--- /dev/null
+From 7dea9665fee828fb56db3bae5b9685d9fa006d33 Mon Sep 17 00:00:00 2001
+From: Matthew Garrett <mjg@redhat.com>
+Date: Sun, 17 Jun 2012 17:05:25 -0400
+Subject: hfsplus: fix bless ioctl when used with hardlinks
+
+From: Matthew Garrett <mjg@redhat.com>
+
+commit 7dea9665fee828fb56db3bae5b9685d9fa006d33 upstream.
+
+HFS+ doesn't really implement hard links - instead, hardlinks are indicated
+by a magic file type which refers to an indirect node in a hidden
+directory. The spec indicates that stat() should return the inode number
+of the indirect node, but it turns out that this doesn't satisfy the
+firmware when it's looking for a bootloader - it wants the catalog ID of
+the hardlink file instead. Fix up this case.
+
+Signed-off-by: Matthew Garrett <mjg@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/hfsplus/ioctl.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/hfsplus/ioctl.c
++++ b/fs/hfsplus/ioctl.c
+@@ -31,6 +31,7 @@ static int hfsplus_ioctl_bless(struct fi
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(inode->i_sb);
+ struct hfsplus_vh *vh = sbi->s_vhdr;
+ struct hfsplus_vh *bvh = sbi->s_backup_vhdr;
++ u32 cnid = (unsigned long)dentry->d_fsdata;
+
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+@@ -41,8 +42,12 @@ static int hfsplus_ioctl_bless(struct fi
+ vh->finder_info[0] = bvh->finder_info[0] =
+ cpu_to_be32(parent_ino(dentry));
+
+- /* Bootloader */
+- vh->finder_info[1] = bvh->finder_info[1] = cpu_to_be32(inode->i_ino);
++ /*
++ * Bootloader. Just using the inode here breaks in the case of
++ * hard links - the firmware wants the ID of the hard link file,
++ * but the inode points at the indirect inode
++ */
++ vh->finder_info[1] = bvh->finder_info[1] = cpu_to_be32(cnid);
+
+ /* Per spec, the OS X system folder - same as finder_info[0] here */
+ vh->finder_info[5] = bvh->finder_info[5] =
--- /dev/null
+From a6dc8c04218eb752ff79cdc24a995cf51866caed Mon Sep 17 00:00:00 2001
+From: Janne Kalliomäki <janne@tuxera.com>
+Date: Sun, 17 Jun 2012 17:05:24 -0400
+Subject: hfsplus: fix overflow in sector calculations in hfsplus_submit_bio
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Janne Kalliomäki <janne@tuxera.com>
+
+commit a6dc8c04218eb752ff79cdc24a995cf51866caed upstream.
+
+The variable io_size was unsigned int, which caused the wrong sector number
+to be calculated after aligning it. This then caused mount to fail with big
+volumes, as backup volume header information was searched from a
+wrong sector.
+
+Signed-off-by: Janne Kalliomäki <janne@tuxera.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/hfsplus/wrapper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -56,7 +56,7 @@ int hfsplus_submit_bio(struct super_bloc
+ DECLARE_COMPLETION_ONSTACK(wait);
+ struct bio *bio;
+ int ret = 0;
+- unsigned int io_size;
++ u64 io_size;
+ loff_t start;
+ int offset;
+
--- /dev/null
+From 62be73eafaa045d3233337303fb140f7f8a61135 Mon Sep 17 00:00:00 2001
+From: Seiji Aguchi <seiji.aguchi@hds.com>
+Date: Tue, 15 May 2012 17:35:09 -0400
+Subject: kdump: Execute kmsg_dump(KMSG_DUMP_PANIC) after smp_send_stop()
+
+From: Seiji Aguchi <seiji.aguchi@hds.com>
+
+commit 62be73eafaa045d3233337303fb140f7f8a61135 upstream.
+
+This patch moves kmsg_dump(KMSG_DUMP_PANIC) below smp_send_stop(),
+to serialize the crash-logging process via smp_send_stop() and to
+thus retrieve a more stable crash image of all CPUs stopped.
+
+Signed-off-by: Seiji Aguchi <seiji.aguchi@hds.com>
+Acked-by: Don Zickus <dzickus@redhat.com>
+Cc: dle-develop@lists.sourceforge.net <dle-develop@lists.sourceforge.net>
+Cc: Satoru Moriya <satoru.moriya@hds.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: a.p.zijlstra@chello.nl <a.p.zijlstra@chello.nl>
+Link: http://lkml.kernel.org/r/5C4C569E8A4B9B42A84A977CF070A35B2E4D7A5CE2@USINDEVS01.corp.hds.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/panic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/panic.c
++++ b/kernel/panic.c
+@@ -108,8 +108,6 @@ void panic(const char *fmt, ...)
+ */
+ crash_kexec(NULL);
+
+- kmsg_dump(KMSG_DUMP_PANIC);
+-
+ /*
+ * Note smp_send_stop is the usual smp shutdown function, which
+ * unfortunately means it may not be hardened to work in a panic
+@@ -117,6 +115,8 @@ void panic(const char *fmt, ...)
+ */
+ smp_send_stop();
+
++ kmsg_dump(KMSG_DUMP_PANIC);
++
+ atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
+
+ bust_spinlocks(0);
--- /dev/null
+From f948501b36c6b3d9352ce212a197098a7e958971 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Fri, 15 Jun 2012 14:51:39 +1000
+Subject: Make hard_irq_disable() actually hard-disable interrupts
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit f948501b36c6b3d9352ce212a197098a7e958971 upstream.
+
+At present, hard_irq_disable() does nothing on powerpc because of
+this code in include/linux/interrupt.h:
+
+ #ifndef hard_irq_disable
+ #define hard_irq_disable() do { } while(0)
+ #endif
+
+So we need to make our hard_irq_disable be a macro. It was previously
+a macro until commit 7230c56441 ("powerpc: Rework lazy-interrupt
+handling") changed it to a static inline function.
+
+Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+--
+ arch/powerpc/include/asm/hw_irq.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/powerpc/include/asm/hw_irq.h
++++ b/arch/powerpc/include/asm/hw_irq.h
+@@ -99,6 +99,9 @@ static inline void hard_irq_disable(void
+ get_paca()->irq_happened |= PACA_IRQ_HARD_DIS;
+ }
+
++/* include/linux/interrupt.h needs hard_irq_disable to be a macro */
++#define hard_irq_disable hard_irq_disable
++
+ /*
+ * This is called by asynchronous interrupts to conditionally
+ * re-enable hard interrupts when soft-disabled after having
usb-option-add-more-yuga-device-ids.patch
usb-option-fix-memory-leak.patch
usb-option-fix-port-data-abuse.patch
+kdump-execute-kmsg_dump-kmsg_dump_panic-after-smp_send_stop.patch
+hfsplus-fix-overflow-in-sector-calculations-in-hfsplus_submit_bio.patch
+hfsplus-fix-bless-ioctl-when-used-with-hardlinks.patch
+make-hard_irq_disable-actually-hard-disable-interrupts.patch
+xhci-fix-invalid-loop-check-in-xhci_free_tt_info.patch
+xhci-don-t-free-endpoints-in-xhci_mem_cleanup.patch
+xhci-increase-the-timeout-for-controller-save-restore-state-operation.patch
+usb-storage-add-090c-1000-to-unusal-devs.patch
--- /dev/null
+From afff07e61a5243e14ee3f0a272a0380cd744a8a3 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 13 Jun 2012 11:44:58 +0200
+Subject: usb-storage: Add 090c:1000 to unusal-devs
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit afff07e61a5243e14ee3f0a272a0380cd744a8a3 upstream.
+
+This device gives a bogus answer to get_capacity(16):
+[ 8628.278614] scsi 8:0:0:0: Direct-Access USB 2.0 USB Flash Drive 1100 PQ: 0 ANSI: 4
+[ 8628.279452] sd 8:0:0:0: Attached scsi generic sg4 type 0
+[ 8628.280338] sd 8:0:0:0: [sdd] 35747322042253313 512-byte logical blocks: (18.3 EB/15.8 EiB)
+
+So set the quirk flag to avoid using get_capacity(16) with it:
+[11731.386014] usb-storage 2-1.6:1.0: Quirks match for vid 090c pid 1000: 80000
+[11731.386075] scsi9 : usb-storage 2-1.6:1.0
+[11731.386172] usbcore: registered new interface driver usb-storage
+[11731.386175] USB Mass Storage support registered.
+[11732.387394] scsi 9:0:0:0: Direct-Access USB 2.0 USB Flash Drive 1100 PQ: 0 ANSI: 4
+[11732.388462] sd 9:0:0:0: Attached scsi generic sg3 type 0
+[11732.389432] sd 9:0:0:0: [sdc] 7975296 512-byte logical blocks: (4.08 GB/3.80 GiB)
+
+Which makes the capacity look a lot more sane :)
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Simon Raffeiner <sturmflut@lieberbiber.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/unusual_devs.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1107,6 +1107,13 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9
+ USB_SC_RBC, USB_PR_BULK, NULL,
+ 0 ),
+
++/* Feiya QDI U2 DISK, reported by Hans de Goede <hdegoede@redhat.com> */
++UNUSUAL_DEV( 0x090c, 0x1000, 0x0000, 0xffff,
++ "Feiya",
++ "QDI U2 DISK",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_READ_CAPACITY_16 ),
++
+ /* aeb */
+ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
+ "Feiya",
--- /dev/null
+From 32f1d2c536d0c26c5814cb0e6a0606c42d02fac1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 1 Jun 2012 10:06:24 +0200
+Subject: xhci: Don't free endpoints in xhci_mem_cleanup()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 32f1d2c536d0c26c5814cb0e6a0606c42d02fac1 upstream.
+
+This patch fixes a few issues introduced in the recent fix
+[f8a9e72d: USB: fix resource leak in xhci power loss path]
+
+- The endpoints listed in bw table are just links and each entry is an
+ array member of dev->eps[]. But the commit above adds a kfree() call
+ to these instances, and thus it results in memory corruption.
+
+- It clears only the first entry of rh_bw[], but there can be multiple
+ ports.
+
+- It'd be safer to clear the list_head of ep as well, not only
+ removing from the list, as it's checked in
+ xhci_discover_or_reset_device().
+
+This patch should be backported to kernels as old as 3.2, that contain
+the commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe "xhci: Store
+information about roothubs and TTs."
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reviewed-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 35 ++++++++++++++---------------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1772,17 +1772,9 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+ {
+ struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
+ struct dev_info *dev_info, *next;
+- struct list_head *tt_list_head;
+- struct list_head *tt;
+- struct list_head *endpoints;
+- struct list_head *ep, *q;
+- struct xhci_tt_bw_info *tt_info;
+- struct xhci_interval_bw_table *bwt;
+- struct xhci_virt_ep *virt_ep;
+-
+ unsigned long flags;
+ int size;
+- int i;
++ int i, j, num_ports;
+
+ /* Free the Event Ring Segment Table and the actual Event Ring */
+ size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
+@@ -1839,21 +1831,22 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+ }
+ spin_unlock_irqrestore(&xhci->lock, flags);
+
+- bwt = &xhci->rh_bw->bw_table;
+- for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
+- endpoints = &bwt->interval_bw[i].endpoints;
+- list_for_each_safe(ep, q, endpoints) {
+- virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
+- list_del(&virt_ep->bw_endpoint_list);
+- kfree(virt_ep);
++ num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
++ for (i = 0; i < num_ports; i++) {
++ struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
++ for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
++ struct list_head *ep = &bwt->interval_bw[j].endpoints;
++ while (!list_empty(ep))
++ list_del_init(ep->next);
+ }
+ }
+
+- tt_list_head = &xhci->rh_bw->tts;
+- list_for_each_safe(tt, q, tt_list_head) {
+- tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
+- list_del(tt);
+- kfree(tt_info);
++ for (i = 0; i < num_ports; i++) {
++ struct xhci_tt_bw_info *tt, *n;
++ list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
++ list_del(&tt->tt_list);
++ kfree(tt);
++ }
+ }
+
+ xhci->num_usb2_ports = 0;
--- /dev/null
+From 46ed8f00d8982e49f8fe2c1a9cea192f640cb3ba Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 1 Jun 2012 10:06:23 +0200
+Subject: xhci: Fix invalid loop check in xhci_free_tt_info()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 46ed8f00d8982e49f8fe2c1a9cea192f640cb3ba upstream.
+
+xhci_free_tt_info() may access the invalid memory when it removes the
+last entry but the list is not empty. Then tt_next reaches to the
+list head but it still tries to check the tt_info of that entry.
+
+This patch fixes the bug and cleans up the messy code by rewriting
+with a simple list_for_each_entry_safe().
+
+This patch should be backported to kernels as old as 3.2, that contain
+the commit 839c817ce67178ca3c7c7ad534c571bba1e69ebe "xhci: Store
+information about roothubs and TTs."
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Reviewed-by: Oliver Neukum <oneukum@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 39 ++++++++++-----------------------------
+ 1 file changed, 10 insertions(+), 29 deletions(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -793,10 +793,9 @@ static void xhci_free_tt_info(struct xhc
+ struct xhci_virt_device *virt_dev,
+ int slot_id)
+ {
+- struct list_head *tt;
+ struct list_head *tt_list_head;
+- struct list_head *tt_next;
+- struct xhci_tt_bw_info *tt_info;
++ struct xhci_tt_bw_info *tt_info, *next;
++ bool slot_found = false;
+
+ /* If the device never made it past the Set Address stage,
+ * it may not have the real_port set correctly.
+@@ -808,34 +807,16 @@ static void xhci_free_tt_info(struct xhc
+ }
+
+ tt_list_head = &(xhci->rh_bw[virt_dev->real_port - 1].tts);
+- if (list_empty(tt_list_head))
+- return;
+-
+- list_for_each(tt, tt_list_head) {
+- tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
+- if (tt_info->slot_id == slot_id)
++ list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
++ /* Multi-TT hubs will have more than one entry */
++ if (tt_info->slot_id == slot_id) {
++ slot_found = true;
++ list_del(&tt_info->tt_list);
++ kfree(tt_info);
++ } else if (slot_found) {
+ break;
++ }
+ }
+- /* Cautionary measure in case the hub was disconnected before we
+- * stored the TT information.
+- */
+- if (tt_info->slot_id != slot_id)
+- return;
+-
+- tt_next = tt->next;
+- tt_info = list_entry(tt, struct xhci_tt_bw_info,
+- tt_list);
+- /* Multi-TT hubs will have more than one entry */
+- do {
+- list_del(tt);
+- kfree(tt_info);
+- tt = tt_next;
+- if (list_empty(tt_list_head))
+- break;
+- tt_next = tt->next;
+- tt_info = list_entry(tt, struct xhci_tt_bw_info,
+- tt_list);
+- } while (tt_info->slot_id == slot_id);
+ }
+
+ int xhci_alloc_tt_info(struct xhci_hcd *xhci,
--- /dev/null
+From 622eb783fe6ff4c1baa47db16c3a5db97f9e6e50 Mon Sep 17 00:00:00 2001
+From: Andiry Xu <andiry.xu@gmail.com>
+Date: Wed, 13 Jun 2012 10:51:57 +0800
+Subject: xHCI: Increase the timeout for controller save/restore state operation
+
+From: Andiry Xu <andiry.xu@gmail.com>
+
+commit 622eb783fe6ff4c1baa47db16c3a5db97f9e6e50 upstream.
+
+When system software decides to power down the xHC with the intent of
+resuming operation at a later time, it will ask xHC to save the internal
+state and restore it when resume to correctly recover from a power event.
+Two bits are used to enable this operation: Save State and Restore State.
+
+xHCI spec 4.23.2 says software should "Set the Controller Save/Restore
+State flag in the USBCMD register and wait for the Save/Restore State
+Status flag in the USBSTS register to transition to '0'". However, it does
+not define how long software should wait for the SSS/RSS bit to transition
+to 0.
+
+Currently the timeout is set to 1ms. There is bug report
+(https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1002697)
+indicates that the timeout is too short for ASMedia ASM1042 host controller
+to save/restore the state successfully. Increase the timeout to 10ms helps to
+resolve the issue.
+
+This patch should be backported to stable kernels as old as 2.6.37, that
+contain the commit 5535b1d5f8885695c6ded783c692e3c0d0eda8ca "USB: xHCI:
+PCI power management implementation"
+
+Signed-off-by: Andiry Xu <andiry.xu@gmail.com>
+Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Cc: Ming Lei <ming.lei@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -795,8 +795,8 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ command = xhci_readl(xhci, &xhci->op_regs->command);
+ command |= CMD_CSS;
+ xhci_writel(xhci, command, &xhci->op_regs->command);
+- if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10*100)) {
+- xhci_warn(xhci, "WARN: xHC CMD_CSS timeout\n");
++ if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10 * 1000)) {
++ xhci_warn(xhci, "WARN: xHC save state timeout\n");
+ spin_unlock_irq(&xhci->lock);
+ return -ETIMEDOUT;
+ }
+@@ -848,8 +848,8 @@ int xhci_resume(struct xhci_hcd *xhci, b
+ command |= CMD_CRS;
+ xhci_writel(xhci, command, &xhci->op_regs->command);
+ if (handshake(xhci, &xhci->op_regs->status,
+- STS_RESTORE, 0, 10*100)) {
+- xhci_dbg(xhci, "WARN: xHC CMD_CSS timeout\n");
++ STS_RESTORE, 0, 10 * 1000)) {
++ xhci_warn(xhci, "WARN: xHC restore state timeout\n");
+ spin_unlock_irq(&xhci->lock);
+ return -ETIMEDOUT;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
