--- /dev/null
+From a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Thu, 7 Mar 2013 15:09:24 +0000
+Subject: clockevents: Don't allow dummy broadcast timers
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit a7dc19b8652c862d5b7c4d2339bd3c428bd29c4a upstream.
+
+Currently tick_check_broadcast_device doesn't reject clock_event_devices
+with CLOCK_EVT_FEAT_DUMMY, and may select them in preference to real
+hardware if they have a higher rating value. In this situation, the
+dummy timer is responsible for broadcasting to itself, and the core
+clockevents code may attempt to call non-existent callbacks for
+programming the dummy, eventually leading to a panic.
+
+This patch makes tick_check_broadcast_device always reject dummy timers,
+preventing this problem.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Jon Medhurst (Tixy) <tixy@linaro.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/tick-broadcast.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodi
+ */
+ int tick_check_broadcast_device(struct clock_event_device *dev)
+ {
+- if ((tick_broadcast_device.evtdev &&
++ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
++ (tick_broadcast_device.evtdev &&
+ tick_broadcast_device.evtdev->rating >= dev->rating) ||
+ (dev->features & CLOCK_EVT_FEAT_C3STOP))
+ return 0;
--- /dev/null
+From 2b405bfa84063bfa35621d2d6879f52693c614b0 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 20 Mar 2013 09:42:11 -0400
+Subject: ext4: fix data=journal fast mount/umount hang
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 2b405bfa84063bfa35621d2d6879f52693c614b0 upstream.
+
+In data=journal mode, if we unmount the file system before a
+transaction has a chance to complete, when the journal inode is being
+evicted, we can end up calling into jbd2_log_wait_commit() for the
+last transaction, after the journalling machinery has been shut down.
+
+Arguably we should adjust ext4_should_journal_data() to return FALSE
+for the journal inode, but the only place it matters is
+ext4_evict_inode(), and so to save a bit of CPU time, and to make the
+patch much more obviously correct by inspection(tm), we'll fix it by
+explicitly not trying to waiting for a journal commit when we are
+evicting the journal inode, since it's guaranteed to never succeed in
+this case.
+
+This can be easily replicated via:
+
+ mount -t ext4 -o data=journal /dev/vdb /vdb ; umount /vdb
+
+------------[ cut here ]------------
+WARNING: at /usr/projects/linux/ext4/fs/jbd2/journal.c:542 __jbd2_log_start_commit+0xba/0xcd()
+Hardware name: Bochs
+JBD2: bad log_start_commit: 3005630206 3005630206 0 0
+Modules linked in:
+Pid: 2909, comm: umount Not tainted 3.8.0-rc3 #1020
+Call Trace:
+ [<c015c0ef>] warn_slowpath_common+0x68/0x7d
+ [<c02b7e7d>] ? __jbd2_log_start_commit+0xba/0xcd
+ [<c015c177>] warn_slowpath_fmt+0x2b/0x2f
+ [<c02b7e7d>] __jbd2_log_start_commit+0xba/0xcd
+ [<c02b8075>] jbd2_log_start_commit+0x24/0x34
+ [<c0279ed5>] ext4_evict_inode+0x71/0x2e3
+ [<c021f0ec>] evict+0x94/0x135
+ [<c021f9aa>] iput+0x10a/0x110
+ [<c02b7836>] jbd2_journal_destroy+0x190/0x1ce
+ [<c0175284>] ? bit_waitqueue+0x50/0x50
+ [<c028d23f>] ext4_put_super+0x52/0x294
+ [<c020efe3>] generic_shutdown_super+0x48/0xb4
+ [<c020f071>] kill_block_super+0x22/0x60
+ [<c020f3e0>] deactivate_locked_super+0x22/0x49
+ [<c020f5d6>] deactivate_super+0x30/0x33
+ [<c0222795>] mntput_no_expire+0x107/0x10c
+ [<c02233a7>] sys_umount+0x2cf/0x2e0
+ [<c02233ca>] sys_oldumount+0x12/0x14
+ [<c08096b8>] syscall_call+0x7/0xb
+---[ end trace 6a954cc790501c1f ]---
+jbd2_log_wait_commit: error: j_commit_request=-1289337090, tid=0
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -144,7 +144,8 @@ void ext4_evict_inode(struct inode *inod
+ * don't use page cache.
+ */
+ if (ext4_should_journal_data(inode) &&
+- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
++ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
++ inode->i_ino != EXT4_JOURNAL_INO) {
+ journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
+ tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
+
--- /dev/null
+From 1ee9e2aa7b31427303466776f455d43e5e3c9275 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Tue, 26 Feb 2013 15:46:27 +0000
+Subject: IPoIB: Fix send lockup due to missed TX completion
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 1ee9e2aa7b31427303466776f455d43e5e3c9275 upstream.
+
+Commit f0dc117abdfa ("IPoIB: Fix TX queue lockup with mixed UD/CM
+traffic") attempts to solve an issue where unprocessed UD send
+completions can deadlock the netdev.
+
+The patch doesn't fully resolve the issue because if more than half
+the tx_outstanding's were UD and all of the destinations are RC
+reachable, arming the CQ doesn't solve the issue.
+
+This patch uses the IB_CQ_REPORT_MISSED_EVENTS on the
+ib_req_notify_cq(). If the rc is above 0, the UD send cq completion
+callback is called directly to re-arm the send completion timer.
+
+This issue is seen in very large parallel filesystem deployments
+and the patch has been shown to correct the issue.
+
+Reviewed-by: Dean Luick <dean.luick@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Roland Dreier <roland@purestorage.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -755,9 +755,13 @@ void ipoib_cm_send(struct net_device *de
+ if (++priv->tx_outstanding == ipoib_sendq_size) {
+ ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ tx->qp->qp_num);
+- if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
+- ipoib_warn(priv, "request notify on send CQ failed\n");
+ netif_stop_queue(dev);
++ rc = ib_req_notify_cq(priv->send_cq,
++ IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
++ if (rc < 0)
++ ipoib_warn(priv, "request notify on send CQ failed\n");
++ else if (rc)
++ ipoib_send_comp_handler(priv->send_cq, dev);
+ }
+ }
+ }
cifs-ignore-everything-in-spnego-blob-after-mechtypes.patch
jbd2-fix-use-after-free-in-jbd2_journal_dirty_metadata.patch
ext4-fix-the-wrong-number-of-the-allocated-blocks-in-ext4_split_extent.patch
+usb-storage-add-unusual_devs-entry-for-samsung-yp-z3-mp3-player.patch
+ext4-fix-data-journal-fast-mount-umount-hang.patch
+ipoib-fix-send-lockup-due-to-missed-tx-completion.patch
+clockevents-don-t-allow-dummy-broadcast-timers.patch
+x86-64-fix-the-failure-case-in-copy_user_handle_tail.patch
+usb-xhci-fix-bit-definitions-for-iman-register.patch
+usb-xhci-correctly-enable-interrupts.patch
+usb-cdc-acm-fix-device-unregistration.patch
+usb-serial-fix-interface-refcounting.patch
--- /dev/null
+From cb25505fc604292c70fc02143fc102f54c8595f0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 19 Mar 2013 09:21:06 +0100
+Subject: USB: cdc-acm: fix device unregistration
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit cb25505fc604292c70fc02143fc102f54c8595f0 upstream.
+
+Unregister tty device in disconnect as is required by the USB stack.
+
+By deferring unregistration to when the last tty reference is dropped,
+the parent interface device can get unregistered before the child
+resulting in broken hotplug events being generated when the tty is
+finally closed:
+
+KERNEL[2290.798128] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:3.1 (usb)
+KERNEL[2290.804589] remove /devices/pci0000:00/0000:00:1d.7/usb2/2-1 (usb)
+KERNEL[2294.554799] remove /2-1:3.1/tty/ttyACM0 (tty)
+
+The driver must deal with tty callbacks after disconnect by checking the
+disconnected flag. Specifically, further opens must be prevented and
+this is already implemented.
+
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Cc: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -601,7 +601,6 @@ static void acm_port_destruct(struct tty
+
+ dev_dbg(&acm->control->dev, "%s\n", __func__);
+
+- tty_unregister_device(acm_tty_driver, acm->minor);
+ acm_release_minor(acm);
+ usb_put_intf(acm->control);
+ kfree(acm->country_codes);
+@@ -1418,6 +1417,8 @@ static void acm_disconnect(struct usb_in
+
+ stop_data_traffic(acm);
+
++ tty_unregister_device(acm_tty_driver, acm->minor);
++
+ usb_free_urb(acm->ctrlurb);
+ for (i = 0; i < ACM_NW; i++)
+ usb_free_urb(acm->wb[i].urb);
--- /dev/null
+From d7971051e4df825e0bc11b995e87bfe86355b8e5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Tue, 19 Mar 2013 09:21:09 +0100
+Subject: USB: serial: fix interface refcounting
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit d7971051e4df825e0bc11b995e87bfe86355b8e5 upstream.
+
+Make sure the interface is not released before our serial device.
+
+Note that drivers are still not allowed to access the interface in
+any way that may interfere with another driver that may have gotten
+bound to the same interface after disconnect returns.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -168,6 +168,7 @@ static void destroy_serial(struct kref *
+ }
+ }
+
++ usb_put_intf(serial->interface);
+ usb_put_dev(serial->dev);
+ kfree(serial);
+ }
+@@ -625,7 +626,7 @@ static struct usb_serial *create_serial(
+ }
+ serial->dev = usb_get_dev(dev);
+ serial->type = driver;
+- serial->interface = interface;
++ serial->interface = usb_get_intf(interface);
+ kref_init(&serial->kref);
+ mutex_init(&serial->disc_mutex);
+ serial->minor = SERIAL_TTY_NO_MINOR;
--- /dev/null
+From 29f86e66428ee083aec106cca1748dc63d98ce23 Mon Sep 17 00:00:00 2001
+From: Dmitry Artamonow <mad_soft@inbox.ru>
+Date: Sat, 9 Mar 2013 20:30:58 +0400
+Subject: usb-storage: add unusual_devs entry for Samsung YP-Z3 mp3 player
+
+From: Dmitry Artamonow <mad_soft@inbox.ru>
+
+commit 29f86e66428ee083aec106cca1748dc63d98ce23 upstream.
+
+Device stucks on filesystem writes, unless following quirk is passed:
+ echo 04e8:5136:m > /sys/module/usb_storage/parameters/quirks
+
+Add corresponding entry to unusual_devs.h
+
+Signed-off-by: Dmitry Artamonow <mad_soft@inbox.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
+
++/* Added by Dmitry Artamonow <mad_soft@inbox.ru> */
++UNUSUAL_DEV( 0x04e8, 0x5136, 0x0000, 0x9999,
++ "Samsung",
++ "YP-Z3",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_MAX_SECTORS_64),
++
+ /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
+ * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
+ * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
--- /dev/null
+From 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Mon, 4 Mar 2013 17:14:43 +0100
+Subject: USB: xhci: correctly enable interrupts
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb upstream.
+
+xhci has its own interrupt enabling routine, which will try to
+use MSI-X/MSI if present. So the usb core shouldn't try to enable
+legacy interrupts; on some machines the xhci legacy IRQ setting
+is invalid.
+
+v3: Be careful to not break XHCI_BROKEN_MSI workaround (by trenn)
+
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Oliver Neukum <oneukum@suse.de>
+Cc: Thomas Renninger <trenn@suse.de>
+Cc: Yinghai Lu <yinghai@kernel.org>
+Cc: Frederik Himpe <fhimpe@vub.ac.be>
+Cc: David Haerdeman <david@hardeman.nu>
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reviewed-by: Thomas Renninger <trenn@suse.de>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd-pci.c | 23 ++++++++++++++---------
+ drivers/usb/host/xhci.c | 3 ++-
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/usb/core/hcd-pci.c
++++ b/drivers/usb/core/hcd-pci.c
+@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *de
+ struct hc_driver *driver;
+ struct usb_hcd *hcd;
+ int retval;
++ int hcd_irq = 0;
+
+ if (usb_disabled())
+ return -ENODEV;
+@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *de
+ return -ENODEV;
+ dev->current_state = PCI_D0;
+
+- /* The xHCI driver supports MSI and MSI-X,
+- * so don't fail if the BIOS doesn't provide a legacy IRQ.
++ /*
++ * The xHCI driver has its own irq management
++ * make sure irq setup is not touched for xhci in generic hcd code
+ */
+- if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
+- dev_err(&dev->dev,
+- "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
+- pci_name(dev));
+- retval = -ENODEV;
+- goto disable_pci;
++ if ((driver->flags & HCD_MASK) != HCD_USB3) {
++ if (!dev->irq) {
++ dev_err(&dev->dev,
++ "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
++ pci_name(dev));
++ retval = -ENODEV;
++ goto disable_pci;
++ }
++ hcd_irq = dev->irq;
+ }
+
+ hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
+@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *de
+
+ pci_set_master(dev);
+
+- retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
++ retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
+ if (retval != 0)
+ goto unmap_registers;
+ set_hs_companion(dev, hcd);
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct us
+ * generate interrupts. Don't even try to enable MSI.
+ */
+ if (xhci->quirks & XHCI_BROKEN_MSI)
+- return 0;
++ goto legacy_irq;
+
+ /* unregister the legacy interrupt */
+ if (hcd->irq)
+@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct us
+ return -EINVAL;
+ }
+
++ legacy_irq:
+ /* fall back to legacy interrupt*/
+ ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
+ hcd->irq_descr, hcd);
--- /dev/null
+From f8264340e694604863255cc0276491d17c402390 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dtor@vmware.com>
+Date: Mon, 25 Feb 2013 10:56:01 -0800
+Subject: USB: xhci - fix bit definitions for IMAN register
+
+From: Dmitry Torokhov <dtor@vmware.com>
+
+commit f8264340e694604863255cc0276491d17c402390 upstream.
+
+According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1
+of IMAN register. Previously their definitions were reversed.
+
+Even though there are no ill effects being observed from the swapped
+definitions (because IMAN_IP is RW1C and in legacy PCI case we come in
+with it already set to 1 so it was clearing itself even though we were
+setting IMAN_IE instead of IMAN_IP), we should still correct the values.
+
+This patch should be backported to kernels as old as 2.6.36, that
+contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't
+re-enable IE constantly".
+
+Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -206,8 +206,8 @@ struct xhci_op_regs {
+ /* bits 12:31 are reserved (and should be preserved on writes). */
+
+ /* IMAN - Interrupt Management Register */
+-#define IMAN_IP (1 << 1)
+-#define IMAN_IE (1 << 0)
++#define IMAN_IE (1 << 1)
++#define IMAN_IP (1 << 0)
+
+ /* USBSTS - USB status - status bitmasks */
+ /* HC not running - set to 1 when run/stop bit is cleared. */
--- /dev/null
+From 66db3feb486c01349f767b98ebb10b0c3d2d021b Mon Sep 17 00:00:00 2001
+From: CQ Tang <cq.tang@intel.com>
+Date: Mon, 18 Mar 2013 11:02:21 -0400
+Subject: x86-64: Fix the failure case in copy_user_handle_tail()
+
+From: CQ Tang <cq.tang@intel.com>
+
+commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream.
+
+The increment of "to" in copy_user_handle_tail() will have incremented
+before a failure has been noted. This causes us to skip a byte in the
+failure case.
+
+Only do the increment when assured there is no failure.
+
+Signed-off-by: CQ Tang <cq.tang@intel.com>
+Link: http://lkml.kernel.org/r/20130318150221.8439.993.stgit@phlsvslse11.ph.intel.com
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/lib/usercopy_64.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -120,10 +120,10 @@ copy_user_handle_tail(char *to, char *fr
+ char c;
+ unsigned zero_len;
+
+- for (; len; --len) {
++ for (; len; --len, to++) {
+ if (__get_user_nocheck(c, from++, sizeof(char)))
+ break;
+- if (__put_user_nocheck(c, to++, sizeof(char)))
++ if (__put_user_nocheck(c, to, sizeof(char)))
+ break;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
