From: Greg Kroah-Hartman Date: Thu, 22 Mar 2012 22:30:44 +0000 (-0700) Subject: 3.3-stable patches X-Git-Tag: v3.0.26~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=93bf4f1419dc86dc376226c5315ada9aad57db5b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.3-stable patches added patches: alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch asoc-pxa-ssp-atomically-set-stream-active-masks.patch bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch tcm_loop-set-residual-field-for-scsi-commands.patch --- diff --git a/queue-3.3/alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch b/queue-3.3/alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch new file mode 100644 index 00000000000..859c1bd78cf --- /dev/null +++ b/queue-3.3/alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch @@ -0,0 +1,41 @@ +From 25dc16f69892182192b1234594fd3cf342ad4195 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Tue, 13 Mar 2012 17:43:02 +0200 +Subject: ALSA: hda - fix printing of high HDMI sample rates + +From: Anssi Hannula + +commit 25dc16f69892182192b1234594fd3cf342ad4195 upstream. + +A previous commit af65cbf296 (ALSA: hdmi: fix printout of SAD sampling +rates) fixed the sample rates shown in /proc/asound/cardX/eldY and +kernel log to not be entirely wrong. However, a missing rate from the +array added in the patch causes HDMI rates 88.2 kHz, 96 kHz, 176.4 kHz, +and 192 kHz to be shown as 96 kHz, 176.4 kHz, 192 kHz, and 384 kHz, +respectively. + +Fix the reporting by adding the ALSA rate 64 kHz into the conversion +array between 48 kHz and 88.2 kHz. + +Signed-off-by: Anssi Hannula +Cc: Pierre-Louis Bossart +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_eld.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_eld.c ++++ b/sound/pci/hda/hda_eld.c +@@ -385,8 +385,8 @@ error: + static void hdmi_print_pcm_rates(int pcm, char *buf, int buflen) + { + static unsigned int alsa_rates[] = { +- 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, 88200, +- 96000, 176400, 192000, 384000 ++ 5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, ++ 88200, 96000, 176400, 192000, 384000 + }; + int i, j; + diff --git a/queue-3.3/asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch b/queue-3.3/asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch new file mode 100644 index 00000000000..82750d7f09b --- /dev/null +++ b/queue-3.3/asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch @@ -0,0 +1,86 @@ +From 70ac07bb633dee75ac554195b9a4d69adfa7803c Mon Sep 17 00:00:00 2001 +From: Timur Tabi +Date: Fri, 16 Mar 2012 16:32:52 -0500 +Subject: ASoC: fsl: p1022ds: tell the WM8776 codec driver that it's the master + +From: Timur Tabi + +commit 70ac07bb633dee75ac554195b9a4d69adfa7803c upstream. + +The WM8776 codec driver requires the machine driver to set one of the +SND_SOC_DAIFMT_CBx_xxx values. The P1022DS machine driver should be setting +SND_SOC_DAIFMT_CBM_CFM, but since that value was zero, no one noticed. + +Commit 75d9ac46 ("ASoC: Allow DAI formats to be specified in the +dai_link"), however, changed the value of SND_SOC_DAIFMT_CBM_CFM from zero +to a non-zero value, which means that it now needs to be specifically set +by the machine driver. + +We also set SND_SOC_DAIFMT_NB_NF, for the same reason. + +Signed-off-by: Timur Tabi +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/fsl/p1022_ds.c | 24 ++++++++++++++++-------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +--- a/sound/soc/fsl/p1022_ds.c ++++ b/sound/soc/fsl/p1022_ds.c +@@ -395,7 +395,8 @@ static int p1022_ds_probe(struct platfor + } + + if (strcasecmp(sprop, "i2s-slave") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_I2S; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBM_CFM; + mdata->codec_clk_direction = SND_SOC_CLOCK_OUT; + mdata->cpu_clk_direction = SND_SOC_CLOCK_IN; + +@@ -412,31 +413,38 @@ static int p1022_ds_probe(struct platfor + } + mdata->clk_frequency = be32_to_cpup(iprop); + } else if (strcasecmp(sprop, "i2s-master") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_I2S; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_CBS_CFS; + mdata->codec_clk_direction = SND_SOC_CLOCK_IN; + mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT; + } else if (strcasecmp(sprop, "lj-slave") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_LEFT_J; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBM_CFM; + mdata->codec_clk_direction = SND_SOC_CLOCK_OUT; + mdata->cpu_clk_direction = SND_SOC_CLOCK_IN; + } else if (strcasecmp(sprop, "lj-master") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_LEFT_J; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_LEFT_J | SND_SOC_DAIFMT_CBS_CFS; + mdata->codec_clk_direction = SND_SOC_CLOCK_IN; + mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT; + } else if (strcasecmp(sprop, "rj-slave") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_RIGHT_J; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBM_CFM; + mdata->codec_clk_direction = SND_SOC_CLOCK_OUT; + mdata->cpu_clk_direction = SND_SOC_CLOCK_IN; + } else if (strcasecmp(sprop, "rj-master") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_RIGHT_J; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_RIGHT_J | SND_SOC_DAIFMT_CBS_CFS; + mdata->codec_clk_direction = SND_SOC_CLOCK_IN; + mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT; + } else if (strcasecmp(sprop, "ac97-slave") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_AC97; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBM_CFM; + mdata->codec_clk_direction = SND_SOC_CLOCK_OUT; + mdata->cpu_clk_direction = SND_SOC_CLOCK_IN; + } else if (strcasecmp(sprop, "ac97-master") == 0) { +- mdata->dai_format = SND_SOC_DAIFMT_AC97; ++ mdata->dai_format = SND_SOC_DAIFMT_NB_NF | ++ SND_SOC_DAIFMT_AC97 | SND_SOC_DAIFMT_CBS_CFS; + mdata->codec_clk_direction = SND_SOC_CLOCK_IN; + mdata->cpu_clk_direction = SND_SOC_CLOCK_OUT; + } else { diff --git a/queue-3.3/asoc-pxa-ssp-atomically-set-stream-active-masks.patch b/queue-3.3/asoc-pxa-ssp-atomically-set-stream-active-masks.patch new file mode 100644 index 00000000000..e882014c470 --- /dev/null +++ b/queue-3.3/asoc-pxa-ssp-atomically-set-stream-active-masks.patch @@ -0,0 +1,120 @@ +From 273b72c8ce6b28df6b49423d775c3e59072c73c5 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Mon, 19 Mar 2012 09:12:53 +0100 +Subject: ASoC: pxa-ssp: atomically set stream active masks + +From: Daniel Mack + +commit 273b72c8ce6b28df6b49423d775c3e59072c73c5 upstream. + +PXA's SSP engine fails to take its current channel phase into account +when enabling a stream while the engine is already running. This +results in randomly swapped left/right channels on either the record +or the playback side, depending on which one was enabled first. + +The following patch fixes this by factoring out the bit field +modifications in question to a separate function that pauses the +engine temporarily, modifies the bits and kicks it off again +afterwards. Appearantly, a transition of SSCR0_SSE syncs both +directions properly. + +The patch has been rolled out to quite a number of devices over the +last weeks and seems to fix the issue reliably. + +Signed-off-by: Daniel Mack +Reported-and-tested-by: Sven Neumann +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/pxa/pxa-ssp.c | 61 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 36 insertions(+), 25 deletions(-) + +--- a/sound/soc/pxa/pxa-ssp.c ++++ b/sound/soc/pxa/pxa-ssp.c +@@ -668,6 +668,38 @@ static int pxa_ssp_hw_params(struct snd_ + return 0; + } + ++static void pxa_ssp_set_running_bit(struct snd_pcm_substream *substream, ++ struct ssp_device *ssp, int value) ++{ ++ uint32_t sscr0 = pxa_ssp_read_reg(ssp, SSCR0); ++ uint32_t sscr1 = pxa_ssp_read_reg(ssp, SSCR1); ++ uint32_t sspsp = pxa_ssp_read_reg(ssp, SSPSP); ++ uint32_t sssr = pxa_ssp_read_reg(ssp, SSSR); ++ ++ if (value && (sscr0 & SSCR0_SSE)) ++ pxa_ssp_write_reg(ssp, SSCR0, sscr0 & ~SSCR0_SSE); ++ ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { ++ if (value) ++ sscr1 |= SSCR1_TSRE; ++ else ++ sscr1 &= ~SSCR1_TSRE; ++ } else { ++ if (value) ++ sscr1 |= SSCR1_RSRE; ++ else ++ sscr1 &= ~SSCR1_RSRE; ++ } ++ ++ pxa_ssp_write_reg(ssp, SSCR1, sscr1); ++ ++ if (value) { ++ pxa_ssp_write_reg(ssp, SSSR, sssr); ++ pxa_ssp_write_reg(ssp, SSPSP, sspsp); ++ pxa_ssp_write_reg(ssp, SSCR0, sscr0 | SSCR0_SSE); ++ } ++} ++ + static int pxa_ssp_trigger(struct snd_pcm_substream *substream, int cmd, + struct snd_soc_dai *cpu_dai) + { +@@ -681,42 +713,21 @@ static int pxa_ssp_trigger(struct snd_pc + pxa_ssp_enable(ssp); + break; + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: +- val = pxa_ssp_read_reg(ssp, SSCR1); +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- val |= SSCR1_TSRE; +- else +- val |= SSCR1_RSRE; +- pxa_ssp_write_reg(ssp, SSCR1, val); ++ pxa_ssp_set_running_bit(substream, ssp, 1); + val = pxa_ssp_read_reg(ssp, SSSR); + pxa_ssp_write_reg(ssp, SSSR, val); + break; + case SNDRV_PCM_TRIGGER_START: +- val = pxa_ssp_read_reg(ssp, SSCR1); +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- val |= SSCR1_TSRE; +- else +- val |= SSCR1_RSRE; +- pxa_ssp_write_reg(ssp, SSCR1, val); +- pxa_ssp_enable(ssp); ++ pxa_ssp_set_running_bit(substream, ssp, 1); + break; + case SNDRV_PCM_TRIGGER_STOP: +- val = pxa_ssp_read_reg(ssp, SSCR1); +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- val &= ~SSCR1_TSRE; +- else +- val &= ~SSCR1_RSRE; +- pxa_ssp_write_reg(ssp, SSCR1, val); ++ pxa_ssp_set_running_bit(substream, ssp, 0); + break; + case SNDRV_PCM_TRIGGER_SUSPEND: + pxa_ssp_disable(ssp); + break; + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +- val = pxa_ssp_read_reg(ssp, SSCR1); +- if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) +- val &= ~SSCR1_TSRE; +- else +- val &= ~SSCR1_RSRE; +- pxa_ssp_write_reg(ssp, SSCR1, val); ++ pxa_ssp_set_running_bit(substream, ssp, 0); + break; + + default: diff --git a/queue-3.3/bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch b/queue-3.3/bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch new file mode 100644 index 00000000000..a4cdadb1d96 --- /dev/null +++ b/queue-3.3/bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch @@ -0,0 +1,142 @@ +From f5bf18fa22f8c41a13eb8762c7373eb3a93a7333 Mon Sep 17 00:00:00 2001 +From: Nishanth Aravamudan +Date: Wed, 21 Mar 2012 16:34:07 -0700 +Subject: bootmem/sparsemem: remove limit constraint in alloc_bootmem_section + +From: Nishanth Aravamudan + +commit f5bf18fa22f8c41a13eb8762c7373eb3a93a7333 upstream. + +While testing AMS (Active Memory Sharing) / CMO (Cooperative Memory +Overcommit) on powerpc, we tripped the following: + + kernel BUG at mm/bootmem.c:483! + cpu 0x0: Vector: 700 (Program Check) at [c000000000c03940] + pc: c000000000a62bd8: .alloc_bootmem_core+0x90/0x39c + lr: c000000000a64bcc: .sparse_early_usemaps_alloc_node+0x84/0x29c + sp: c000000000c03bc0 + msr: 8000000000021032 + current = 0xc000000000b0cce0 + paca = 0xc000000001d80000 + pid = 0, comm = swapper + kernel BUG at mm/bootmem.c:483! + enter ? for help + [c000000000c03c80] c000000000a64bcc + .sparse_early_usemaps_alloc_node+0x84/0x29c + [c000000000c03d50] c000000000a64f10 .sparse_init+0x12c/0x28c + [c000000000c03e20] c000000000a474f4 .setup_arch+0x20c/0x294 + [c000000000c03ee0] c000000000a4079c .start_kernel+0xb4/0x460 + [c000000000c03f90] c000000000009670 .start_here_common+0x1c/0x2c + +This is + + BUG_ON(limit && goal + size > limit); + +and after some debugging, it seems that + + goal = 0x7ffff000000 + limit = 0x80000000000 + +and sparse_early_usemaps_alloc_node -> +sparse_early_usemaps_alloc_pgdat_section calls + + return alloc_bootmem_section(usemap_size() * count, section_nr); + +This is on a system with 8TB available via the AMS pool, and as a quirk +of AMS in firmware, all of that memory shows up in node 0. So, we end +up with an allocation that will fail the goal/limit constraints. + +In theory, we could "fall-back" to alloc_bootmem_node() in +sparse_early_usemaps_alloc_node(), but since we actually have HOTREMOVE +defined, we'll BUG_ON() instead. A simple solution appears to be to +unconditionally remove the limit condition in alloc_bootmem_section, +meaning allocations are allowed to cross section boundaries (necessary +for systems of this size). + +Johannes Weiner pointed out that if alloc_bootmem_section() no longer +guarantees section-locality, we need check_usemap_section_nr() to print +possible cross-dependencies between node descriptors and the usemaps +allocated through it. That makes the two loops in +sparse_early_usemaps_alloc_node() identical, so re-factor the code a +bit. + +[akpm@linux-foundation.org: code simplification] +Signed-off-by: Nishanth Aravamudan +Cc: Dave Hansen +Cc: Anton Blanchard +Cc: Paul Mackerras +Cc: Ben Herrenschmidt +Cc: Robert Jennings +Acked-by: Johannes Weiner +Acked-by: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/bootmem.c | 5 ++--- + mm/sparse.c | 30 +++++++++++------------------- + 2 files changed, 13 insertions(+), 22 deletions(-) + +--- a/mm/bootmem.c ++++ b/mm/bootmem.c +@@ -766,14 +766,13 @@ void * __init alloc_bootmem_section(unsi + unsigned long section_nr) + { + bootmem_data_t *bdata; +- unsigned long pfn, goal, limit; ++ unsigned long pfn, goal; + + pfn = section_nr_to_pfn(section_nr); + goal = pfn << PAGE_SHIFT; +- limit = section_nr_to_pfn(section_nr + 1) << PAGE_SHIFT; + bdata = &bootmem_node_data[early_pfn_to_nid(pfn)]; + +- return alloc_bootmem_core(bdata, size, SMP_CACHE_BYTES, goal, limit); ++ return alloc_bootmem_core(bdata, size, SMP_CACHE_BYTES, goal, 0); + } + #endif + +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -353,29 +353,21 @@ static void __init sparse_early_usemaps_ + + usemap = sparse_early_usemaps_alloc_pgdat_section(NODE_DATA(nodeid), + usemap_count); +- if (usemap) { +- for (pnum = pnum_begin; pnum < pnum_end; pnum++) { +- if (!present_section_nr(pnum)) +- continue; +- usemap_map[pnum] = usemap; +- usemap += size; ++ if (!usemap) { ++ usemap = alloc_bootmem_node(NODE_DATA(nodeid), size * usemap_count); ++ if (!usemap) { ++ printk(KERN_WARNING "%s: allocation failed\n", __func__); ++ return; + } +- return; + } + +- usemap = alloc_bootmem_node(NODE_DATA(nodeid), size * usemap_count); +- if (usemap) { +- for (pnum = pnum_begin; pnum < pnum_end; pnum++) { +- if (!present_section_nr(pnum)) +- continue; +- usemap_map[pnum] = usemap; +- usemap += size; +- check_usemap_section_nr(nodeid, usemap_map[pnum]); +- } +- return; ++ for (pnum = pnum_begin; pnum < pnum_end; pnum++) { ++ if (!present_section_nr(pnum)) ++ continue; ++ usemap_map[pnum] = usemap; ++ usemap += size; ++ check_usemap_section_nr(nodeid, usemap_map[pnum]); + } +- +- printk(KERN_WARNING "%s: allocation failed\n", __func__); + } + + #ifndef CONFIG_SPARSEMEM_VMEMMAP diff --git a/queue-3.3/hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch b/queue-3.3/hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch new file mode 100644 index 00000000000..2ff5243e025 --- /dev/null +++ b/queue-3.3/hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch @@ -0,0 +1,137 @@ +From a05b0855fd15504972dba2358e5faa172a1e50ba Mon Sep 17 00:00:00 2001 +From: "Aneesh Kumar K.V" +Date: Wed, 21 Mar 2012 16:34:08 -0700 +Subject: hugetlbfs: avoid taking i_mutex from hugetlbfs_read() + +From: "Aneesh Kumar K.V" + +commit a05b0855fd15504972dba2358e5faa172a1e50ba upstream. + +Taking i_mutex in hugetlbfs_read() can result in deadlock with mmap as +explained below + + Thread A: + read() on hugetlbfs + hugetlbfs_read() called + i_mutex grabbed + hugetlbfs_read_actor() called + __copy_to_user() called + page fault is triggered + Thread B, sharing address space with A: + mmap() the same file + ->mmap_sem is grabbed on task_B->mm->mmap_sem + hugetlbfs_file_mmap() is called + attempt to grab ->i_mutex and block waiting for A to give it up + Thread A: + pagefault handled blocked on attempt to grab task_A->mm->mmap_sem, + which happens to be the same thing as task_B->mm->mmap_sem. Block waiting + for B to give it up. + +AFAIU the i_mutex locking was added to hugetlbfs_read() as per +http://lkml.indiana.edu/hypermail/linux/kernel/0707.2/3066.html to take +care of the race between truncate and read. This patch fixes this by +looking at page->mapping under lock_page() (find_lock_page()) to ensure +that the inode didn't get truncated in the range during a parallel read. + +Ideally we can extend the patch to make sure we don't increase i_size in +mmap. But that will break userspace, because applications will now have +to use truncate(2) to increase i_size in hugetlbfs. + +Based on the original patch from Hillf Danton. + +Signed-off-by: Aneesh Kumar K.V +Cc: Hillf Danton +Cc: KAMEZAWA Hiroyuki +Cc: Al Viro +Cc: Hugh Dickins +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hugetlbfs/inode.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -238,17 +238,10 @@ static ssize_t hugetlbfs_read(struct fil + loff_t isize; + ssize_t retval = 0; + +- mutex_lock(&inode->i_mutex); +- + /* validate length */ + if (len == 0) + goto out; + +- isize = i_size_read(inode); +- if (!isize) +- goto out; +- +- end_index = (isize - 1) >> huge_page_shift(h); + for (;;) { + struct page *page; + unsigned long nr, ret; +@@ -256,18 +249,21 @@ static ssize_t hugetlbfs_read(struct fil + + /* nr is the maximum number of bytes to copy from this page */ + nr = huge_page_size(h); ++ isize = i_size_read(inode); ++ if (!isize) ++ goto out; ++ end_index = (isize - 1) >> huge_page_shift(h); + if (index >= end_index) { + if (index > end_index) + goto out; + nr = ((isize - 1) & ~huge_page_mask(h)) + 1; +- if (nr <= offset) { ++ if (nr <= offset) + goto out; +- } + } + nr = nr - offset; + + /* Find the page */ +- page = find_get_page(mapping, index); ++ page = find_lock_page(mapping, index); + if (unlikely(page == NULL)) { + /* + * We have a HOLE, zero out the user-buffer for the +@@ -279,17 +275,18 @@ static ssize_t hugetlbfs_read(struct fil + else + ra = 0; + } else { ++ unlock_page(page); ++ + /* + * We have the page, copy it to user space buffer. + */ + ra = hugetlbfs_read_actor(page, offset, buf, len, nr); + ret = ra; ++ page_cache_release(page); + } + if (ra < 0) { + if (retval == 0) + retval = ra; +- if (page) +- page_cache_release(page); + goto out; + } + +@@ -299,16 +296,12 @@ static ssize_t hugetlbfs_read(struct fil + index += offset >> huge_page_shift(h); + offset &= ~huge_page_mask(h); + +- if (page) +- page_cache_release(page); +- + /* short read or no more work */ + if ((ret != nr) || (len == 0)) + break; + } + out: + *ppos = ((loff_t)index << huge_page_shift(h)) + offset; +- mutex_unlock(&inode->i_mutex); + return retval; + } + diff --git a/queue-3.3/iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch b/queue-3.3/iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch new file mode 100644 index 00000000000..9d2aaba9930 --- /dev/null +++ b/queue-3.3/iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch @@ -0,0 +1,43 @@ +From d06283341aee9e48eff1b068779d340785c635ce Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Sun, 26 Feb 2012 22:16:07 -0800 +Subject: iscsi-target: Fix dynamic -> explict NodeACL pointer reference + +From: Nicholas Bellinger + +commit d06283341aee9e48eff1b068779d340785c635ce upstream. + +This patch fixes a free after use in lio_target_make_nodeacl() where +iscsi_node_acl was referenced from the original se_nacl_new allocation, +instead of from core_tpg_add_initiator_node_acl() in the case of dynamic +-> explict NodeACL conversion. + +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target_configfs.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -812,9 +812,6 @@ static struct se_node_acl *lio_target_ma + if (!se_nacl_new) + return ERR_PTR(-ENOMEM); + +- acl = container_of(se_nacl_new, struct iscsi_node_acl, +- se_node_acl); +- + cmdsn_depth = ISCSI_TPG_ATTRIB(tpg)->default_cmdsn_depth; + /* + * se_nacl_new may be released by core_tpg_add_initiator_node_acl() +@@ -825,7 +822,8 @@ static struct se_node_acl *lio_target_ma + if (IS_ERR(se_nacl)) + return se_nacl; + +- stats_cg = &acl->se_node_acl.acl_fabric_stat_group; ++ acl = container_of(se_nacl, struct iscsi_node_acl, se_node_acl); ++ stats_cg = &se_nacl->acl_fabric_stat_group; + + stats_cg->default_groups = kzalloc(sizeof(struct config_group) * 2, + GFP_KERNEL); diff --git a/queue-3.3/iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch b/queue-3.3/iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch new file mode 100644 index 00000000000..f87a3c934ff --- /dev/null +++ b/queue-3.3/iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch @@ -0,0 +1,60 @@ +From d335e6054db616bce3f040e659fa38440518ad1d Mon Sep 17 00:00:00 2001 +From: Nicholas Bellinger +Date: Thu, 23 Feb 2012 17:28:43 -0800 +Subject: iscsi-target: Fix iscsit_alloc_buffs() failure cases + +From: Nicholas Bellinger + +commit d335e6054db616bce3f040e659fa38440518ad1d upstream. + +Make iscsit_alloc_buffs() failure case for page_alloc_failed use correct +__free_page() SGL pointer, and return -ENOMEM for iscsit_allocate_iovecs +failure to push se_cmd->t_mem_sg release into iscsit_release_cmd() +callback during iscsit_add_reject_from_cmd() connection reset. + +Also drop cmd->t_mem_sg = NULL assignment from page_alloc_failed +failure case. + +Reported-by: Roland Dreier +Cc: Andy Grover +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -780,7 +780,7 @@ static int iscsit_alloc_buffs(struct isc + struct scatterlist *sgl; + u32 length = cmd->se_cmd.data_length; + int nents = DIV_ROUND_UP(length, PAGE_SIZE); +- int i = 0, ret; ++ int i = 0, j = 0, ret; + /* + * If no SCSI payload is present, allocate the default iovecs used for + * iSCSI PDU Header +@@ -821,17 +821,15 @@ static int iscsit_alloc_buffs(struct isc + */ + ret = iscsit_allocate_iovecs(cmd); + if (ret < 0) +- goto page_alloc_failed; ++ return -ENOMEM; + + return 0; + + page_alloc_failed: +- while (i >= 0) { +- __free_page(sg_page(&sgl[i])); +- i--; +- } +- kfree(cmd->t_mem_sg); +- cmd->t_mem_sg = NULL; ++ while (j < i) ++ __free_page(sg_page(&sgl[j++])); ++ ++ kfree(sgl); + return -ENOMEM; + } + diff --git a/queue-3.3/pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch b/queue-3.3/pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch new file mode 100644 index 00000000000..7c31d985374 --- /dev/null +++ b/queue-3.3/pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch @@ -0,0 +1,48 @@ +From cc85b20780562d404e18a47b9b55b4a5102ae53e Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 13 Mar 2012 22:39:31 +0100 +Subject: PM / Domains: Fix handling of wakeup devices during system resume + +From: "Rafael J. Wysocki" + +commit cc85b20780562d404e18a47b9b55b4a5102ae53e upstream. + +During system suspend pm_genpd_suspend_noirq() checks if the given +device is in a wakeup path (i.e. it appears to be needed for one or +more wakeup devices to work or is a wakeup device itself) and if it +needs to be "active" for wakeup to work. If that is the case, the +function returns 0 without incrementing the device domain's counter +of suspended devices and without executing genpd_stop_dev() for the +device. In consequence, the device is not stopped (e.g. its clock +isn't disabled) and power is always supplied to its domain in the +resulting system sleep state. + +However, pm_genpd_resume_noirq() doesn't repeat that check and it +runs genpd_start_dev() and decrements the domain's counter of +suspended devices even for the wakeup device that weren't stopped by +pm_genpd_suspend_noirq(). As a result, the start callback may be run +unnecessarily for them and their domains' counters of suspended +devices may become negative. Both outcomes aren't desirable, so fix +pm_genpd_resume_noirq() to look for wakeup devices that might not be +stopped by during system suspend. + +Signed-off-by: Rafael J. Wysocki +Tested-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/domain.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -880,7 +880,8 @@ static int pm_genpd_resume_noirq(struct + if (IS_ERR(genpd)) + return -EINVAL; + +- if (genpd->suspend_power_off) ++ if (genpd->suspend_power_off ++ || (dev->power.wakeup_path && genpd_dev_active_wakeup(genpd, dev))) + return 0; + + /* diff --git a/queue-3.3/pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch b/queue-3.3/pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch new file mode 100644 index 00000000000..d72062fdddb --- /dev/null +++ b/queue-3.3/pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch @@ -0,0 +1,42 @@ +From 615a445f7f8a077c145e737864ae59a4d8717882 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 13 Mar 2012 22:40:06 +0100 +Subject: PM / shmobile: Make CMT driver use pm_genpd_dev_always_on() + +From: "Rafael J. Wysocki" + +commit 615a445f7f8a077c145e737864ae59a4d8717882 upstream. + +Make the CMT clocksource driver mark its device as "always on" +using pm_genpd_dev_always_on() to protect it from surprise power +removals. + +Signed-off-by: Rafael J. Wysocki +Tested-by: Simon Horman +Acked-by: Paul Mundt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/sh_cmt.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/clocksource/sh_cmt.c ++++ b/drivers/clocksource/sh_cmt.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + struct sh_cmt_priv { + void __iomem *mapbase; +@@ -689,6 +690,9 @@ static int __devinit sh_cmt_probe(struct + struct sh_cmt_priv *p = platform_get_drvdata(pdev); + int ret; + ++ if (!is_early_platform_device(pdev)) ++ pm_genpd_dev_always_on(&pdev->dev, true); ++ + if (p) { + dev_info(&pdev->dev, "kept as earlytimer\n"); + return 0; diff --git a/queue-3.3/pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch b/queue-3.3/pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch new file mode 100644 index 00000000000..c63dfa2a473 --- /dev/null +++ b/queue-3.3/pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch @@ -0,0 +1,42 @@ +From 57d13370cfaf6017c68981e66ff5b3bf20a2705c Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 13 Mar 2012 22:40:14 +0100 +Subject: PM / shmobile: Make MTU2 driver use pm_genpd_dev_always_on() + +From: "Rafael J. Wysocki" + +commit 57d13370cfaf6017c68981e66ff5b3bf20a2705c upstream. + +Make the MTU2 clocksource driver mark its device as "always on" +using pm_genpd_dev_always_on() to protect it from surprise power +removals. + +Signed-off-by: Rafael J. Wysocki +Tested-by: Simon Horman +Acked-by: Paul Mundt +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clocksource/sh_mtu2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/clocksource/sh_mtu2.c ++++ b/drivers/clocksource/sh_mtu2.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + struct sh_mtu2_priv { + void __iomem *mapbase; +@@ -306,6 +307,9 @@ static int __devinit sh_mtu2_probe(struc + struct sh_mtu2_priv *p = platform_get_drvdata(pdev); + int ret; + ++ if (!is_early_platform_device(pdev)) ++ pm_genpd_dev_always_on(&pdev->dev, true); ++ + if (p) { + dev_info(&pdev->dev, "kept as earlytimer\n"); + return 0; diff --git a/queue-3.3/pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch b/queue-3.3/pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch new file mode 100644 index 00000000000..346fe61b3ab --- /dev/null +++ b/queue-3.3/pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch @@ -0,0 +1,56 @@ +From 2ee619f9487c2acc1efdf2c78e68e2bd51b635fa Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 13 Mar 2012 22:40:00 +0100 +Subject: PM / shmobile: Make TMU driver use pm_genpd_dev_always_on() + +From: "Rafael J. Wysocki" + +commit 2ee619f9487c2acc1efdf2c78e68e2bd51b635fa upstream. + +Make the TMU clocksource driver mark its device as "always on" +using pm_genpd_dev_always_on() to protect it from surprise power +removals and make sh7372_add_standard_devices() add TMU devices on +sh7372 to the A4R power domain so that their "always on" flags +are taken into account as appropriate. + +Signed-off-by: Rafael J. Wysocki +Tested-by: Simon Horman +Acked-by: Paul Mundt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-shmobile/setup-sh7372.c | 2 ++ + drivers/clocksource/sh_tmu.c | 4 ++++ + 2 files changed, 6 insertions(+) + +--- a/arch/arm/mach-shmobile/setup-sh7372.c ++++ b/arch/arm/mach-shmobile/setup-sh7372.c +@@ -1043,6 +1043,8 @@ void __init sh7372_add_standard_devices( + sh7372_add_device_to_domain(&sh7372_a4r, &veu2_device); + sh7372_add_device_to_domain(&sh7372_a4r, &veu3_device); + sh7372_add_device_to_domain(&sh7372_a4r, &jpu_device); ++ sh7372_add_device_to_domain(&sh7372_a4r, &tmu00_device); ++ sh7372_add_device_to_domain(&sh7372_a4r, &tmu01_device); + } + + void __init sh7372_add_early_devices(void) +--- a/drivers/clocksource/sh_tmu.c ++++ b/drivers/clocksource/sh_tmu.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + struct sh_tmu_priv { + void __iomem *mapbase; +@@ -410,6 +411,9 @@ static int __devinit sh_tmu_probe(struct + struct sh_tmu_priv *p = platform_get_drvdata(pdev); + int ret; + ++ if (!is_early_platform_device(pdev)) ++ pm_genpd_dev_always_on(&pdev->dev, true); ++ + if (p) { + dev_info(&pdev->dev, "kept as earlytimer\n"); + return 0; diff --git a/queue-3.3/scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch b/queue-3.3/scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch new file mode 100644 index 00000000000..604cbc173d6 --- /dev/null +++ b/queue-3.3/scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch @@ -0,0 +1,42 @@ +From df1c7baba1b7b3053950f3845a6575aca47ba9ce Mon Sep 17 00:00:00 2001 +From: Mike Christie +Date: Thu, 26 Jan 2012 21:13:09 -0600 +Subject: SCSI: iscsi: fix setting of pid from netlink skb + +From: Mike Christie + +commit df1c7baba1b7b3053950f3845a6575aca47ba9ce upstream. + +NETLINK_CREDS's pid now returns 0, so I guess we are supposed to +be using NETLINK_CB. This changed while the patch to export the +pid was getting merged upstream, so it was not noticed until both +the network and iscsi changes were in the same tree. + +Signed-off-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_transport_iscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -1941,7 +1941,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_CREATE_SESSION: + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CREDS(skb)->pid, ++ NETLINK_CB(skb).pid, + ev->u.c_session.initial_cmdsn, + ev->u.c_session.cmds_max, + ev->u.c_session.queue_depth); +@@ -1954,7 +1954,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, s + } + + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CREDS(skb)->pid, ++ NETLINK_CB(skb).pid, + ev->u.c_bound_session.initial_cmdsn, + ev->u.c_bound_session.cmds_max, + ev->u.c_bound_session.queue_depth); diff --git a/queue-3.3/series b/queue-3.3/series index f5a7875b0c2..72b43662753 100644 --- a/queue-3.3/series +++ b/queue-3.3/series @@ -61,3 +61,16 @@ ima-fix-kconfig-dependencies.patch x86-ioapic-add-register-level-checks-to-detect-bogus-io-apic-entries.patch mm-thp-fix-pmd_bad-triggering-in-code-paths-holding-mmap_sem-read-mode.patch tpm-zero-buffer-whole-after-copying-to-userspace.patch +pm-domains-fix-handling-of-wakeup-devices-during-system-resume.patch +pm-shmobile-make-mtu2-driver-use-pm_genpd_dev_always_on.patch +pm-shmobile-make-cmt-driver-use-pm_genpd_dev_always_on.patch +pm-shmobile-make-tmu-driver-use-pm_genpd_dev_always_on.patch +bootmem-sparsemem-remove-limit-constraint-in-alloc_bootmem_section.patch +hugetlbfs-avoid-taking-i_mutex-from-hugetlbfs_read.patch +asoc-fsl-p1022ds-tell-the-wm8776-codec-driver-that-it-s-the-master.patch +asoc-pxa-ssp-atomically-set-stream-active-masks.patch +tcm_loop-set-residual-field-for-scsi-commands.patch +scsi-iscsi-fix-setting-of-pid-from-netlink-skb.patch +iscsi-target-fix-iscsit_alloc_buffs-failure-cases.patch +iscsi-target-fix-dynamic-explict-nodeacl-pointer-reference.patch +alsa-hda-fix-printing-of-high-hdmi-sample-rates.patch diff --git a/queue-3.3/tcm_loop-set-residual-field-for-scsi-commands.patch b/queue-3.3/tcm_loop-set-residual-field-for-scsi-commands.patch new file mode 100644 index 00000000000..024f381700e --- /dev/null +++ b/queue-3.3/tcm_loop-set-residual-field-for-scsi-commands.patch @@ -0,0 +1,49 @@ +From 6cf3fa6918baab0c447f1206f1cef9166ad04864 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Tue, 14 Feb 2012 15:30:31 -0800 +Subject: tcm_loop: Set residual field for SCSI commands + +From: Roland Dreier + +commit 6cf3fa6918baab0c447f1206f1cef9166ad04864 upstream. + +If the target core signals an over- or under-run, tcm_loop should call +scsi_set_resid() to tell the SCSI midlayer about the residual data length. + +The difference can be seen by doing something like + + strace -eioctl sg_raw -r 1024 /dev/sda 8 0 0 0 1 0 > /dev/null + +and looking at the "resid=" part of the SG_IO ioctl -- after this patch, +the field is correctly reported as 512. + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/loopback/tcm_loop.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/target/loopback/tcm_loop.c ++++ b/drivers/target/loopback/tcm_loop.c +@@ -855,6 +855,9 @@ static int tcm_loop_queue_data_in(struct + + sc->result = SAM_STAT_GOOD; + set_host_byte(sc, DID_OK); ++ if ((se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) || ++ (se_cmd->se_cmd_flags & SCF_UNDERFLOW_BIT)) ++ scsi_set_resid(sc, se_cmd->residual_count); + sc->scsi_done(sc); + return 0; + } +@@ -880,6 +883,9 @@ static int tcm_loop_queue_status(struct + sc->result = se_cmd->scsi_status; + + set_host_byte(sc, DID_OK); ++ if ((se_cmd->se_cmd_flags & SCF_OVERFLOW_BIT) || ++ (se_cmd->se_cmd_flags & SCF_UNDERFLOW_BIT)) ++ scsi_set_resid(sc, se_cmd->residual_count); + sc->scsi_done(sc); + return 0; + }