--- /dev/null
+From fed22007113cb857e917913ce016d9b539dc3a80 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 19:17:06 +0000
+Subject: ASoC: Disable register synchronisation for low frequency WM8996 SYSCLK
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit fed22007113cb857e917913ce016d9b539dc3a80 upstream.
+
+With a low frequency SYSCLK and a fast I2C clock register synchronisation
+may occasionally take too long to take effect, causing I/O issues. Disable
+synchronisation in order to avoid any issues.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8996.c | 4 ++++
+ sound/soc/codecs/wm8996.h | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1932,6 +1932,7 @@ static int wm8996_set_sysclk(struct snd_
+ struct wm8996_priv *wm8996 = snd_soc_codec_get_drvdata(codec);
+ int lfclk = 0;
+ int ratediv = 0;
++ int sync = WM8996_REG_SYNC;
+ int src;
+ int old;
+
+@@ -1976,6 +1977,7 @@ static int wm8996_set_sysclk(struct snd_
+ case 32000:
+ case 32768:
+ lfclk = WM8996_LFCLK_ENA;
++ sync = 0;
+ break;
+ default:
+ dev_warn(codec->dev, "Unsupported clock rate %dHz\n",
+@@ -1989,6 +1991,8 @@ static int wm8996_set_sysclk(struct snd_
+ WM8996_SYSCLK_SRC_MASK | WM8996_SYSCLK_DIV_MASK,
+ src << WM8996_SYSCLK_SRC_SHIFT | ratediv);
+ snd_soc_update_bits(codec, WM8996_CLOCKING_1, WM8996_LFCLK_ENA, lfclk);
++ snd_soc_update_bits(codec, WM8996_CONTROL_INTERFACE_1,
++ WM8996_REG_SYNC, sync);
+ snd_soc_update_bits(codec, WM8996_AIF_CLOCKING_1,
+ WM8996_SYSCLK_ENA, old);
+
+--- a/sound/soc/codecs/wm8996.h
++++ b/sound/soc/codecs/wm8996.h
+@@ -1567,6 +1567,10 @@ int wm8996_detect(struct snd_soc_codec *
+ /*
+ * R257 (0x101) - Control Interface (1)
+ */
++#define WM8996_REG_SYNC 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_MASK 0x8000 /* REG_SYNC */
++#define WM8996_REG_SYNC_SHIFT 15 /* REG_SYNC */
++#define WM8996_REG_SYNC_WIDTH 1 /* REG_SYNC */
+ #define WM8996_AUTO_INC 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_MASK 0x0004 /* AUTO_INC */
+ #define WM8996_AUTO_INC_SHIFT 2 /* AUTO_INC */
--- /dev/null
+From 495174a8ffbaa0d15153d855cf206cdc46d51cf4 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Thu, 19 Jan 2012 11:16:37 +0000
+Subject: ASoC: Don't go through cache when applying WM5100 rev A updates
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit 495174a8ffbaa0d15153d855cf206cdc46d51cf4 upstream.
+
+These are all to either uncached registers or fixes to register defaults,
+in the former case the cache won't do anything and in the latter case
+we're fixing things so the cache sync will do the right thing.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm5100.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1379,6 +1379,7 @@ static int wm5100_set_bias_level(struct
+
+ switch (wm5100->rev) {
+ case 0:
++ regcache_cache_bypass(wm5100->regmap, true);
+ snd_soc_write(codec, 0x11, 0x3);
+ snd_soc_write(codec, 0x203, 0xc);
+ snd_soc_write(codec, 0x206, 0);
+@@ -1394,6 +1395,7 @@ static int wm5100_set_bias_level(struct
+ snd_soc_write(codec,
+ wm5100_reva_patches[i].reg,
+ wm5100_reva_patches[i].val);
++ regcache_cache_bypass(wm5100->regmap, false);
+ break;
+ default:
+ break;
--- /dev/null
+From e53e417331c57b9b97e3f8be870214a02c99265c Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Wed, 18 Jan 2012 20:02:38 +0000
+Subject: ASoC: Mark WM5100 register map cache only when going into BIAS_OFF
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit e53e417331c57b9b97e3f8be870214a02c99265c upstream.
+
+Writing to the registers won't work if we do actually manage to hit a fully
+powered off state.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm5100.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/wm5100.c
++++ b/sound/soc/codecs/wm5100.c
+@@ -1404,6 +1404,7 @@ static int wm5100_set_bias_level(struct
+ break;
+
+ case SND_SOC_BIAS_OFF:
++ regcache_cache_only(wm5100->regmap, true);
+ if (wm5100->pdata.ldo_ena)
+ gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
+ regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
--- /dev/null
+From a14304edcd5e8323205db34b08f709feb5357e64 Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Date: Sat, 21 Jan 2012 21:48:53 +0000
+Subject: ASoC: wm8996: Call _POST_PMU callback for CPVDD
+
+From: Mark Brown <broonie@opensource.wolfsonmicro.com>
+
+commit a14304edcd5e8323205db34b08f709feb5357e64 upstream.
+
+We should be allowing a 5ms delay after the charge pump is started in
+order to ensure it has finished ramping.
+
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/soc/codecs/wm8996.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8996.c
++++ b/sound/soc/codecs/wm8996.c
+@@ -1049,7 +1049,8 @@ SND_SOC_DAPM_SUPPLY_S("SYSCLK", 1, WM899
+ SND_SOC_DAPM_SUPPLY_S("SYSDSPCLK", 2, WM8996_CLOCKING_1, 1, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("AIFCLK", 2, WM8996_CLOCKING_1, 2, 0, NULL, 0),
+ SND_SOC_DAPM_SUPPLY_S("Charge Pump", 2, WM8996_CHARGE_PUMP_1, 15, 0, cp_event,
+- SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
++ SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("Bandgap", SND_SOC_NOPM, 0, 0, bg_event,
+ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+ SND_SOC_DAPM_SUPPLY("LDO2", WM8996_POWER_MANAGEMENT_2, 1, 0, NULL, 0),
--- /dev/null
+From f96b08a7e6f69c0f0a576554df3df5b1b519c479 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Tue, 17 Jan 2012 12:38:50 +0100
+Subject: brcmsmac: fix tx queue flush infinite loop
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+commit f96b08a7e6f69c0f0a576554df3df5b1b519c479 upstream.
+
+This patch workaround live deadlock problem caused by infinite loop
+in brcms_c_wait_for_tx_completion(). I do not consider the patch as
+the proper fix, which should fix the real reason of tx queue flush
+failure, but patch helps with system lockup.
+
+Reference:
+https://bugzilla.kernel.org/show_bug.cgi?id=42576
+
+Reported-and-tested-by: Patrick <ragamuffin@datacomm.ch>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/brcm80211/brcmsmac/main.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
+@@ -8217,13 +8217,21 @@ int brcms_c_get_curband(struct brcms_c_i
+
+ void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+ {
++ int timeout = 20;
++
+ /* flush packet queue when requested */
+ if (drop)
+ brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL);
+
+ /* wait for queue and DMA fifos to run dry */
+- while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0)
++ while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) {
+ brcms_msleep(wlc->wl, 1);
++
++ if (--timeout == 0)
++ break;
++ }
++
++ WARN_ON_ONCE(timeout == 0);
+ }
+
+ void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
--- /dev/null
+From 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Sat, 14 Jan 2012 21:27:37 +0300
+Subject: crypto: sha512 - make it work, undo percpu message schedule
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 84e31fdb7c797a7303e0cc295cb9bc8b73fb872d upstream.
+
+commit f9e2bca6c22d75a289a349f869701214d63b5060
+aka "crypto: sha512 - Move message schedule W[80] to static percpu area"
+created global message schedule area.
+
+If sha512_update will ever be entered twice, hash will be silently
+calculated incorrectly.
+
+Probably the easiest way to notice incorrect hashes being calculated is
+to run 2 ping floods over AH with hmac(sha512):
+
+ #!/usr/sbin/setkey -f
+ flush;
+ spdflush;
+ add IP1 IP2 ah 25 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025;
+ add IP2 IP1 ah 52 -A hmac-sha512 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052;
+ spdadd IP1 IP2 any -P out ipsec ah/transport//require;
+ spdadd IP2 IP1 any -P in ipsec ah/transport//require;
+
+XfrmInStateProtoError will start ticking with -EBADMSG being returned
+from ah_input(). This never happens with, say, hmac(sha1).
+
+With patch applied (on BOTH sides), XfrmInStateProtoError does not tick
+with multiple bidirectional ping flood streams like it doesn't tick
+with SHA-1.
+
+After this patch sha512_transform() will start using ~750 bytes of stack on x86_64.
+This is OK for simple loads, for something more heavy, stack reduction will be done
+separatedly.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/sha512_generic.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -21,8 +21,6 @@
+ #include <linux/percpu.h>
+ #include <asm/byteorder.h>
+
+-static DEFINE_PER_CPU(u64[80], msg_schedule);
+-
+ static inline u64 Ch(u64 x, u64 y, u64 z)
+ {
+ return z ^ (x & (y ^ z));
+@@ -89,7 +87,7 @@ sha512_transform(u64 *state, const u8 *i
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 *W = get_cpu_var(msg_schedule);
++ u64 W[80];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+@@ -128,8 +126,6 @@ sha512_transform(u64 *state, const u8 *i
+
+ /* erase our data */
+ a = b = c = d = e = f = g = h = t1 = t2 = 0;
+- memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
+- put_cpu_var(msg_schedule);
+ }
+
+ static int
--- /dev/null
+From 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Sat, 14 Jan 2012 21:40:57 +0300
+Subject: crypto: sha512 - reduce stack usage to safe number
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit 51fc6dc8f948047364f7d42a4ed89b416c6cc0a3 upstream.
+
+For rounds 16--79, W[i] only depends on W[i - 2], W[i - 7], W[i - 15] and W[i - 16].
+Consequently, keeping all W[80] array on stack is unnecessary,
+only 16 values are really needed.
+
+Using W[16] instead of W[80] greatly reduces stack usage
+(~750 bytes to ~340 bytes on x86_64).
+
+Line by line explanation:
+* BLEND_OP
+ array is "circular" now, all indexes have to be modulo 16.
+ Round number is positive, so remainder operation should be
+ without surprises.
+
+* initial full message scheduling is trimmed to first 16 values which
+ come from data block, the rest is calculated before it's needed.
+
+* original loop body is unrolled version of new SHA512_0_15 and
+ SHA512_16_79 macros, unrolling was done to not do explicit variable
+ renaming. Otherwise it's the very same code after preprocessing.
+ See sha1_transform() code which does the same trick.
+
+Patch survives in-tree crypto test and original bugreport test
+(ping flood with hmac(sha512).
+
+See FIPS 180-2 for SHA-512 definition
+http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ crypto/sha512_generic.c | 58 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 34 insertions(+), 24 deletions(-)
+
+--- a/crypto/sha512_generic.c
++++ b/crypto/sha512_generic.c
+@@ -78,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W
+
+ static inline void BLEND_OP(int I, u64 *W)
+ {
+- W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
++ W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
+ }
+
+ static void
+@@ -87,38 +87,48 @@ sha512_transform(u64 *state, const u8 *i
+ u64 a, b, c, d, e, f, g, h, t1, t2;
+
+ int i;
+- u64 W[80];
++ u64 W[16];
+
+ /* load the input */
+ for (i = 0; i < 16; i++)
+ LOAD_OP(i, W, input);
+
+- for (i = 16; i < 80; i++) {
+- BLEND_OP(i, W);
+- }
+-
+ /* load the state into our registers */
+ a=state[0]; b=state[1]; c=state[2]; d=state[3];
+ e=state[4]; f=state[5]; g=state[6]; h=state[7];
+
+- /* now iterate */
+- for (i=0; i<80; i+=8) {
+- t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i ] + W[i ];
+- t2 = e0(a) + Maj(a,b,c); d+=t1; h=t1+t2;
+- t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
+- t2 = e0(h) + Maj(h,a,b); c+=t1; g=t1+t2;
+- t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
+- t2 = e0(g) + Maj(g,h,a); b+=t1; f=t1+t2;
+- t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
+- t2 = e0(f) + Maj(f,g,h); a+=t1; e=t1+t2;
+- t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
+- t2 = e0(e) + Maj(e,f,g); h+=t1; d=t1+t2;
+- t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
+- t2 = e0(d) + Maj(d,e,f); g+=t1; c=t1+t2;
+- t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
+- t2 = e0(c) + Maj(c,d,e); f+=t1; b=t1+t2;
+- t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
+- t2 = e0(b) + Maj(b,c,d); e+=t1; a=t1+t2;
++#define SHA512_0_15(i, a, b, c, d, e, f, g, h) \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++#define SHA512_16_79(i, a, b, c, d, e, f, g, h) \
++ BLEND_OP(i, W); \
++ t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16]; \
++ t2 = e0(a) + Maj(a, b, c); \
++ d += t1; \
++ h = t1 + t2
++
++ for (i = 0; i < 16; i += 8) {
++ SHA512_0_15(i, a, b, c, d, e, f, g, h);
++ SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
++ }
++ for (i = 16; i < 80; i += 8) {
++ SHA512_16_79(i, a, b, c, d, e, f, g, h);
++ SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
++ SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
++ SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
++ SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
++ SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
++ SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
++ SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
+ }
+
+ state[0] += a; state[1] += b; state[2] += c; state[3] += d;
--- /dev/null
+From 353b67d8ced4dc53281c88150ad295e24bc4b4c5 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Sat, 26 Nov 2011 00:35:39 +0100
+Subject: jbd: Issue cache flush after checkpointing
+
+From: Jan Kara <jack@suse.cz>
+
+commit 353b67d8ced4dc53281c88150ad295e24bc4b4c5 upstream.
+
+When we reach cleanup_journal_tail(), there is no guarantee that
+checkpointed buffers are on a stable storage - especially if buffers were
+written out by log_do_checkpoint(), they are likely to be only in disk's
+caches. Thus when we update journal superblock, effectively removing old
+transaction from journal, this write of superblock can get to stable storage
+before those checkpointed buffers which can result in filesystem corruption
+after a crash.
+
+A similar problem can happen if we replay the journal and wipe it before
+flushing disk's caches.
+
+Thus we must unconditionally issue a cache flush before we update journal
+superblock in these cases. The fix is slightly complicated by the fact that we
+have to get log tail before we issue cache flush but we can store it in the
+journal superblock only after the cache flush. Otherwise we risk races where
+new tail is written before appropriate cache flush is finished.
+
+I managed to reproduce the corruption using somewhat tweaked Chris Mason's
+barrier-test scheduler. Also this should fix occasional reports of 'Bit already
+freed' filesystem errors which are totally unreproducible but inspection of
+several fs images I've gathered over time points to a problem like this.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd/checkpoint.c | 27 ++++++++++++++++++++++-----
+ fs/jbd/recovery.c | 4 ++++
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd/checkpoint.c
++++ b/fs/jbd/checkpoint.c
+@@ -453,8 +453,6 @@ out:
+ *
+ * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
+ *
+- * Called with the journal lock held.
+- *
+ * This is the only part of the journaling code which really needs to be
+ * aware of transaction aborts. Checkpointing involves writing to the
+ * main filesystem area rather than to the journal, so it can proceed
+@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *jour
+ if (is_journal_aborted(journal))
+ return 1;
+
+- /* OK, work out the oldest transaction remaining in the log, and
++ /*
++ * OK, work out the oldest transaction remaining in the log, and
+ * the log block it starts at.
+ *
+ * If the log is now empty, we need to work out which is the
+ * next transaction ID we will write, and where it will
+- * start. */
+-
++ * start.
++ */
+ spin_lock(&journal->j_state_lock);
+ spin_lock(&journal->j_list_lock);
+ transaction = journal->j_checkpoint_transactions;
+@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *jour
+ spin_unlock(&journal->j_state_lock);
+ return 1;
+ }
++ spin_unlock(&journal->j_state_lock);
++
++ /*
++ * We need to make sure that any blocks that were recently written out
++ * --- perhaps by log_do_checkpoint() --- are flushed out before we
++ * drop the transactions from the journal. It's unlikely this will be
++ * necessary, especially with an appropriately sized journal, but we
++ * need this to guarantee correctness. Fortunately
++ * cleanup_journal_tail() doesn't get called all that often.
++ */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
++ spin_lock(&journal->j_state_lock);
++ if (!tid_gt(first_tid, journal->j_tail_sequence)) {
++ spin_unlock(&journal->j_state_lock);
++ /* Someone else cleaned up journal so return 0 */
++ return 0;
++ }
+ /* OK, update the superblock to recover the freed space.
+ * Physical blocks come first: have we wrapped beyond the end of
+ * the log? */
+--- a/fs/jbd/recovery.c
++++ b/fs/jbd/recovery.c
+@@ -20,6 +20,7 @@
+ #include <linux/fs.h>
+ #include <linux/jbd.h>
+ #include <linux/errno.h>
++#include <linux/blkdev.h>
+ #endif
+
+ /*
+@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal)
+ err2 = sync_blockdev(journal->j_fs_dev);
+ if (!err)
+ err = err2;
++ /* Flush disk caches to get replayed data on the permanent storage */
++ if (journal->j_flags & JFS_BARRIER)
++ blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
+
+ return err;
+ }
--- /dev/null
+From bc4934bc61d0a11fd62c5187ff83645628f8be8b Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 18 Jan 2012 14:10:25 +0100
+Subject: mac80211: fix work removal on deauth request
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit bc4934bc61d0a11fd62c5187ff83645628f8be8b upstream.
+
+When deauth is requested while an auth or assoc
+work item is in progress, we currently delete it
+without regard for any state it might need to
+clean up. Fix it by cleaning up for those items.
+
+In the case Pontus found, the problem manifested
+itself as such:
+
+authenticate with 00:23:69:aa:dd:7b (try 1)
+authenticated
+failed to insert Dummy STA entry for the AP (error -17)
+deauthenticating from 00:23:69:aa:dd:7b by local choice (reason=2)
+
+It could also happen differently if the driver
+uses the tx_sync callback.
+
+We can't just call the ->done() method of the work
+items because that will lock up due to the locking
+in cfg80211. This fix isn't very clean, but that
+seems acceptable since I have patches pending to
+remove this code completely.
+
+Reported-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Tested-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/mac80211/mlme.c | 38 +++++++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 11 deletions(-)
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2719,7 +2719,6 @@ int ieee80211_mgd_deauth(struct ieee8021
+ {
+ struct ieee80211_local *local = sdata->local;
+ struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+- struct ieee80211_work *wk;
+ u8 bssid[ETH_ALEN];
+ bool assoc_bss = false;
+
+@@ -2732,30 +2731,47 @@ int ieee80211_mgd_deauth(struct ieee8021
+ assoc_bss = true;
+ } else {
+ bool not_auth_yet = false;
++ struct ieee80211_work *tmp, *wk = NULL;
+
+ mutex_unlock(&ifmgd->mtx);
+
+ mutex_lock(&local->mtx);
+- list_for_each_entry(wk, &local->work_list, list) {
+- if (wk->sdata != sdata)
++ list_for_each_entry(tmp, &local->work_list, list) {
++ if (tmp->sdata != sdata)
+ continue;
+
+- if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
+- wk->type != IEEE80211_WORK_AUTH &&
+- wk->type != IEEE80211_WORK_ASSOC &&
+- wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
++ if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
++ tmp->type != IEEE80211_WORK_AUTH &&
++ tmp->type != IEEE80211_WORK_ASSOC &&
++ tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
+ continue;
+
+- if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
++ if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
+ continue;
+
+- not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
+- list_del_rcu(&wk->list);
+- free_work(wk);
++ not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
++ list_del_rcu(&tmp->list);
++ synchronize_rcu();
++ wk = tmp;
+ break;
+ }
+ mutex_unlock(&local->mtx);
+
++ if (wk && wk->type == IEEE80211_WORK_ASSOC) {
++ /* clean up dummy sta & TX sync */
++ sta_info_destroy_addr(wk->sdata, wk->filter_ta);
++ if (wk->assoc.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_ASSOC);
++ } else if (wk && wk->type == IEEE80211_WORK_AUTH) {
++ if (wk->probe_auth.synced)
++ drv_finish_tx_sync(local, wk->sdata,
++ wk->filter_ta,
++ IEEE80211_TX_SYNC_AUTH);
++ }
++ kfree(wk);
++
+ /*
+ * If somebody requests authentication and we haven't
+ * sent out an auth frame yet there's no need to send
drm-radeon-kms-rework-modeset-sequence-for-dce41-and-dce5.patch
drm-fix-authentication-kernel-crash.patch
xfs-fix-missing-xfs_iunlock-on-error-recovery-path-in-xfs_readlink.patch
+asoc-mark-wm5100-register-map-cache-only-when-going-into-bias_off.patch
+asoc-disable-register-synchronisation-for-low-frequency-wm8996-sysclk.patch
+asoc-don-t-go-through-cache-when-applying-wm5100-rev-a-updates.patch
+asoc-wm8996-call-_post_pmu-callback-for-cpvdd.patch
+brcmsmac-fix-tx-queue-flush-infinite-loop.patch
+mac80211-fix-work-removal-on-deauth-request.patch
+jbd-issue-cache-flush-after-checkpointing.patch
+crypto-sha512-make-it-work-undo-percpu-message-schedule.patch
+crypto-sha512-reduce-stack-usage-to-safe-number.patch
+tpm_tis-add-delay-after-aborting-command.patch
--- /dev/null
+From a927b8131794ee449b7f6666e7ab61301949b20f Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Date: Fri, 11 Nov 2011 12:57:06 -0500
+Subject: tpm_tis: add delay after aborting command
+
+From: Stefan Berger <stefanb@linux.vnet.ibm.com>
+
+commit a927b8131794ee449b7f6666e7ab61301949b20f upstream.
+
+This patch adds a delay after aborting a command. Some TPMs need
+this and will not process the subsequent command correctly otherwise.
+
+It's worth noting that a TPM randomly failing to process a command,
+maps to randomly failing suspend/resume operations.
+
+Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm_tis.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -432,6 +432,9 @@ static int probe_itpm(struct tpm_chip *c
+ out:
+ itpm = rem_itpm;
+ tpm_tis_ready(chip);
++ /* some TPMs need a break here otherwise they will not work
++ * correctly on the immediately subsequent command */
++ msleep(chip->vendor.timeout_b);
+ release_locality(chip, chip->vendor.locality, 0);
+
+ return rc;
projects / thirdparty / kernel / stable-queue.git / commitdiff
