUMB2_KERNEL
+ #ifndef __ARMEB__
+@@ -60,12 +64,14 @@ ENTRY(__put_user_2)
+ ENDPROC(__put_user_2)
+
+ ENTRY(__put_user_4)
++ check_uaccess r0, 4, r1, ip, __put_user_bad
+ 4: TUSER(str) r2, [r0]
+ mov r0, #0
+ mov pc, lr
+ ENDPROC(__put_user_4)
+
+ ENTRY(__put_user_8)
++ check_uaccess r0, 8, r1, ip, __put_user_bad
+ #ifdef CONFIG_THUMB2_KERNEL
+ 5: TUSER(str) r2, [r0]
+ 6: TUSER(str) r3, [r0, #4]
--- /dev/null
+From 912bfe76528c287bc4812521b8d53366954b39a5 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Sun, 19 Aug 2012 14:05:59 -0300
+Subject: ARM: clk-imx25: Fix SSI clock registration
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 912bfe76528c287bc4812521b8d53366954b39a5 upstream.
+
+SSI block has two types of clock:
+
+ipg: bus clock, the clock needed for accessing registers.
+per: peripheral clock, the clock needed for generating the bit rate.
+
+Currently SSI driver only supports slave mode and only need to handle
+the ipg clock, because the peripheral clock comes from the master codec.
+
+Only register the ipg clock and do not register the peripheral clock for ssi.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx25.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-imx/clk-imx25.c
++++ b/arch/arm/mach-imx/clk-imx25.c
+@@ -222,10 +222,8 @@ int __init mx25_clocks_init(void)
+ clk_register_clkdev(clk[lcdc_ipg], "ipg", "imx-fb.0");
+ clk_register_clkdev(clk[lcdc_ahb], "ahb", "imx-fb.0");
+ clk_register_clkdev(clk[wdt_ipg], NULL, "imx2-wdt.0");
+- clk_register_clkdev(clk[ssi1_ipg_per], "per", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi1_ipg], "ipg", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi2_ipg_per], "per", "imx-ssi.1");
+- clk_register_clkdev(clk[ssi2_ipg], "ipg", "imx-ssi.1");
++ clk_register_clkdev(clk[ssi1_ipg], NULL, "imx-ssi.0");
++ clk_register_clkdev(clk[ssi2_ipg], NULL, "imx-ssi.1");
+ clk_register_clkdev(clk[esdhc1_ipg_per], "per", "sdhci-esdhc-imx25.0");
+ clk_register_clkdev(clk[esdhc1_ipg], "ipg", "sdhci-esdhc-imx25.0");
+ clk_register_clkdev(clk[esdhc1_ahb], "ahb", "sdhci-esdhc-imx25.0");
--- /dev/null
+From 48540058612786d365602f3324ed97f9071092de Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Mon, 20 Aug 2012 09:39:22 -0300
+Subject: ARM: clk-imx35: Fix SSI clock registration
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 48540058612786d365602f3324ed97f9071092de upstream.
+
+SSI block has two types of clock:
+
+ipg: bus clock, the clock needed for accessing registers.
+per: peripheral clock, the clock needed for generating the bit rate.
+
+Currently SSI driver only supports slave mode and only need to handle
+the ipg clock, because the peripheral clock comes from the master codec.
+
+Only register the ipg clock and do not register the peripheral clock for ssi.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Tested-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/clk-imx35.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -230,10 +230,8 @@ int __init mx35_clocks_init()
+ clk_register_clkdev(clk[ipu_gate], NULL, "mx3_sdc_fb");
+ clk_register_clkdev(clk[owire_gate], NULL, "mxc_w1");
+ clk_register_clkdev(clk[sdma_gate], NULL, "imx35-sdma");
+- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.0");
+- clk_register_clkdev(clk[ssi1_div_post], "per", "imx-ssi.0");
+- clk_register_clkdev(clk[ipg], "ipg", "imx-ssi.1");
+- clk_register_clkdev(clk[ssi2_div_post], "per", "imx-ssi.1");
++ clk_register_clkdev(clk[ssi1_gate], NULL, "imx-ssi.0");
++ clk_register_clkdev(clk[ssi2_gate], NULL, "imx-ssi.1");
+ /* i.mx35 has the i.mx21 type uart */
+ clk_register_clkdev(clk[uart1_gate], "per", "imx21-uart.0");
+ clk_register_clkdev(clk[ipg], "ipg", "imx21-uart.0");
--- /dev/null
+From a849088aa1552b1a28eea3daff599ee22a734ae3 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Sat, 25 Aug 2012 09:03:15 +0100
+Subject: ARM: Fix ioremap() of address zero
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit a849088aa1552b1a28eea3daff599ee22a734ae3 upstream.
+
+Murali Nalajala reports a regression that ioremapping address zero
+results in an oops dump:
+
+Unable to handle kernel paging request at virtual address fa200000
+pgd = d4f80000
+[fa200000] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in:
+CPU: 0 Tainted: G W (3.4.0-g3b5f728-00009-g638207a #13)
+PC is at msm_pm_config_rst_vector_before_pc+0x8/0x30
+LR is at msm_pm_boot_config_before_pc+0x18/0x20
+pc : [<c0078f84>] lr : [<c007903c>] psr: a0000093
+sp : c0837ef0 ip : cfe00000 fp : 0000000d
+r10: da7efc17 r9 : 225c4278 r8 : 00000006
+r7 : 0003c000 r6 : c085c824 r5 : 00000001 r4 : fa101000
+r3 : fa200000 r2 : c095080c r1 : 002250fc r0 : 00000000
+Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 10c5387d Table: 25180059 DAC: 00000015
+[<c0078f84>] (msm_pm_config_rst_vector_before_pc+0x8/0x30) from [<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20)
+[<c007903c>] (msm_pm_boot_config_before_pc+0x18/0x20) from [<c007a55c>] (msm_pm_power_collapse+0x410/0xb04)
+[<c007a55c>] (msm_pm_power_collapse+0x410/0xb04) from [<c007b17c>] (arch_idle+0x294/0x3e0)
+[<c007b17c>] (arch_idle+0x294/0x3e0) from [<c000eed8>] (default_idle+0x18/0x2c)
+[<c000eed8>] (default_idle+0x18/0x2c) from [<c000f254>] (cpu_idle+0x90/0xe4)
+[<c000f254>] (cpu_idle+0x90/0xe4) from [<c057231c>] (rest_init+0x88/0xa0)
+[<c057231c>] (rest_init+0x88/0xa0) from [<c07ff890>] (start_kernel+0x3a8/0x40c)
+Code: c0704256 e12fff1e e59f2020 e5923000 (e5930000)
+
+This is caused by the 'reserved' entries which we insert (see
+19b52abe3c5d7 - ARM: 7438/1: fill possible PMD empty section gaps)
+which get matched for physical address zero.
+
+Resolve this by marking these reserved entries with a different flag.
+
+Tested-by: Murali Nalajala <mnalajal@codeaurora.org>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/mm.h | 3 +++
+ arch/arm/mm/mmu.c | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mm/mm.h
++++ b/arch/arm/mm/mm.h
+@@ -55,6 +55,9 @@ extern void __flush_dcache_page(struct a
+ /* permanent static mappings from iotable_init() */
+ #define VM_ARM_STATIC_MAPPING 0x40000000
+
++/* empty mapping */
++#define VM_ARM_EMPTY_MAPPING 0x20000000
++
+ /* mapping type (attributes) for permanent static mappings */
+ #define VM_ARM_MTYPE(mt) ((mt) << 20)
+ #define VM_ARM_MTYPE_MASK (0x1f << 20)
+--- a/arch/arm/mm/mmu.c
++++ b/arch/arm/mm/mmu.c
+@@ -813,7 +813,7 @@ static void __init pmd_empty_section_gap
+ vm = early_alloc_aligned(sizeof(*vm), __alignof__(*vm));
+ vm->addr = (void *)addr;
+ vm->size = SECTION_SIZE;
+- vm->flags = VM_IOREMAP | VM_ARM_STATIC_MAPPING;
++ vm->flags = VM_IOREMAP | VM_ARM_EMPTY_MAPPING;
+ vm->caller = pmd_empty_section_gap;
+ vm_area_add_early(vm);
+ }
+@@ -826,7 +826,7 @@ static void __init fill_pmd_gaps(void)
+
+ /* we're still single threaded hence no lock needed here */
+ for (vm = vmlist; vm; vm = vm->next) {
+- if (!(vm->flags & VM_ARM_STATIC_MAPPING))
++ if (!(vm->flags & (VM_ARM_STATIC_MAPPING | VM_ARM_EMPTY_MAPPING)))
+ continue;
+ addr = (unsigned long)vm->addr;
+ if (addr < next)
--- /dev/null
+From 45caae74d238ef6583e9402cb8c550cc0b0f7dbd Mon Sep 17 00:00:00 2001
+From: Igor Grinberg <grinberg@compulab.co.il>
+Date: Tue, 28 Aug 2012 01:26:14 +0300
+Subject: ARM: OMAP: timer: obey the !CONFIG_OMAP_32K_TIMER
+
+From: Igor Grinberg <grinberg@compulab.co.il>
+
+commit 45caae74d238ef6583e9402cb8c550cc0b0f7dbd upstream.
+
+Currently, omap2_sync32k_clocksource_init() function initializes the 32K
+timer as the system clock source regardless of the CONFIG_OMAP_32K_TIMER
+setting.
+Fix this by providing a default implementation for
+!CONFIG_OMAP_32K_TIMER case.
+
+Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
+Reviewed-by: Paul Walmsley <paul@pwsan.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap2/timer.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/mach-omap2/timer.c
++++ b/arch/arm/mach-omap2/timer.c
+@@ -263,6 +263,7 @@ static u32 notrace dmtimer_read_sched_cl
+ return 0;
+ }
+
++#ifdef CONFIG_OMAP_32K_TIMER
+ /* Setup free-running counter for clocksource */
+ static int __init omap2_sync32k_clocksource_init(void)
+ {
+@@ -302,6 +303,12 @@ static int __init omap2_sync32k_clocksou
+
+ return ret;
+ }
++#else
++static inline int omap2_sync32k_clocksource_init(void)
++{
++ return -ENODEV;
++}
++#endif
+
+ static void __init omap2_gptimer_clocksource_init(int gptimer_id,
+ const char *fck_source)
--- /dev/null
+From 2453f5f992717251cfadab6184fbb3ec2f2e8b40 Mon Sep 17 00:00:00 2001
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+Date: Fri, 14 Sep 2012 16:35:10 -0500
+Subject: cciss: fix handling of protocol error
+
+From: "Stephen M. Cameron" <scameron@beardog.cce.hp.com>
+
+commit 2453f5f992717251cfadab6184fbb3ec2f2e8b40 upstream.
+
+If a command completes with a status of CMD_PROTOCOL_ERR, this
+information should be conveyed to the SCSI mid layer, not dropped
+on the floor. Unlike a similar bug in the hpsa driver, this bug
+only affects tape drives and CD and DVD ROM drives in the cciss
+driver, and to induce it, you have to disconnect (or damage) a
+cable, so it is not a very likely scenario (which would explain
+why the bug has gone undetected for the last 10 years.)
+
+Signed-off-by: Stephen M. Cameron <scameron@beardog.cce.hp.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/cciss_scsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/block/cciss_scsi.c
++++ b/drivers/block/cciss_scsi.c
+@@ -795,6 +795,7 @@ static void complete_scsi_command(Comman
+ }
+ break;
+ case CMD_PROTOCOL_ERR:
++ cmd->result = DID_ERROR << 16;
+ dev_warn(&h->pdev->dev,
+ "%p has protocol error\n", c);
+ break;
--- /dev/null
+From 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 18 Sep 2012 14:24:59 -0700
+Subject: cpufreq/powernow-k8: workqueue user shouldn't migrate the kworker to another CPU
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 6889125b8b4e09c5e53e6ecab3433bed1ce198c9 upstream.
+
+powernowk8_target() runs off a per-cpu work item and if the
+cpufreq_policy->cpu is different from the current one, it migrates the
+kworker to the target CPU by manipulating current->cpus_allowed. The
+function migrates the kworker back to the original CPU but this is
+still broken. Workqueue concurrency management requires the kworkers
+to stay on the same CPU and powernowk8_target() ends up triggerring
+BUG_ON(rq != this_rq()) in try_to_wake_up_local() if it contends on
+fidvid_mutex and sleeps.
+
+It is unclear why this bug is being reported now. Duncan says it
+appeared to be a regression of 3.6-rc1 and couldn't reproduce it on
+3.5. Bisection seemed to point to 63d95a91 "workqueue: use @pool
+instead of @gcwq or @cpu where applicable" which is an non-functional
+change. Given that the reproduce case sometimes took upto days to
+trigger, it's easy to be misled while bisecting. Maybe something made
+contention on fidvid_mutex more likely? I don't know.
+
+This patch fixes the bug by using work_on_cpu() instead if @pol->cpu
+isn't the same as the current one. The code assumes that
+cpufreq_policy->cpu is kept online by the caller, which Rafael tells
+me is the case.
+
+stable: ed48ece27c ("workqueue: reimplement work_on_cpu() using
+ system_wq") should be applied before this; otherwise, the
+ behavior could be horrible.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Duncan <1i5t5.duncan@cox.net>
+Tested-by: Duncan <1i5t5.duncan@cox.net>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Cc: Andreas Herrmann <andreas.herrmann3@amd.com>
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47301
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernow-k8.c | 63 ++++++++++++++++++++++--------------------
+ 1 file changed, 34 insertions(+), 29 deletions(-)
+
+--- a/drivers/cpufreq/powernow-k8.c
++++ b/drivers/cpufreq/powernow-k8.c
+@@ -35,7 +35,6 @@
+ #include <linux/slab.h>
+ #include <linux/string.h>
+ #include <linux/cpumask.h>
+-#include <linux/sched.h> /* for current / set_cpus_allowed() */
+ #include <linux/io.h>
+ #include <linux/delay.h>
+
+@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(s
+ return res;
+ }
+
+-/* Driver entry point to switch to the target frequency */
+-static int powernowk8_target(struct cpufreq_policy *pol,
+- unsigned targfreq, unsigned relation)
++struct powernowk8_target_arg {
++ struct cpufreq_policy *pol;
++ unsigned targfreq;
++ unsigned relation;
++};
++
++static long powernowk8_target_fn(void *arg)
+ {
+- cpumask_var_t oldmask;
++ struct powernowk8_target_arg *pta = arg;
++ struct cpufreq_policy *pol = pta->pol;
++ unsigned targfreq = pta->targfreq;
++ unsigned relation = pta->relation;
+ struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
+ u32 checkfid;
+ u32 checkvid;
+ unsigned int newstate;
+- int ret = -EIO;
++ int ret;
+
+ if (!data)
+ return -EINVAL;
+@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpuf
+ checkfid = data->currfid;
+ checkvid = data->currvid;
+
+- /* only run on specific CPU from here on. */
+- /* This is poor form: use a workqueue or smp_call_function_single */
+- if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
+- return -ENOMEM;
+-
+- cpumask_copy(oldmask, tsk_cpus_allowed(current));
+- set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
+-
+- if (smp_processor_id() != pol->cpu) {
+- printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
+- goto err_out;
+- }
+-
+ if (pending_bit_stuck()) {
+ printk(KERN_ERR PFX "failing targ, change pending bit set\n");
+- goto err_out;
++ return -EIO;
+ }
+
+ pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
+ pol->cpu, targfreq, pol->min, pol->max, relation);
+
+ if (query_current_values_with_pending_wait(data))
+- goto err_out;
++ return -EIO;
+
+ if (cpu_family != CPU_HW_PSTATE) {
+ pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
+@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpuf
+
+ if (cpufreq_frequency_table_target(pol, data->powernow_table,
+ targfreq, relation, &newstate))
+- goto err_out;
++ return -EIO;
+
+ mutex_lock(&fidvid_mutex);
+
+@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpuf
+ ret = transition_frequency_fidvid(data, newstate);
+ if (ret) {
+ printk(KERN_ERR PFX "transition frequency failed\n");
+- ret = 1;
+ mutex_unlock(&fidvid_mutex);
+- goto err_out;
++ return 1;
+ }
+ mutex_unlock(&fidvid_mutex);
+
+@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpuf
+ data->powernow_table[newstate].index);
+ else
+ pol->cur = find_khz_freq_from_fid(data->currfid);
+- ret = 0;
+
+-err_out:
+- set_cpus_allowed_ptr(current, oldmask);
+- free_cpumask_var(oldmask);
+- return ret;
++ return 0;
++}
++
++/* Driver entry point to switch to the target frequency */
++static int powernowk8_target(struct cpufreq_policy *pol,
++ unsigned targfreq, unsigned relation)
++{
++ struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
++ .relation = relation };
++
++ /*
++ * Must run on @pol->cpu. cpufreq core is responsible for ensuring
++ * that we're bound to the current CPU and pol->cpu stays online.
++ */
++ if (smp_processor_id() == pol->cpu)
++ return powernowk8_target_fn(&pta);
++ else
++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
+ }
+
+ /* Driver entry point to verify the policy and range of frequencies */
--- /dev/null
+From 8335eafc2859e1a26282bef7c3d19f3d68868b8a Mon Sep 17 00:00:00 2001
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Thu, 13 Sep 2012 12:00:56 -0700
+Subject: eCryptfs: Copy up attributes of the lower target inode after rename
+
+From: Tyler Hicks <tyhicks@canonical.com>
+
+commit 8335eafc2859e1a26282bef7c3d19f3d68868b8a upstream.
+
+After calling into the lower filesystem to do a rename, the lower target
+inode's attributes were not copied up to the eCryptfs target inode. This
+resulted in the eCryptfs target inode staying around, rather than being
+evicted, because i_nlink was not updated for the eCryptfs inode. This
+also meant that eCryptfs didn't do the final iput() on the lower target
+inode so it stayed around, as well. This would result in a failure to
+free up space occupied by the target file in the rename() operation.
+Both target inodes would eventually be evicted when the eCryptfs
+filesystem was unmounted.
+
+This patch calls fsstack_copy_attr_all() after the lower filesystem
+does its ->rename() so that important inode attributes, such as i_nlink,
+are updated at the eCryptfs layer. ecryptfs_evict_inode() is now called
+and eCryptfs can drop its final reference on the lower inode.
+
+http://launchpad.net/bugs/561129
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Tested-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ecryptfs/inode.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -621,6 +621,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ struct dentry *lower_old_dir_dentry;
+ struct dentry *lower_new_dir_dentry;
+ struct dentry *trap = NULL;
++ struct inode *target_inode;
+
+ lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
+ lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
+@@ -628,6 +629,7 @@ ecryptfs_rename(struct inode *old_dir, s
+ dget(lower_new_dentry);
+ lower_old_dir_dentry = dget_parent(lower_old_dentry);
+ lower_new_dir_dentry = dget_parent(lower_new_dentry);
++ target_inode = new_dentry->d_inode;
+ trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+ /* source should not be ancestor of target */
+ if (trap == lower_old_dentry) {
+@@ -643,6 +645,9 @@ ecryptfs_rename(struct inode *old_dir, s
+ lower_new_dir_dentry->d_inode, lower_new_dentry);
+ if (rc)
+ goto out_lock;
++ if (target_inode)
++ fsstack_copy_attr_all(target_inode,
++ ecryptfs_inode_to_lower(target_inode));
+ fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
+ if (new_dir != old_dir)
+ fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
--- /dev/null
+From 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa Mon Sep 17 00:00:00 2001
+From: Amerigo Wang <amwang@redhat.com>
+Date: Sat, 18 Aug 2012 07:02:20 +0000
+Subject: netconsole: remove a redundant netconsole_target_put()
+
+From: Amerigo Wang <amwang@redhat.com>
+
+commit 72d3eb13b5c0abe7d63efac41f39c5b644c7bbaa upstream.
+
+This netconsole_target_put() is obviously redundant, and it
+causes a kernel segfault when removing a bridge device which has
+netconsole running on it.
+
+This is caused by:
+
+ commit 8d8fc29d02a33e4bd5f4fa47823c1fd386346093
+ Author: Amerigo Wang <amwang@redhat.com>
+ Date: Thu May 19 21:39:10 2011 +0000
+
+ netpoll: disable netpoll when enslave a device
+
+Signed-off-by: Cong Wang <amwang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/netconsole.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -648,7 +648,6 @@ static int netconsole_netdev_event(struc
+ flags);
+ dev_put(nt->np.dev);
+ nt->np.dev = NULL;
+- netconsole_target_put(nt);
+ }
+ nt->enabled = 0;
+ stopped = true;
bnx2x-fix-57840_mf-pci-id.patch
cs89x0-packet-reception-not-working.patch
openvswitch-reset-upper-layer-protocol-info-on-internal-devices.patch
+workqueue-reimplement-work_on_cpu-using-system_wq.patch
+cpufreq-powernow-k8-workqueue-user-shouldn-t-migrate-the-kworker-to-another-cpu.patch
+cciss-fix-handling-of-protocol-error.patch
+vfs-make-o_path-file-descriptors-usable-for-fstat.patch
+vfs-dcache-use-dcache_dentry_killed-instead-of-dcache_disconnected-in-d_kill.patch
+netconsole-remove-a-redundant-netconsole_target_put.patch
+ecryptfs-copy-up-attributes-of-the-lower-target-inode-after-rename.patch
+target-fix-data_length-re-assignment-bug-with-scsi-overflow.patch
+target-simplify-code-around-transport_get_sense_data.patch
+arm-7496-1-hw_breakpoint-don-t-rely-on-dfsr-to-show-watchpoint-access-type.patch
+arm-7501-1-decompressor-reset-ttbcr-for-vmsa-armv7-cores.patch
+arm-7513-1-make-sure-dtc-is-built-before-running-it.patch
+arm-7526-1-traps-send-sigill-if-get_user-fails-on-undef-handling-path.patch
+arm-7527-1-uaccess-explicitly-check-__user-pointer-when-cpu_use_domains.patch
+staging-android-alarm-ioctl-command-encoding-fix.patch
+arm-omap-timer-obey-the-config_omap_32k_timer.patch
+arm-clk-imx25-fix-ssi-clock-registration.patch
+arm-clk-imx35-fix-ssi-clock-registration.patch
+arm-fix-ioremap-of-address-zero.patch
+alsa-hda-fix-missing-master-volume-for-stac9200-925x.patch
+alsa-usb-audio-fix-bogus-error-messages-for-delay-accounting.patch
+alsa-hda-fix-oops-at-codec-reset-reconfig.patch
+alsa-ice1724-use-linear-scale-for-ak4396-volume-control.patch
+alsa-hda-workaround-for-silent-output-on-vaio-z-with-alc889.patch
+staging-speakup-fix-an-improperly-declared-variable.patch
+staging-zcache-fix-cleancache-race-condition-with-shrinker.patch
+staging-vt6656-failed-connection-incorrect-endian.patch
+staging-r8712u-fix-bug-in-r8712_recv_indicatepkt.patch
+staging-comedi-amplc_pci224-fix-pci-ref-count.patch
+staging-comedi-das08-correct-ao-output-for-das08jr-16-ao.patch
+staging-comedi-das08-correct-ai-encoding-for-das08jr-16-ao.patch
+usb-option-replace-zte-k5006-z-entry-with-vendor-class-rule.patch
--- /dev/null
+From 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 Mon Sep 17 00:00:00 2001
+From: "Dae S. Kim" <dae@velatum.com>
+Date: Fri, 31 Aug 2012 02:00:51 +0200
+Subject: Staging: Android alarm: IOCTL command encoding fix
+
+From: "Dae S. Kim" <dae@velatum.com>
+
+commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 upstream.
+
+Fixed a bug. Data was being written to user space using an IOCTL
+command encoded with _IOC_WRITE access mode.
+
+Signed-off-by: Dae S. Kim <dae@velatum.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/android_alarm.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/android/android_alarm.h
++++ b/drivers/staging/android/android_alarm.h
+@@ -51,10 +51,12 @@ enum android_alarm_return_flags {
+ #define ANDROID_ALARM_WAIT _IO('a', 1)
+
+ #define ALARM_IOW(c, type, size) _IOW('a', (c) | ((type) << 4), size)
++#define ALARM_IOR(c, type, size) _IOR('a', (c) | ((type) << 4), size)
++
+ /* Set alarm */
+ #define ANDROID_ALARM_SET(type) ALARM_IOW(2, type, struct timespec)
+ #define ANDROID_ALARM_SET_AND_WAIT(type) ALARM_IOW(3, type, struct timespec)
+-#define ANDROID_ALARM_GET_TIME(type) ALARM_IOW(4, type, struct timespec)
++#define ANDROID_ALARM_GET_TIME(type) ALARM_IOR(4, type, struct timespec)
+ #define ANDROID_ALARM_SET_RTC _IOW('a', 5, struct timespec)
+ #define ANDROID_ALARM_BASE_CMD(cmd) (cmd & ~(_IOC(0, 0, 0xf0, 0)))
+ #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd) (_IOC_NR(cmd) >> 4)
--- /dev/null
+From cadf84bfeb80e216fde328d357fe856160157d2c Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 3 Sep 2012 16:39:38 +0100
+Subject: staging: comedi: amplc_pci224: Fix PCI ref count
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit cadf84bfeb80e216fde328d357fe856160157d2c upstream.
+
+When attaching a PCI device manually via the comedi driver `attach` hook
+(`pci224_attach()`) (called by the comedi core for the
+`COMEDI_DEVCONFIG` ioctl), its reference count is incremented in the
+`for_each_pci_dev` loop (in `pci224_find_pci_dev()`). It is decremented
+when the `detach` hook (`pci224_detach()`) is called to detach the
+device. However, when the PCI device is attached automatically via the
+`attach_pci` hook (`pci224_attach_pci()`, called at probe time via
+`comedi_pci_auto_config()`) it's reference count is not incremented so
+there will be an unmatched decrement when detaching the device.
+
+Increment the PCI device reference count in `pci224_attach_pci()` to
+correct the mismatch.
+
+Once support for manual configuration has been removed from this driver,
+the calls to `pci_dev_get()` and `pci_dev_put()` can be removed.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/amplc_pci224.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/staging/comedi/drivers/amplc_pci224.c
++++ b/drivers/staging/comedi/drivers/amplc_pci224.c
+@@ -1519,6 +1519,13 @@ pci224_attach_pci(struct comedi_device *
+ dev->minor, DRIVER_NAME);
+ return -EINVAL;
+ }
++ /*
++ * Need to 'get' the PCI device to match the 'put' in pci224_detach().
++ * TODO: Remove the pci_dev_get() and matching pci_dev_put() once
++ * support for manual attachment of PCI devices via pci224_attach()
++ * has been removed.
++ */
++ pci_dev_get(pci_dev);
+ return pci224_attach_common(dev, pci_dev, NULL);
+ }
+
--- /dev/null
+From e6391a182865efc896cb2a8d79e07b7ac2f45b48 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 31 Aug 2012 20:41:29 +0100
+Subject: staging: comedi: das08: Correct AI encoding for das08jr-16-ao
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit e6391a182865efc896cb2a8d79e07b7ac2f45b48 upstream.
+
+The element of `das08_boards[]` for the 'das08jr-16-ao' board has the
+`ai_encoding` member set to `das08_encode12`. It should be set to
+`das08_encode16` same as the 'das08jr/16' board. After all, this board
+has 16-bit AI resolution.
+
+The description of the A/D LSB register at offset 0 seems incorrect in
+the user manual "cio-das08jr-16-ao.pdf" as it implies that the AI
+resolution is only 12 bits. The diagrams of the A/D LSB and MSB
+registers show 15 data bits and a sign bit, which matches what the
+software expects for the `das08_encode16` AI encoding method.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/das08.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -403,7 +403,7 @@ static const struct das08_board_struct d
+ .ai = das08_ai_rinsn,
+ .ai_nbits = 16,
+ .ai_pg = das08_pg_none,
+- .ai_encoding = das08_encode12,
++ .ai_encoding = das08_encode16,
+ .ao = das08jr_ao_winsn,
+ .ao_nbits = 16,
+ .di = das08jr_di_rbits,
--- /dev/null
+From 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 31 Aug 2012 20:41:30 +0100
+Subject: staging: comedi: das08: Correct AO output for das08jr-16-ao
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 61ed59ed09e6ad2b8395178ea5ad5f653bba08e3 upstream.
+
+Don't zero out bits 15..12 of the data value in `das08jr_ao_winsn()` as
+that knobbles the upper three-quarters of the output range for the
+'das08jr-16-ao' board.
+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/das08.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -678,7 +678,7 @@ static int das08jr_ao_winsn(struct comed
+ int chan;
+
+ lsb = data[0] & 0xff;
+- msb = (data[0] >> 8) & 0xf;
++ msb = (data[0] >> 8) & 0xff;
+
+ chan = CR_CHAN(insn->chanspec);
+
--- /dev/null
+From abf02cfc179bb4bd30d05f582d61b3b8f429b813 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 10 Sep 2012 21:22:11 +0200
+Subject: staging: r8712u: fix bug in r8712_recv_indicatepkt()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit abf02cfc179bb4bd30d05f582d61b3b8f429b813 upstream.
+
+64bit arches have a buggy r8712u driver, let's fix it.
+
+skb->tail must be set properly or network stack behavior is undefined.
+
+Addresses https://bugzilla.redhat.com/show_bug.cgi?id=847525
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=45071
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Dave Jones <davej@redhat.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/recv_linux.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/staging/rtl8712/recv_linux.c
++++ b/drivers/staging/rtl8712/recv_linux.c
+@@ -117,13 +117,8 @@ void r8712_recv_indicatepkt(struct _adap
+ if (skb == NULL)
+ goto _recv_indicatepkt_drop;
+ skb->data = precv_frame->u.hdr.rx_data;
+-#ifdef NET_SKBUFF_DATA_USES_OFFSET
+- skb->tail = (sk_buff_data_t)(precv_frame->u.hdr.rx_tail -
+- precv_frame->u.hdr.rx_head);
+-#else
+- skb->tail = (sk_buff_data_t)precv_frame->u.hdr.rx_tail;
+-#endif
+ skb->len = precv_frame->u.hdr.len;
++ skb_set_tail_pointer(skb, skb->len);
+ if ((pattrib->tcpchk_valid == 1) && (pattrib->tcp_chkrpt == 1))
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ else
--- /dev/null
+From 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b Mon Sep 17 00:00:00 2001
+From: Christopher Brannon <chris@the-brannons.com>
+Date: Sat, 16 Jun 2012 16:55:20 -0500
+Subject: Staging: speakup: fix an improperly-declared variable.
+
+From: Christopher Brannon <chris@the-brannons.com>
+
+commit 4ea418b8b2fa8a70d0fcc8231b65e67b3a72984b upstream.
+
+A local static variable was declared as a pointer to a string
+constant. We're assigning to the underlying memory, so it
+needs to be an array instead.
+
+Signed-off-by: Christopher Brannon <chris@the-brannons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -1854,7 +1854,7 @@ static void speakup_bits(struct vc_data
+
+ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u_short key)
+ {
+- static u_char *goto_buf = "\0\0\0\0\0\0";
++ static u_char goto_buf[8];
+ static int num;
+ int maxlen, go_pos;
+ char *cp;
--- /dev/null
+From aa209eef3ce8419ff2926c2fa944dfbfb5afbacb Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 29 Aug 2012 23:08:21 +0100
+Subject: staging: vt6656: [BUG] - Failed connection, incorrect endian.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit aa209eef3ce8419ff2926c2fa944dfbfb5afbacb upstream.
+
+Hi,
+
+This patch fixes a bug with driver failing to negotiate a connection.
+
+The bug was traced to commit
+203e4615ee9d9fa8d3506b9d0ef30095e4d5bc90
+staging: vt6656: removed custom definitions of Ethernet packet types
+
+In that patch, definitions in include/linux/if_ether.h replaced ones
+in tether.h which had both big and little endian definitions.
+
+include/linux/if_ether.h only refers to big endian values, cpu_to_be16
+should be used for the correct endian architectures.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/dpc.c | 2 +-
+ drivers/staging/vt6656/rxtx.c | 38 +++++++++++++++++++-------------------
+ 2 files changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/staging/vt6656/dpc.c
++++ b/drivers/staging/vt6656/dpc.c
+@@ -200,7 +200,7 @@ s_vProcessRxMACHeader (
+ } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
+ cbHeaderSize += 6;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+- if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
+ (*pwType == cpu_to_le16(0xF380))) {
+ cbHeaderSize -= 8;
+ pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
+--- a/drivers/staging/vt6656/rxtx.c
++++ b/drivers/staging/vt6656/rxtx.c
+@@ -1701,7 +1701,7 @@ s_bPacketToWirelessUsb(
+ // 802.1H
+ if (ntohs(psEthHeader->wType) > ETH_DATA_LEN) {
+ if (pDevice->dwDiagRefCount == 0) {
+- if ((psEthHeader->wType == cpu_to_le16(ETH_P_IPX)) ||
++ if ((psEthHeader->wType == cpu_to_be16(ETH_P_IPX)) ||
+ (psEthHeader->wType == cpu_to_le16(0xF380))) {
+ memcpy((PBYTE) (pbyPayloadHead),
+ abySNAP_Bridgetunnel, 6);
+@@ -2840,10 +2840,10 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ Packet_Type = skb->data[ETH_HLEN+1];
+ Descriptor_type = skb->data[ETH_HLEN+1+1+2];
+ Key_info = (skb->data[ETH_HLEN+1+1+2+1] << 8)|(skb->data[ETH_HLEN+1+1+2+2]);
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- /* 802.1x OR eapol-key challenge frame transfer */
+- if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
+- (Packet_Type == 3)) {
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ /* 802.1x OR eapol-key challenge frame transfer */
++ if (((Protocol_Version == 1) || (Protocol_Version == 2)) &&
++ (Packet_Type == 3)) {
+ bTxeapol_key = TRUE;
+ if(!(Key_info & BIT3) && //WPA or RSN group-key challenge
+ (Key_info & BIT8) && (Key_info & BIT9)) { //send 2/2 key
+@@ -2989,19 +2989,19 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+ }
+ }
+
+- if (pDevice->sTxEthHeader.wType == cpu_to_le16(ETH_P_PAE)) {
+- if (pDevice->byBBType != BB_TYPE_11A) {
+- pDevice->wCurrentRate = RATE_1M;
+- pDevice->byACKRate = RATE_1M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- } else {
+- pDevice->wCurrentRate = RATE_6M;
+- pDevice->byACKRate = RATE_6M;
+- pDevice->byTopCCKBasicRate = RATE_1M;
+- pDevice->byTopOFDMBasicRate = RATE_6M;
+- }
+- }
++ if (pDevice->sTxEthHeader.wType == cpu_to_be16(ETH_P_PAE)) {
++ if (pDevice->byBBType != BB_TYPE_11A) {
++ pDevice->wCurrentRate = RATE_1M;
++ pDevice->byACKRate = RATE_1M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ } else {
++ pDevice->wCurrentRate = RATE_6M;
++ pDevice->byACKRate = RATE_6M;
++ pDevice->byTopCCKBasicRate = RATE_1M;
++ pDevice->byTopOFDMBasicRate = RATE_6M;
++ }
++ }
+
+ DBG_PRT(MSG_LEVEL_DEBUG,
+ KERN_INFO "dma_tx: pDevice->wCurrentRate = %d\n",
+@@ -3017,7 +3017,7 @@ int nsDMA_tx_packet(PSDevice pDevice, un
+
+ if (bNeedEncryption == TRUE) {
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ntohs Pkt Type=%04x\n", ntohs(pDevice->sTxEthHeader.wType));
+- if ((pDevice->sTxEthHeader.wType) == cpu_to_le16(ETH_P_PAE)) {
++ if ((pDevice->sTxEthHeader.wType) == cpu_to_be16(ETH_P_PAE)) {
+ bNeedEncryption = FALSE;
+ DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Pkt Type=%04x\n", (pDevice->sTxEthHeader.wType));
+ if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) && (pMgmt->eCurrState == WMAC_STATE_ASSOC)) {
--- /dev/null
+From 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 Mon Sep 17 00:00:00 2001
+From: Seth Jennings <sjenning@linux.vnet.ibm.com>
+Date: Wed, 29 Aug 2012 16:58:45 -0500
+Subject: staging: zcache: fix cleancache race condition with shrinker
+
+From: Seth Jennings <sjenning@linux.vnet.ibm.com>
+
+commit 6d7d9798ad5c97ee4e911dd070dc12dc5ae55bd0 upstream.
+
+This patch fixes a race condition that results in memory
+corruption when using cleancache.
+
+The race exists between the zcache shrinker handler,
+shrink_zcache_memory() and cleancache_get_page().
+
+In most cases, the shrinker will both evict a zbpg
+from its buddy list and flush it from tmem before a
+cleancache_get_page() occurs on that page. A subsequent
+cleancache_get_page() will fail in the tmem layer.
+
+In the rare case that two occur together and the
+cleancache_get_page() path gets through the tmem
+layer before the shrinker path can flush tmem,
+zbud_decompress() does a check to see if the zbpg is a
+"zombie", i.e. not on a buddy list, which means the shrinker
+is in the process of reclaiming it. If the zbpg is a zombie,
+zbud_decompress() returns -EINVAL.
+
+However, this return code is being ignored by the caller,
+zcache_pampd_get_data_and_free(), which results in the
+caller of cleancache_get_page() thinking that the page has
+been properly retrieved when it has not.
+
+This patch modifies zcache_pampd_get_data_and_free() to
+convey the failure up the stack so that the caller of
+cleancache_get_page() knows the page retrieval failed.
+
+This needs to be applied to stable trees as well.
+zcache-main.c was named zcache.c before v3.1, so
+I'm not sure how you want to handle trees earlier
+than that.
+
+Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Reviewed-by: Minchan Kim <minchan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/zcache/zcache-main.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/zcache/zcache-main.c
++++ b/drivers/staging/zcache/zcache-main.c
+@@ -1259,13 +1259,12 @@ static int zcache_pampd_get_data_and_fre
+ void *pampd, struct tmem_pool *pool,
+ struct tmem_oid *oid, uint32_t index)
+ {
+- int ret = 0;
+-
+ BUG_ON(!is_ephemeral(pool));
+- zbud_decompress((struct page *)(data), pampd);
++ if (zbud_decompress((struct page *)(data), pampd) < 0)
++ return -EINVAL;
+ zbud_free_and_delist((struct zbud_hdr *)pampd);
+ atomic_dec(&zcache_curr_eph_pampd_count);
+- return ret;
++ return 0;
+ }
+
+ /*
--- /dev/null
+From 4c054ba63ad47ef244cfcfa1cea38134620a5bae Mon Sep 17 00:00:00 2001
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+Date: Thu, 16 Aug 2012 15:33:10 -0700
+Subject: target: Fix ->data_length re-assignment bug with SCSI overflow
+
+From: Nicholas Bellinger <nab@linux-iscsi.org>
+
+commit 4c054ba63ad47ef244cfcfa1cea38134620a5bae upstream.
+
+This patch fixes a long-standing bug with SCSI overflow handling
+where se_cmd->data_length was incorrectly being re-assigned to
+the larger CDB extracted allocation length, resulting in a number
+of fabric level errors that would end up causing a session reset
+in most cases. So instead now:
+
+ - Only re-assign se_cmd->data_length durining UNDERFLOW (to use the
+ smaller value)
+ - Use existing se_cmd->data_length for OVERFLOW (to use the smaller
+ value)
+
+This fix has been tested with the following CDB to generate an
+SCSI overflow:
+
+ sg_raw -r512 /dev/sdc 28 0 0 0 0 0 0 0 9 0
+
+Tested using iscsi-target, tcm_qla2xxx, loopback and tcm_vhost fabric
+ports. Here is a bit more detail on each case:
+
+ - iscsi-target: Bug with open-iscsi with overflow, sg_raw returns
+ -3584 bytes of data.
+ - tcm_qla2xxx: Working as expected, returnins 512 bytes of data
+ - loopback: sg_raw returns CHECK_CONDITION, from overflow rejection
+ in transport_generic_map_mem_to_cmd()
+ - tcm_vhost: Same as loopback
+
+Reported-by: Roland Dreier <roland@purestorage.com>
+Cc: Roland Dreier <roland@purestorage.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3000,15 +3000,20 @@ static int transport_generic_cmd_sequenc
+ /* Returns CHECK_CONDITION + INVALID_CDB_FIELD */
+ goto out_invalid_cdb_field;
+ }
+-
++ /*
++ * For the overflow case keep the existing fabric provided
++ * ->data_length. Otherwise for the underflow case, reset
++ * ->data_length to the smaller SCSI expected data transfer
++ * length.
++ */
+ if (size > cmd->data_length) {
+ cmd->se_cmd_flags |= SCF_OVERFLOW_BIT;
+ cmd->residual_count = (size - cmd->data_length);
+ } else {
+ cmd->se_cmd_flags |= SCF_UNDERFLOW_BIT;
+ cmd->residual_count = (cmd->data_length - size);
++ cmd->data_length = size;
+ }
+- cmd->data_length = size;
+ }
+
+ if (cmd->se_cmd_flags & SCF_SCSI_DATA_SG_IO_CDB) {
--- /dev/null
+From 27a2709912ac19c755d34c79fe11994b0bf8082b Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 5 Sep 2012 17:09:14 +0200
+Subject: target: simplify code around transport_get_sense_data
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 27a2709912ac19c755d34c79fe11994b0bf8082b upstream.
+
+The error conditions in transport_get_sense_data are superfluous
+and complicate the code unnecessarily:
+
+* SCF_TRANSPORT_TASK_SENSE is checked in the caller;
+
+* it's simply part of the invariants of dev->transport->get_sense_buffer
+ that it must be there if transport_complete ever returns 1, and that
+ it must not return NULL. Besides, the entire callback will disappear
+ with the next patch.
+
+* similarly in the caller we can expect that sense data is only sent
+ for non-zero cmd->scsi_status.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_transport.c | 49 ++++++++-------------------------
+ 1 file changed, 13 insertions(+), 36 deletions(-)
+
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2261,7 +2261,7 @@ out:
+ /*
+ * Used to obtain Sense Data from underlying Linux/SCSI struct scsi_cmnd
+ */
+-static int transport_get_sense_data(struct se_cmd *cmd)
++static void transport_get_sense_data(struct se_cmd *cmd)
+ {
+ unsigned char *buffer = cmd->sense_buffer, *sense_buffer = NULL;
+ struct se_device *dev = cmd->se_dev;
+@@ -2271,30 +2271,15 @@ static int transport_get_sense_data(stru
+ WARN_ON(!cmd->se_lun);
+
+ if (!dev)
+- return 0;
++ return;
+
+ spin_lock_irqsave(&cmd->t_state_lock, flags);
+ if (cmd->se_cmd_flags & SCF_SENT_CHECK_CONDITION) {
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+- return 0;
+- }
+-
+- if (!(cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE))
+- goto out;
+-
+- if (!dev->transport->get_sense_buffer) {
+- pr_err("dev->transport->get_sense_buffer is NULL\n");
+- goto out;
++ return;
+ }
+
+ sense_buffer = dev->transport->get_sense_buffer(cmd);
+- if (!sense_buffer) {
+- pr_err("ITT 0x%08x cmd %p: Unable to locate"
+- " sense buffer for task with sense\n",
+- cmd->se_tfo->get_task_tag(cmd), cmd);
+- goto out;
+- }
+-
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+ offset = cmd->se_tfo->set_fabric_sense_len(cmd, TRANSPORT_SENSE_BUFFER);
+@@ -2306,11 +2291,6 @@ static int transport_get_sense_data(stru
+
+ pr_debug("HBA_[%u]_PLUG[%s]: Set SAM STATUS: 0x%02x and sense\n",
+ dev->se_hba->hba_id, dev->transport->name, cmd->scsi_status);
+- return 0;
+-
+-out:
+- spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+- return -1;
+ }
+
+ static inline long long transport_dev_end_lba(struct se_device *dev)
+@@ -3171,7 +3151,7 @@ static void transport_handle_queue_full(
+ static void target_complete_ok_work(struct work_struct *work)
+ {
+ struct se_cmd *cmd = container_of(work, struct se_cmd, work);
+- int reason = 0, ret;
++ int ret;
+
+ /*
+ * Check if we need to move delayed/dormant tasks from cmds on the
+@@ -3192,19 +3172,16 @@ static void target_complete_ok_work(stru
+ * the struct se_cmd in question.
+ */
+ if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
+- if (transport_get_sense_data(cmd) < 0)
+- reason = TCM_NON_EXISTENT_LUN;
++ WARN_ON(!cmd->scsi_status);
++ transport_get_sense_data(cmd);
++ ret = transport_send_check_condition_and_sense(
++ cmd, 0, 1);
++ if (ret == -EAGAIN || ret == -ENOMEM)
++ goto queue_full;
+
+- if (cmd->scsi_status) {
+- ret = transport_send_check_condition_and_sense(
+- cmd, reason, 1);
+- if (ret == -EAGAIN || ret == -ENOMEM)
+- goto queue_full;
+-
+- transport_lun_remove_cmd(cmd);
+- transport_cmd_check_stop_to_fabric(cmd);
+- return;
+- }
++ transport_lun_remove_cmd(cmd);
++ transport_cmd_check_stop_to_fabric(cmd);
++ return;
+ }
+ /*
+ * Check for a callback, used by amongst other things
--- /dev/null
+From ba9edaa468869a8cea242a411066b0f490751798 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Tue, 11 Sep 2012 09:40:31 +0200
+Subject: USB: option: replace ZTE K5006-Z entry with vendor class rule
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+
+commit ba9edaa468869a8cea242a411066b0f490751798 upstream.
+
+Fix the ZTE K5006-Z entry so that it actually matches anything
+
+ commit f1b5c997 USB: option: add ZTE K5006-Z
+
+added a device specific entry assuming that the device would use
+class/subclass/proto == ff/ff/ff like other ZTE devices. It
+turns out that ZTE has started using vendor specific subclass
+and protocol codes:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=1018 Rev= 0.00
+S: Manufacturer=ZTE,Incorporated
+S: Product=ZTE LTE Technologies MSM
+S: SerialNumber=MF821Vxxxxxxx
+C:* #Ifs= 5 Cfg#= 1 Atr=c0 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=86 Prot=10 Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=02 Prot=05 Driver=(none)
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=00 Driver=qmi_wwan
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=4ms
+I:* If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+We do not have any information on how ZTE intend to use these
+codes, but let us assume for now that the 3 sets matching
+serial functions in the K5006-Z always will identify a serial
+function in a ZTE device.
+
+Cc: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -886,8 +886,6 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff),
+- .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
+@@ -1092,6 +1090,10 @@ static const struct usb_device_id option
+ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
++ { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
++
+ { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+ { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
+ { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
--- /dev/null
+From b161dfa6937ae46d50adce8a7c6b12233e96e7bd Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@suse.cz>
+Date: Mon, 17 Sep 2012 22:31:38 +0200
+Subject: vfs: dcache: use DCACHE_DENTRY_KILLED instead of DCACHE_DISCONNECTED in d_kill()
+
+From: Miklos Szeredi <mszeredi@suse.cz>
+
+commit b161dfa6937ae46d50adce8a7c6b12233e96e7bd upstream.
+
+IBM reported a soft lockup after applying the fix for the rename_lock
+deadlock. Commit c83ce989cb5f ("VFS: Fix the nfs sillyrename regression
+in kernel 2.6.38") was found to be the culprit.
+
+The nfs sillyrename fix used DCACHE_DISCONNECTED to indicate that the
+dentry was killed. This flag can be set on non-killed dentries too,
+which results in infinite retries when trying to traverse the dentry
+tree.
+
+This patch introduces a separate flag: DCACHE_DENTRY_KILLED, which is
+only set in d_kill() and makes try_to_ascend() test only this flag.
+
+IBM reported successful test results with this patch.
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+Cc: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 4 ++--
+ include/linux/dcache.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dent
+ * Inform try_to_ascend() that we are no longer attached to the
+ * dentry tree
+ */
+- dentry->d_flags |= DCACHE_DISCONNECTED;
++ dentry->d_flags |= DCACHE_DENTRY_KILLED;
+ if (parent)
+ spin_unlock(&parent->d_lock);
+ dentry_iput(dentry);
+@@ -1046,7 +1046,7 @@ static struct dentry *try_to_ascend(stru
+ * or deletion
+ */
+ if (new != old->d_parent ||
+- (old->d_flags & DCACHE_DISCONNECTED) ||
++ (old->d_flags & DCACHE_DENTRY_KILLED) ||
+ (!locked && read_seqretry(&rename_lock, seq))) {
+ spin_unlock(&new->d_lock);
+ new = NULL;
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -206,6 +206,8 @@ struct dentry_operations {
+ #define DCACHE_MANAGED_DENTRY \
+ (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
+
++#define DCACHE_DENTRY_KILLED 0x100000
++
+ extern seqlock_t rename_lock;
+
+ static inline int dname_external(struct dentry *dentry)
--- /dev/null
+From 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Fri, 14 Sep 2012 14:48:21 -0700
+Subject: vfs: make O_PATH file descriptors usable for 'fstat()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 55815f70147dcfa3ead5738fd56d3574e2e3c1c2 upstream.
+
+We already use them for openat() and friends, but fstat() also wants to
+be able to use O_PATH file descriptors. This should make it more
+directly comparable to the O_SEARCH of Solaris.
+
+Note that you could already do the same thing with "fstatat()" and an
+empty path, but just doing "fstat()" directly is simpler and faster, so
+there is no reason not to just allow it directly.
+
+See also commit 332a2e1244bd, which did the same thing for fchdir, for
+the same reasons.
+
+Reported-by: ольга крыжановская <olga.kryzhanovska@gmail.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/stat.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/stat.c
++++ b/fs/stat.c
+@@ -58,7 +58,7 @@ EXPORT_SYMBOL(vfs_getattr);
+ int vfs_fstat(unsigned int fd, struct kstat *stat)
+ {
+ int fput_needed;
+- struct file *f = fget_light(fd, &fput_needed);
++ struct file *f = fget_raw_light(fd, &fput_needed);
+ int error = -EBADF;
+
+ if (f) {
--- /dev/null
+From ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Tue, 18 Sep 2012 12:48:43 -0700
+Subject: workqueue: reimplement work_on_cpu() using system_wq
+
+From: Tejun Heo <tj@kernel.org>
+
+commit ed48ece27cd3d5ee0354c32bbaec0f3e1d4715c3 upstream.
+
+The existing work_on_cpu() implementation is hugely inefficient. It
+creates a new kthread, execute that single function and then let the
+kthread die on each invocation.
+
+Now that system_wq can handle concurrent executions, there's no
+advantage of doing this. Reimplement work_on_cpu() using system_wq
+which makes it simpler and way more efficient.
+
+stable: While this isn't a fix in itself, it's needed to fix a
+ workqueue related bug in cpufreq/powernow-k8. AFAICS, this
+ shouldn't break other existing users.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Len Brown <lenb@kernel.org>
+Cc: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3628,18 +3628,17 @@ static int __devinit workqueue_cpu_down_
+ #ifdef CONFIG_SMP
+
+ struct work_for_cpu {
+- struct completion completion;
++ struct work_struct work;
+ long (*fn)(void *);
+ void *arg;
+ long ret;
+ };
+
+-static int do_work_for_cpu(void *_wfc)
++static void work_for_cpu_fn(struct work_struct *work)
+ {
+- struct work_for_cpu *wfc = _wfc;
++ struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
++
+ wfc->ret = wfc->fn(wfc->arg);
+- complete(&wfc->completion);
+- return 0;
+ }
+
+ /**
+@@ -3654,19 +3653,11 @@ static int do_work_for_cpu(void *_wfc)
+ */
+ long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
+ {
+- struct task_struct *sub_thread;
+- struct work_for_cpu wfc = {
+- .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
+- .fn = fn,
+- .arg = arg,
+- };
++ struct work_for_cpu wfc = { .fn = fn, .arg = arg };
+
+- sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
+- if (IS_ERR(sub_thread))
+- return PTR_ERR(sub_thread);
+- kthread_bind(sub_thread, cpu);
+- wake_up_process(sub_thread);
+- wait_for_completion(&wfc.completion);
++ INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
++ schedule_work_on(cpu, &wfc.work);
++ flush_work(&wfc.work);
+ return wfc.ret;
+ }
+ EXPORT_SYMBOL_GPL(work_on_cpu);
projects / thirdparty / kernel / stable-queue.git / commitdiff
