Linux 3.0.21

commit 1d05f993784973189395051cc711fdd6dd5eb389
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon Feb 13 11:15:52 2012 -0800

    Linux 3.0.21

commit 8a533666d1591cf4ea596c6bd710e2fe682cb56a
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Thu Feb 9 16:13:19 2012 -0500

    net: fix NULL dereferences in check_peer_redir()

    [ Upstream commit d3aaeb38c40e5a6c08dd31a1b64da65c4352be36, along
      with dependent backports of commits:
         69cce1d1404968f78b177a0314f5822d5afdbbfb
         9de79c127cccecb11ae6a21ab1499e87aa222880
         218fa90f072e4aeff9003d57e390857f4f35513e
         580da35a31f91a594f3090b7a2c39b85cb051a12
         f7e57044eeb1841847c24aa06766c8290c202583
         e049f28883126c689cf95859480d9ee4ab23b7fa ]

    Gergely Kalman reported crashes in check_peer_redir().

    It appears commit f39925dbde778 (ipv4: Cache learned redirect
    information in inetpeer.) added a race, leading to possible NULL ptr
    dereference.

    Since we can now change dst neighbour, we should make sure a reader can
    safely use a neighbour.

    Add RCU protection to dst neighbour, and make sure check_peer_redir()
    can be called safely by different cpus in parallel.

    As neighbours are already freed after one RCU grace period, this patch
    should not add typical RCU penalty (cache cold effects)

    Many thanks to Gergely for providing a pretty report pointing to the
    bug.

    Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 323a479328cbc2fb5cf647790f7414ca570a577b
Author: Andreas Herrmann <andreas.herrmann3@amd.com>
Date:   Fri Jan 6 15:57:55 2012 +0100

    powernow-k8: Fix indexing issue

    commit a8eb28480e9b637cc78b9aa5e08612ba97e1317a upstream.

    The driver uses the pstate number from the status register as index in
    its table of ACPI pstates (powernow_table). This is wrong as this is
    not a 1-to-1 mapping.

    For example we can have _PSS information to just utilize Pstate 0 and
    Pstate 4, ie.

      powernow-k8: Core Performance Boosting: on.
      powernow-k8:    0 : pstate 0 (2200 MHz)
      powernow-k8:    1 : pstate 4 (1400 MHz)

    In this example the driver's powernow_table has just 2 entries. Using
    the pstate number (4) as index into this table is just plain wrong.

    Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
    Signed-off-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d8a3a209b35f8301c86e7962f636a372a0d7cad
Author: Andreas Herrmann <andreas.herrmann3@amd.com>
Date:   Fri Jan 6 15:56:31 2012 +0100

    powernow-k8: Avoid Pstate MSR accesses on systems supporting CPB

    commit 201bf0f129e1715a33568d1563d9a75b840ab4d3 upstream.

    Due to CPB we can't directly map SW Pstates to Pstate MSRs. Get rid of
    the paranoia check. (assuming that the ACPI Pstate information is
    correct.)

    Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
    Signed-off-by: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ebc5010892742064d7436a1c1ff91b3189c4b8c7
Author: Axel Lin <axel.lin@gmail.com>
Date:   Wed Feb 1 12:31:47 2012 +0800

    mmc: cb710 core: Add missing spin_lock_init for irq_lock of struct cb710_chip

    commit b5266ea675c5a041e2852c7ccec4cf2d4f5e0cf4 upstream.

    Signed-off-by: Axel Lin <axel.lin@gmail.com>
    Acked-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 27939dafb1bd1053fda96d69d4b693f29f2389b6
Author: Rui li <li.rui27@zte.com.cn>
Date:   Tue Jan 31 15:27:33 2012 +0800

    USB: add new zte 3g-dongle's pid to option.c

    commit 1608ea5f4b5d6262cd6e808839491cfb2a67405a upstream.

    As ZTE have and will use more pid for new products this year,
    so we need to add some new zte 3g-dongle's pid on option.c ,
    and delete one pid 0x0154 because it use for mass-storage port.

    Signed-off-by: Rui li <li.rui27@zte.com.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 71f1a6a81350c7bf75141e183c1d5e310f264622
Author: Milan Kocian <milon@wq.cz>
Date:   Fri Feb 3 14:28:00 2012 +0100

    USB: usbserial: add new PID number (0xa951) to the ftdi driver

    commit 90451e6973a5da155c6f315a409ca0a8d3ce6b76 upstream.

    Signed-off-by: Milan Kocian <milon@wq.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 20ef4883ff2c65f96da1617446ebc58c0a707970
Author: Jayachandran C <jayachandranc@netlogicmicro.com>
Date:   Fri Jan 27 20:27:32 2012 +0530

    usb: Skip PCI USB quirk handling for Netlogic XLP

    commit e4436a7c17ac2b5e138f93f83a541cba9b311685 upstream.

    The Netlogic XLP SoC's on-chip USB controller appears as a PCI
    USB device, but does not need the EHCI/OHCI handoff done in
    usb/host/pci-quirks.c.

    The pci-quirks.c is enabled for all vendors and devices, and is
    enabled if USB and PCI are configured.

    If we do not skip the qurik handling on XLP, the readb() call in
    ehci_bios_handoff() will cause a crash since byte access is not
    supported for EHCI registers in XLP.

    Signed-off-by: Jayachandran C <jayachandranc@netlogicmicro.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d6adb709398ee159ab2ef26d51760041ca5e8262
Author: Timo Juhani Lindfors <timo.lindfors@iki.fi>
Date:   Sun Jan 29 16:12:13 2012 +0200

    usb: gadget: zero: fix bug in loopback autoresume handling

    commit 683da59d7b8ae04891636d4b59893cd4e9b0b7e5 upstream.

    ab943a2e125b (USB: gadget: gadget zero uses new suspend/resume hooks)
    introduced a copy-paste error where f_loopback.c writes to a variable
    declared in f_sourcesink.c. This prevents one from creating gadgets
    that only have a loopback function.

    Signed-off-by: Timo Juhani Lindfors <timo.lindfors@iki.fi>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fc2286972bd426b03fe64d79d39d9ff9ac1c4cc3
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Sat Jan 7 10:07:03 2012 -0600

    staging: r8712u: Add new Sitecom UsB ID

    commit 1793bf1deddc8ce25dc41925d5dbe64536c841b6 upstream.

    Add USB ID for SITECOM WLA-1000 V1 001 WLAN

    Reported-and-tested-by: Roland Gruber <post@rolandgruber.de>
    Reported-and-tested-by: Dario Lucia <dario.lucia@gmail.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 946972e6ab9c59142f5cb51f31ea36a090f2ce16
Author: Pekka Paalanen <pq@iki.fi>
Date:   Sun Jan 22 16:33:47 2012 +0200

    Staging: asus_oled: fix NULL-ptr crash on unloading

    commit 3589e74595a4332ebf77b5ed006f3c6686071ecd upstream.

    Asus_oled triggers the following bug on module unloading:

     usbcore: deregistering interface driver asus-oled
     BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
     IP: [<ffffffff8111292b>] sysfs_delete_link+0x30/0x66

     Call Trace:
      [<ffffffff81225373>] device_remove_class_symlinks+0x6b/0x70
      [<ffffffff812256a8>] device_del+0x9f/0x1ab
      [<ffffffff812257c5>] device_unregister+0x11/0x1e
      [<ffffffffa000cb82>] asus_oled_disconnect+0x4f/0x9e [asus_oled]
      [<ffffffff81277430>] usb_unbind_interface+0x54/0x103
      [<ffffffff812276c4>] __device_release_driver+0xa2/0xeb
      [<ffffffff81227794>] driver_detach+0x87/0xad
      [<ffffffff812269e9>] bus_remove_driver+0x91/0xc1
      [<ffffffff81227fb4>] driver_unregister+0x66/0x6e
      [<ffffffff812771ed>] usb_deregister+0xbb/0xc4
      [<ffffffffa000ce87>] asus_oled_exit+0x2f/0x31 [asus_oled]
      [<ffffffff81068365>] sys_delete_module+0x1b8/0x21b
      [<ffffffff810ae3de>] ? do_munmap+0x2ef/0x313
      [<ffffffff813699bb>] system_call_fastpath+0x16/0x1b

    This is due to an incorrect destruction sequence in asus_oled_exit().

    Fix the order, fixes the bug. Tested on an Asus G50V laptop only.

    Cc: Jakub Schmidtke <sjakub@gmail.com>
    Signed-off-by: Pekka Paalanen <pq@iki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3f64466ca0f04dc2b138a3c1e348a7e15b91ebba
Author: Pekka Paalanen <pq@iki.fi>
Date:   Sun Jan 22 16:33:46 2012 +0200

    Staging: asus_oled: fix image processing

    commit 635032cb397b396241372fa0ff36ae758e658b23 upstream.

    Programming an image was broken, because odev->buf_offs was not advanced
    for val == 0 in append_values(). This regression was introduced in:

     commit 1ff12a4aa354bed093a0240d5e6347b1e27601bc
     Author: Kevin A. Granade <kevin.granade@gmail.com>
     Date:   Sat Sep 5 01:03:39 2009 -0500

         Staging: asus_oled: Cleaned up checkpatch issues.

    Fix the image processing by special-casing val == 0.

    I have tested this change on an Asus G50V laptop only.

    Cc: Jakub Schmidtke <sjakub@gmail.com>
    Cc: Kevin A. Granade <kevin.granade@gmail.com>
    Signed-off-by: Pekka Paalanen <pq@iki.fi>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 967a6f42d195569b596f9af39cd878803a0d1f8b
Author: Roland Dreier <roland@purestorage.com>
Date:   Mon Jan 9 17:54:00 2012 -0800

    target: Correct sense key for INVALID FIELD IN {PARAMETER LIST,CDB}

    commit 9fbc8909876a2160044e71d376848973b9bfdc3f upstream.

    According to SPC-4, the sense key for commands that are failed with
    INVALID FIELD IN PARAMETER LIST and INVALID FIELD IN CDB should be
    ILLEGAL REQUEST (5h) rather than ABORTED COMMAND (Bh).  Without this
    patch, a tcm_loop LUN incorrectly gives:

        # sg_raw -r 1 -v /dev/sda 3 1 0 0 ff 0
        Sense Information:
         Fixed format, current;  Sense key: Aborted Command
         Additional sense: Invalid field in cdb
         Raw sense data (in hex):
                70 00 0b 00 00 00 00 0a  00 00 00 00 24 00 00 00
                00 00

    While a real SCSI disk gives:

        Sense Information:
         Fixed format, current;  Sense key: Illegal Request
         Additional sense: Invalid field in cdb
         Raw sense data (in hex):
                70 00 05 00 00 00 00 18  00 00 00 00 24 00 00 00
                00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00

    with the main point being that the real disk gives a sense key of
    ILLEGAL REQUEST (5h).

    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b8a8c4aa9e22c2de7af17ea48b7cc868f5bc79ad
Author: Marco Sanvido <marco@purestorage.com>
Date:   Tue Jan 3 17:12:58 2012 -0800

    target: Allow PERSISTENT RESERVE IN for non-reservation holder

    commit 6816966a8418b980481b4dced7eddd1796b145e8 upstream.

    Initiators that aren't the active reservation holder should be able to
    do a PERSISTENT RESERVE IN command in all cases, so add it to the list
    of allowed CDBs in core_scsi3_pr_seq_non_holder().

    Signed-off-by: Marco Sanvido <marco@purestorage.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b96473a25fa375b08c9bf0c1c0dbf47ca826eaec
Author: Marco Sanvido <marco@purestorage.com>
Date:   Tue Jan 3 17:12:57 2012 -0800

    target: Use correct preempted registration sense code

    commit 9e08e34e3735ae057eb3834da3570995811b7eb9 upstream.

    The comments quote the right parts of the spec:

       * d) Establish a unit attention condition for the
       *    initiator port associated with every I_T nexus
       *    that lost its registration other than the I_T
       *    nexus on which the PERSISTENT RESERVE OUT command
       *    was received, with the additional sense code set
       *    to REGISTRATIONS PREEMPTED.

    and

       * e) Establish a unit attention condition for the initiator
       *    port associated with every I_T nexus that lost its
       *    persistent reservation and/or registration, with the
       *    additional sense code set to REGISTRATIONS PREEMPTED;

    but the actual code accidentally uses ASCQ_2AH_RESERVATIONS_PREEMPTED
    instead of ASCQ_2AH_REGISTRATIONS_PREEMPTED.  Fix this.

    Signed-off-by: Marco Sanvido <marco@purestorage.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 91b08ca08c8f5fbad289950086d6fb7ab0642d63
Author: Hugh Dickins <hughd@google.com>
Date:   Wed Feb 8 17:13:40 2012 -0800

    mm: fix UP THP spin_is_locked BUGs

    commit b9980cdcf2524c5fe15d8cbae9c97b3ed6385563 upstream.

    Fix CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_SMP=n CONFIG_DEBUG_VM=y
    CONFIG_DEBUG_SPINLOCK=n kernel: spin_is_locked() is then always false,
    and so triggers some BUGs in Transparent HugePage codepaths.

    asm-generic/bug.h mentions this problem, and provides a WARN_ON_SMP(x);
    but being too lazy to add VM_BUG_ON_SMP, BUG_ON_SMP, WARN_ON_SMP_ONCE,
    VM_WARN_ON_SMP_ONCE, just test NR_CPUS != 1 in the existing VM_BUG_ONs.

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Andrea Arcangeli <aarcange@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b9134812300fd0e3c242c50af5c563065d2f1b1e
Author: Mel Gorman <mgorman@suse.de>
Date:   Wed Feb 8 17:13:38 2012 -0800

    mm: compaction: check for overlapping nodes during isolation for migration

    commit dc9086004b3d5db75997a645b3fe08d9138b7ad0 upstream.

    When isolating pages for migration, migration starts at the start of a
    zone while the free scanner starts at the end of the zone.  Migration
    avoids entering a new zone by never going beyond the free scanned.

    Unfortunately, in very rare cases nodes can overlap.  When this happens,
    migration isolates pages without the LRU lock held, corrupting lists
    which will trigger errors in reclaim or during page free such as in the
    following oops

      BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
      IP: [<ffffffff810f795c>] free_pcppages_bulk+0xcc/0x450
      PGD 1dda554067 PUD 1e1cb58067 PMD 0
      Oops: 0000 [#1] SMP
      CPU 37
      Pid: 17088, comm: memcg_process_s Tainted: G            X
      RIP: free_pcppages_bulk+0xcc/0x450
      Process memcg_process_s (pid: 17088, threadinfo ffff881c2926e000, task ffff881c2926c0c0)
      Call Trace:
        free_hot_cold_page+0x17e/0x1f0
        __pagevec_free+0x90/0xb0
        release_pages+0x22a/0x260
        pagevec_lru_move_fn+0xf3/0x110
        putback_lru_page+0x66/0xe0
        unmap_and_move+0x156/0x180
        migrate_pages+0x9e/0x1b0
        compact_zone+0x1f3/0x2f0
        compact_zone_order+0xa2/0xe0
        try_to_compact_pages+0xdf/0x110
        __alloc_pages_direct_compact+0xee/0x1c0
        __alloc_pages_slowpath+0x370/0x830
        __alloc_pages_nodemask+0x1b1/0x1c0
        alloc_pages_vma+0x9b/0x160
        do_huge_pmd_anonymous_page+0x160/0x270
        do_page_fault+0x207/0x4c0
        page_fault+0x25/0x30

    The "X" in the taint flag means that external modules were loaded but but
    is unrelated to the bug triggering.  The real problem was because the PFN
    layout looks like this

      Zone PFN ranges:
        DMA      0x00000010 -> 0x00001000
        DMA32    0x00001000 -> 0x00100000
        Normal   0x00100000 -> 0x01e80000
      Movable zone start PFN for each node
      early_node_map[14] active PFN ranges
          0: 0x00000010 -> 0x0000009b
          0: 0x00000100 -> 0x0007a1ec
          0: 0x0007a354 -> 0x0007a379
          0: 0x0007f7ff -> 0x0007f800
          0: 0x00100000 -> 0x00680000
          1: 0x00680000 -> 0x00e80000
          0: 0x00e80000 -> 0x01080000
          1: 0x01080000 -> 0x01280000
          0: 0x01280000 -> 0x01480000
          1: 0x01480000 -> 0x01680000
          0: 0x01680000 -> 0x01880000
          1: 0x01880000 -> 0x01a80000
          0: 0x01a80000 -> 0x01c80000
          1: 0x01c80000 -> 0x01e80000

    The fix is straight-forward.  isolate_migratepages() has to make a
    similar check to isolate_freepage to ensure that it never isolates pages
    from a zone it does not hold the LRU lock for.

    This was discovered in a 3.0-based kernel but it affects 3.1.x, 3.2.x
    and current mainline.

    Signed-off-by: Mel Gorman <mgorman@suse.de>
    Acked-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a5e2ba3e021e7a3135a7dbb8e188d21971a59f49
Author: Russell King <rmk+kernel@arm.linux.org.uk>
Date:   Wed Feb 8 17:13:41 2012 -0800

    pcmcia: fix socket refcount decrementing on each resume

    commit 025e4ab3db07fcbf62c01e4f30d1012234beb980 upstream.

    This fixes a memory-corrupting bug: not only does it cause the warning,
    but as a result of dropping the refcount to zero, it causes the
    pcmcia_socket0 device structure to be freed while it still has
    references, causing slab caches corruption.  A fatal oops quickly
    follows this warning - often even just a 'dmesg' following the warning
    causes the kernel to oops.

    While testing suspend/resume on an ARM device with PCMCIA support, and a
    CF card inserted, I found that after five suspend and resumes, the
    kernel would complain, and shortly die after with slab corruption.

      WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()

    As the message doesn't give a clue about which kobject, and the built-in
    debugging in drivers/base/power/main.c happens too late, this was added
    right before each get_device():

      printk("%s: %p [%s] %u\n", __func__, dev, kobject_name(&dev->kobj), atomic_read(&dev->kobj.kref.refcount));

    and on the 3rd s2ram cycle, the following behaviour observed:

    On the 3rd suspend/resume cycle:

      dpm_prepare: c1a0d998 [pcmcia_socket0] 3
      dpm_suspend: c1a0d998 [pcmcia_socket0] 3
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 3
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 3
      dpm_resume: c1a0d998 [pcmcia_socket0] 3
      dpm_complete: c1a0d998 [pcmcia_socket0] 2

    4th:

      dpm_prepare: c1a0d998 [pcmcia_socket0] 2
      dpm_suspend: c1a0d998 [pcmcia_socket0] 2
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 2
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 2
      dpm_resume: c1a0d998 [pcmcia_socket0] 2
      dpm_complete: c1a0d998 [pcmcia_socket0] 1

    5th:

      dpm_prepare: c1a0d998 [pcmcia_socket0] 1
      dpm_suspend: c1a0d998 [pcmcia_socket0] 1
      dpm_suspend_noirq: c1a0d998 [pcmcia_socket0] 1
      dpm_resume_noirq: c1a0d998 [pcmcia_socket0] 1
      dpm_resume: c1a0d998 [pcmcia_socket0] 1
      dpm_complete: c1a0d998 [pcmcia_socket0] 0
      ------------[ cut here ]------------
      WARNING: at include/linux/kref.h:41 kobject_get+0x28/0x50()
      Modules linked in: ucb1x00_core
      Backtrace:
      [<c0212090>] (dump_backtrace+0x0/0x110) from [<c04799dc>] (dump_stack+0x18/0x1c)
      [<c04799c4>] (dump_stack+0x0/0x1c) from [<c021cba0>] (warn_slowpath_common+0x50/0x68)
      [<c021cb50>] (warn_slowpath_common+0x0/0x68) from [<c021cbdc>] (warn_slowpath_null+0x24/0x28)
      [<c021cbb8>] (warn_slowpath_null+0x0/0x28) from [<c0335374>] (kobject_get+0x28/0x50)
      [<c033534c>] (kobject_get+0x0/0x50) from [<c03804f4>] (get_device+0x1c/0x24)
      [<c0388c90>] (dpm_complete+0x0/0x1a0) from [<c0389cc0>] (dpm_resume_end+0x1c/0x20)
      ...

    Looking at commit 7b24e7988263 ("pcmcia: split up central event handler"),
    the following change was made to cs.c:

                    return 0;
            }
     #endif
    -
    -       send_event(skt, CS_EVENT_PM_RESUME, CS_EVENT_PRI_LOW);
    +       if (!(skt->state & SOCKET_CARDBUS) && (skt->callback))
    +               skt->callback->early_resume(skt);
            return 0;
     }

    And the corresponding change in ds.c is from:

    -static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
    -{
    -       struct pcmcia_socket *s = pcmcia_get_socket(skt);
    ...
    -       switch (event) {
    ...
    -       case CS_EVENT_PM_RESUME:
    -               if (verify_cis_cache(skt) != 0) {
    -                       dev_dbg(&skt->dev, "cis mismatch - different card\n");
    -                       /* first, remove the card */
    -                       ds_event(skt, CS_EVENT_CARD_REMOVAL, CS_EVENT_PRI_HIGH);
    -                       mutex_lock(&s->ops_mutex);
    -                       destroy_cis_cache(skt);
    -                       kfree(skt->fake_cis);
    -                       skt->fake_cis = NULL;
    -                       s->functions = 0;
    -                       mutex_unlock(&s->ops_mutex);
    -                       /* now, add the new card */
    -                       ds_event(skt, CS_EVENT_CARD_INSERTION,
    -                                CS_EVENT_PRI_LOW);
    -               }
    -               break;
    ...
    -    }

    -    pcmcia_put_socket(s);

    -    return 0;
    -} /* ds_event */

    to:

    +static int pcmcia_bus_early_resume(struct pcmcia_socket *skt)
    +{
    +       if (!verify_cis_cache(skt)) {
    +               pcmcia_put_socket(skt);
    +               return 0;
    +       }

    +       dev_dbg(&skt->dev, "cis mismatch - different card\n");

    +       /* first, remove the card */
    +       pcmcia_bus_remove(skt);
    +       mutex_lock(&skt->ops_mutex);
    +       destroy_cis_cache(skt);
    +       kfree(skt->fake_cis);
    +       skt->fake_cis = NULL;
    +       skt->functions = 0;
    +       mutex_unlock(&skt->ops_mutex);

    +       /* now, add the new card */
    +       pcmcia_bus_add(skt);
    +       return 0;
    +}

    As can be seen, the original function called pcmcia_get_socket() and
    pcmcia_put_socket() around the guts, whereas the replacement code
    calls pcmcia_put_socket() only in one path.  This creates an imbalance
    in the refcounting.

    Testing with pcmcia_put_socket() put removed shows that the bug is gone:

      dpm_suspend: c1a10998 [pcmcia_socket0] 5
      dpm_suspend_noirq: c1a10998 [pcmcia_socket0] 5
      dpm_resume_noirq: c1a10998 [pcmcia_socket0] 5
      dpm_resume: c1a10998 [pcmcia_socket0] 5
      dpm_complete: c1a10998 [pcmcia_socket0] 5

    Tested-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2b42237845c6c1f94479320b012664bbf07bb989
Author: Susan Gao <sgao@opensource.wolfsonmicro.com>
Date:   Mon Jan 30 13:57:04 2012 -0800

    ASoC: wm8962: Fix word length configuration

    commit 2b6712b19531e22455e7fa18371c5ba9eec76699 upstream.

    Signed-off-by: Susan Gao <sgao@opensource.wolfsonmicro.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b855f76b5f217bd6d03c7dfa38a64b51143338ac
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Wed Feb 1 23:46:58 2012 +0000

    ASoC: wm_hubs: Correct line input to line output 2 paths

    commit 43b6cec27e1e50a1de3eff47e66e502f3fe7e66e upstream.

    The second line output mixer has the controls for the line input bypasses
    in the opposite order.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30b4b3a54fc6ca34c6f8a18b56c83680ad0a7fa9
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Tue Jan 31 11:55:32 2012 +0000

    ASoC: wm_hubs: Fix routing of input PGAs to line output mixer

    commit ee76744c51ec342df9822b4a85dbbfc3887b6d60 upstream.

    IN1L/R is routed to both line output mixers, we don't route IN1 to LINEOUT1
    and IN2 to LINEOUT2.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb521fbb338f21b2de12fe8f7e4fa5b7e4f9fb2a
Author: Guenter Roeck <linux@roeck-us.net>
Date:   Fri Jan 27 05:43:59 2012 -0800

    hwmon: (w83627ehf) Fix number of fans for NCT6776F

    commit 585c0fd8216e0c9f98e2434092af7ec0f999522d upstream.

    NCT6776F can select fan input pins for fans 3 to 5 with a secondary set of
    chip register bits. Check that second set of bits in addition to the first set
    to detect if fans 3..5 are monitored.

    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Acked-by: Jean Delvare <khali@linux-fr.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d378b2d044139f88384d278bd5830669c44c789b
Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
Date:   Mon Nov 14 13:13:49 2011 +0100

    lockdep, bug: Exclude TAINT_FIRMWARE_WORKAROUND from disabling lockdep

    commit df754e6af2f237a6c020c0daff55a1a609338e31 upstream.

    It's unlikely that TAINT_FIRMWARE_WORKAROUND causes false
    lockdep messages, so do not disable lockdep in that case.
    We still want to keep lockdep disabled in the
    TAINT_OOT_MODULE case:

      - bin-only modules can cause various instabilities in
        their and in unrelated kernel code

      - they are impossible to debug for kernel developers

      - they also typically do not have the copyright license
        permission to link to the GPL-ed lockdep code.

    Suggested-by: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Link: http://lkml.kernel.org/n/tip-xopopjjens57r0i13qnyh2yo@git.kernel.org
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e02c339f506e10fadf8a5f00f1c932035596ed8e
Author: Hubert Feurstein <h.feurstein@gmail.com>
Date:   Mon Jan 9 17:23:57 2012 +0100

    atmel_lcdfb: fix usage of CONTRAST_CTR in suspend/resume

    commit 9f1065032ceb7e86c7c9f16bb86518857e88a172 upstream.

    An error was existing in the saving of CONTRAST_CTR register
    across suspend/resume.

    Signed-off-by: Hubert Feurstein <h.feurstein@gmail.com>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Acked-by: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7a415a8da853b0724413680a769d89affc8b5be5
Author: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Date:   Thu Feb 2 15:28:28 2012 -0600

    cifs: Fix oops in session setup code for null user mounts

    commit de47a4176c532ef5961b8a46a2d541a3517412d3 upstream.

    For null user mounts, do not invoke string length function
    during session setup.

    Reported-and-Tested-by: Chris Clayton <chris2553@googlemail.com>
    Acked-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1a11d5d7fb7988a92e798dfbed7cdd350c0701cc
Author: Li Wang <liwang@nudt.edu.cn>
Date:   Thu Jan 19 09:44:36 2012 +0800

    eCryptfs: Infinite loop due to overflow in ecryptfs_write()

    commit 684a3ff7e69acc7c678d1a1394fe9e757993fd34 upstream.

    ecryptfs_write() can enter an infinite loop when truncating a file to a
    size larger than 4G. This only happens on architectures where size_t is
    represented by 32 bits.

    This was caused by a size_t overflow due to it incorrectly being used to
    store the result of a calculation which uses potentially large values of
    type loff_t.

    [tyhicks@canonical.com: rewrite subject and commit message]
    Signed-off-by: Li Wang <liwang@nudt.edu.cn>
    Signed-off-by: Yunchuan Wen <wenyunchuan@kylinos.com.cn>
    Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dade9ad146b19c22141032d84190d2220623d2ca
Author: Eugeni Dodonov <eugeni.dodonov@intel.com>
Date:   Sat Jan 7 23:40:35 2012 -0200

    drm/i915: handle 3rd pipe

    commit 07c1e8c1462fa7324de4c36ae9e55da2abd79cee upstream.

    We don't need to check 3rd pipe specifically, as it shares PLL with some
    other one.

    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=41977
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bd26f229584ab3c0470410550d3c69bf3c9d29ee
Author: Rodrigo Vivi <rodrigo.vivi@gmail.com>
Date:   Wed Dec 14 21:10:06 2011 -0200

    drm/i915: Fix TV Out refresh rate.

    commit 23bd15ec662344dc10e9918fdd0dbc58bc71526d upstream.

    TV Out refresh rate was half of the specification for almost all modes.
    Due to this reason pixel clock was so low for some modes causing flickering screen.

    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@gmail.com>
    Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5b19005c6230e6a65d3fe3de8f514feac7d2eebb
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date:   Sun Nov 27 18:58:17 2011 +0100

    drm/i915: check ACTHD of all rings

    commit 097354eb14fa94d31a09c64d640643f58e4a5a9a upstream.

    Otherwise hangcheck spuriously fires when running blitter/bsd-only
    workloads.

    Contrary to a similar patch by Ben Widawsky this does not check
    INSTDONE of the other rings. Chris Wilson implied that in a failure to
    detect a hang, most likely because INSTDONE was fluctuating. Thus only
    check ACTHD, which as far as I know is rather reliable. Also, blitter
    and bsd rings can't launch complex tasks from a single instruction
    (like 3D_PRIM on the render with complex or even infinite shaders).

    This fixes spurious gpu hang detection when running
    tests/gem_hangcheck_forcewake on snb/ivb.

    Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1f8991ccf771442ae2423971798a6ca9d6db6343
Author: Wu Fengguang <fengguang.wu@intel.com>
Date:   Fri Dec 9 20:42:21 2011 +0800

    drm/i915: DisplayPort hot remove notification to audio driver

    commit 832afda6a7d7235ef0e09f4ec46736861540da6d upstream.

    On DP monitor hot remove, clear DP_AUDIO_OUTPUT_ENABLE accordingly,
    so that the audio driver will receive hot plug events and take action
    to refresh its device state and ELD contents.

    Note that the DP_AUDIO_OUTPUT_ENABLE bit may be enabled or disabled
    only when the link training is complete and set to "Normal".

    Tested OK for both hot plug/remove and DPMS on/off.

    Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 032aa01c0b53e12b3ac46db8e7202a3230a83a89
Author: Wu Fengguang <fengguang.wu@intel.com>
Date:   Fri Dec 9 20:42:20 2011 +0800

    drm/i915: HDMI hot remove notification to audio driver

    commit 2deed761188d7480eb5f7efbfe7aa77f09322ed8 upstream.

    On HDMI monitor hot remove, clear SDVO_AUDIO_ENABLE accordingly, so that
    the audio driver will receive hot plug events and take action to refresh
    its device state and ELD contents.

    The cleared SDVO_AUDIO_ENABLE bit needs to be restored to prevent losing
    HDMI audio after DPMS on.

    CC: Wang Zhenyu <zhenyu.z.wang@intel.com>
    Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1357ed0b4b9db30846377febb40a847d6103c991
Author: Jan Kara <jack@suse.cz>
Date:   Fri Dec 23 11:53:07 2011 +0100

    udf: Mark LVID buffer as uptodate before marking it dirty

    commit 853a0c25baf96b028de1654bea1e0c8857eadf3d upstream.

    When we hit EIO while writing LVID, the buffer uptodate bit is cleared.
    This then results in an anoying warning from mark_buffer_dirty() when we
    write the buffer again. So just set uptodate flag unconditionally.

    Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
    Signed-off-by: Jan Kara <jack@suse.cz>
    Cc: Dave Jones <davej@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 10f672f1a199240bc2a77d6f81e1d37f33ba743e
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Tue Sep 20 11:41:54 2011 +0100

    ASoC: Ensure we generate a driver name

    commit f0e8ed858edb327802ee65fd695cc1538286226f upstream.

    Commit 873bd4c (ASoC: Don't set invalid name string to snd_card->driver
    field) broke generation of a driver name for all ASoC cards relying on the
    automatic generation of one. Fix this by using the old default with spaces
    replaced by underscores.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Acked-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c27711dc7f2cff89cee6a47026d936672cb29350
Author: Chanho Min <chanho0207@gmail.com>
Date:   Thu Jan 5 20:00:19 2012 +0900

    sched/rt: Fix task stack corruption under __ARCH_WANT_INTERRUPTS_ON_CTXSW

    commit cb297a3e433dbdcf7ad81e0564e7b804c941ff0d upstream.

    This issue happens under the following conditions:

     1. preemption is off
     2. __ARCH_WANT_INTERRUPTS_ON_CTXSW is defined
     3. RT scheduling class
     4. SMP system

    Sequence is as follows:

     1.suppose current task is A. start schedule()
     2.task A is enqueued pushable task at the entry of schedule()
       __schedule
        prev = rq->curr;
        ...
        put_prev_task
         put_prev_task_rt
          enqueue_pushable_task
     4.pick the task B as next task.
       next = pick_next_task(rq);
     3.rq->curr set to task B and context_switch is started.
       rq->curr = next;
     4.At the entry of context_swtich, release this cpu's rq->lock.
       context_switch
        prepare_task_switch
         prepare_lock_switch
          raw_spin_unlock_irq(&rq->lock);
     5.Shortly after rq->lock is released, interrupt is occurred and start IRQ context
     6.try_to_wake_up() which called by ISR acquires rq->lock
        try_to_wake_up
         ttwu_remote
          rq = __task_rq_lock(p)
          ttwu_do_wakeup(rq, p, wake_flags);
            task_woken_rt
     7.push_rt_task picks the task A which is enqueued before.
       task_woken_rt
        push_rt_tasks(rq)
         next_task = pick_next_pushable_task(rq)
     8.At find_lock_lowest_rq(), If double_lock_balance() returns 0,
       lowest_rq can be the remote rq.
      (But,If preemption is on, double_lock_balance always return 1 and it
       does't happen.)
       push_rt_task
        find_lock_lowest_rq
         if (double_lock_balance(rq, lowest_rq))..
     9.find_lock_lowest_rq return the available rq. task A is migrated to
       the remote cpu/rq.
       push_rt_task
        ...
        deactivate_task(rq, next_task, 0);
        set_task_cpu(next_task, lowest_rq->cpu);
        activate_task(lowest_rq, next_task, 0);
     10. But, task A is on irq context at this cpu.
         So, task A is scheduled by two cpus at the same time until restore from IRQ.
         Task A's stack is corrupted.

    To fix it, don't migrate an RT task if it's still running.

    Signed-off-by: Chanho Min <chanho.min@lge.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Acked-by: Steven Rostedt <rostedt@goodmis.org>
    Link: http://lkml.kernel.org/r/CAOAMb1BHA=5fm7KTewYyke6u-8DP0iUuJMpgQw54vNeXFsGpoQ@mail.gmail.com
    Signed-off-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 32c4490a6ffbe3de604581f5fdce361eb049acff
Author: Seth Forshee <seth.forshee@canonical.com>
Date:   Tue Jan 31 19:06:25 2012 -0600

    drm/radeon/kms: disable output polling when suspended

    commit 86698c20f71d488b32c49ed4687fb3cf8a88a5ca upstream.

    Polling the outputs when the device is suspended can result in erroneous
    status updates. Disable output polling during suspend to prevent this
    from happening.

    Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e1cf4ad959d7b2644f2be70ff38030d6cd3cbede
Author: Ben Skeggs <bskeggs@redhat.com>
Date:   Tue Jan 10 10:18:28 2012 +1000

    drm/nouveau/gem: fix fence_sync race / oops

    commit 525895ba388c949aa906f26e3ec5cb1ab041f56b upstream.

    Due to a race it was possible for a fence to be destroyed while another
    thread was trying to synchronise with it.  If this happened in the fallback
    non-semaphore path, it lead to the following oops due to fence->channel
    being NULL.

    BUG: unable to handle kernel NULL pointer dereference at   (null)
    IP: [<fa9632ce>] nouveau_fence_update+0xe/0xe0 [nouveau]
    *pde = a649c067
    SMP
    Modules linked in: fuse nouveau(O) ttm(O) drm_kms_helper(O) drm(O) mxm_wmi video wmi netconsole configfs lockd bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_realtek snd_hda_intel snd_hda_cobinfmt_misc uinput ata_generic pata_acpi pata_aet2c_algo_bit i2c_core [last unloaded: wmi]

    Pid: 2255, comm: gnome-shell Tainted: G           O 3.2.0-0.rc5.git0.1.fc17.i686 #1 System manufacturer System Product Name/M2A-VM
    EIP: 0060:[<fa9632ce>] EFLAGS: 00010296 CPU: 1
    EIP is at nouveau_fence_update+0xe/0xe0 [nouveau]
    EAX: 00000000 EBX: ddfc6dd0 ECX: dd111580 EDX: 00000000
    ESI: 00003e80 EDI: dd111580 EBP: dd121d00 ESP: dd121ce8
     DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
    Process gnome-shell (pid: 2255, ti=dd120000 task=dd111580 task.ti=dd120000)
    Stack:
     7dc86c76 00000000 00003e80 ddfc6dd0 00003e80 dd111580 dd121d0c fa96371f
     00000000 dd121d3c fa963773 dd111580 01000246 000ec53d 00000000 ddfc6dd0
     00001f40 00000000 ddfc6dd0 00000010 dc7df840 dd121d6c fa9639a0 00000000
    Call Trace:
     [<fa96371f>] __nouveau_fence_signalled+0x1f/0x30 [nouveau]
     [<fa963773>] __nouveau_fence_wait+0x43/0xd0 [nouveau]
     [<fa9639a0>] nouveau_fence_sync+0x1a0/0x1c0 [nouveau]
     [<fa964046>] validate_list+0x176/0x300 [nouveau]
     [<f7d9c9c0>] ? ttm_bo_mem_put+0x30/0x30 [ttm]
     [<fa964b8a>] nouveau_gem_ioctl_pushbuf+0x48a/0xfd0 [nouveau]
     [<c0406481>] ? die+0x31/0x80
     [<f7c93d98>] drm_ioctl+0x388/0x490 [drm]
     [<c0406481>] ? die+0x31/0x80
     [<fa964700>] ? nouveau_gem_ioctl_new+0x150/0x150 [nouveau]
     [<c0635c7b>] ? file_has_perm+0xcb/0xe0
     [<f7c93a10>] ? drm_copy_field+0x80/0x80 [drm]
     [<c0564f56>] do_vfs_ioctl+0x86/0x5b0
     [<c0406481>] ? die+0x31/0x80
     [<c0635f22>] ? selinux_file_ioctl+0x62/0x130
     [<c0554f30>] ? fget_light+0x30/0x340
     [<c05654ef>] sys_ioctl+0x6f/0x80
     [<c099e3a4>] syscall_call+0x7/0xb
     [<c0406481>] ? die+0x31/0x80
     [<c0406481>] ? die+0x31/0x80

    Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f5e9a83833c2effd51bb138b598636f4ed661498
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Wed Feb 1 12:09:55 2012 +0100

    drm/radeon: Set DESKTOP_HEIGHT register to the framebuffer (not mode) height.

    commit 1b61925061660009f5b8047f93c5297e04541273 upstream.

    The value of this register is transferred to the V_COUNTER register at the
    beginning of vertical blank. V_COUNTER is the reference for VLINE waits and
    goes from VIEWPORT_Y_START to VIEWPORT_Y_START+VIEWPORT_HEIGHT during scanout,
    so if VIEWPORT_Y_START is not 0, V_COUNTER actually went backwards at the
    beginning of vertical blank, and VLINE waits excluding the whole scanout area
    could never finish (possibly only if VIEWPORT_Y_START is larger than the length
    of vertical blank in scanlines). Setting DESKTOP_HEIGHT to the framebuffer
    height should prevent this for any kind of VLINE wait.

    Fixes https://bugs.freedesktop.org/show_bug.cgi?id=45329 .

    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 77650df5a701fb3a7acadfb347ebfb0e95cffe09
Author: Mel Gorman <mgorman@suse.de>
Date:   Fri Feb 3 15:37:18 2012 -0800

    mm: compaction: check pfn_valid when entering a new MAX_ORDER_NR_PAGES block during isolation for migration

    commit 0bf380bc70ecba68cb4d74dc656cc2fa8c4d801a upstream.

    When isolating for migration, migration starts at the start of a zone
    which is not necessarily pageblock aligned.  Further, it stops isolating
    when COMPACT_CLUSTER_MAX pages are isolated so migrate_pfn is generally
    not aligned.  This allows isolate_migratepages() to call pfn_to_page() on
    an invalid PFN which can result in a crash.  This was originally reported
    against a 3.0-based kernel with the following trace in a crash dump.

    PID: 9902   TASK: d47aecd0  CPU: 0   COMMAND: "memcg_process_s"
     #0 [d72d3ad0] crash_kexec at c028cfdb
     #1 [d72d3b24] oops_end at c05c5322
     #2 [d72d3b38] __bad_area_nosemaphore at c0227e60
     #3 [d72d3bec] bad_area at c0227fb6
     #4 [d72d3c00] do_page_fault at c05c72ec
     #5 [d72d3c80] error_code (via page_fault) at c05c47a4
        EAX: 00000000  EBX: 000c0000  ECX: 00000001  EDX: 00000807  EBP: 000c0000
        DS:  007b      ESI: 00000001  ES:  007b      EDI: f3000a80  GS:  6f50
        CS:  0060      EIP: c030b15a  ERR: ffffffff  EFLAGS: 00010002
     #6 [d72d3cb4] isolate_migratepages at c030b15a
     #7 [d72d3d14] zone_watermark_ok at c02d26cb
     #8 [d72d3d2c] compact_zone at c030b8de
     #9 [d72d3d68] compact_zone_order at c030bba1
    #10 [d72d3db4] try_to_compact_pages at c030bc84
    #11 [d72d3ddc] __alloc_pages_direct_compact at c02d61e7
    #12 [d72d3e08] __alloc_pages_slowpath at c02d66c7
    #13 [d72d3e78] __alloc_pages_nodemask at c02d6a97
    #14 [d72d3eb8] alloc_pages_vma at c030a845
    #15 [d72d3ed4] do_huge_pmd_anonymous_page at c03178eb
    #16 [d72d3f00] handle_mm_fault at c02f36c6
    #17 [d72d3f30] do_page_fault at c05c70ed
    #18 [d72d3fb0] error_code (via page_fault) at c05c47a4
        EAX: b71ff000  EBX: 00000001  ECX: 00001600  EDX: 00000431
        DS:  007b      ESI: 08048950  ES:  007b      EDI: bfaa3788
        SS:  007b      ESP: bfaa36e0  EBP: bfaa3828  GS:  6f50
        CS:  0073      EIP: 080487c8  ERR: ffffffff  EFLAGS: 00010202

    It was also reported by Herbert van den Bergh against 3.1-based kernel
    with the following snippet from the console log.

    BUG: unable to handle kernel paging request at 01c00008
    IP: [<c0522399>] isolate_migratepages+0x119/0x390
    *pdpt = 000000002f7ce001 *pde = 0000000000000000

    It is expected that it also affects 3.2.x and current mainline.

    The problem is that pfn_valid is only called on the first PFN being
    checked and that PFN is not necessarily aligned.  Lets say we have a case
    like this

    H = MAX_ORDER_NR_PAGES boundary
    | = pageblock boundary
    m = cc->migrate_pfn
    f = cc->free_pfn
    o = memory hole

    H------|------H------|----m-Hoooooo|ooooooH-f----|------H

    The migrate_pfn is just below a memory hole and the free scanner is beyond
    the hole.  When isolate_migratepages started, it scans from migrate_pfn to
    migrate_pfn+pageblock_nr_pages which is now in a memory hole.  It checks
    pfn_valid() on the first PFN but then scans into the hole where there are
    not necessarily valid struct pages.

    This patch ensures that isolate_migratepages calls pfn_valid when
    necessary.

    Reported-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
    Tested-by: Herbert van den Bergh <herbert.van.den.bergh@oracle.com>
    Signed-off-by: Mel Gorman <mgorman@suse.de>
    Acked-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c713decb179258db83fd048c09ec55d521d864d4
Author: Carsten Otte <carsteno@de.ibm.com>
Date:   Fri Feb 3 15:37:14 2012 -0800

    mm/filemap_xip.c: fix race condition in xip_file_fault()

    commit 99f02ef1f18631eb0a4e0ea0a3d56878dbcb4b90 upstream.

    Fix a race condition that shows in conjunction with xip_file_fault() when
    two threads of the same user process fault on the same memory page.

    In this case, the race winner will install the page table entry and the
    unlucky loser will cause an oops: xip_file_fault calls vm_insert_pfn (via
    vm_insert_mixed) which drops out at this check:

    	retval = -EBUSY;
    	if (!pte_none(*pte))
    		goto out_unlock;

    The resulting -EBUSY return value will trigger a BUG_ON() in
    xip_file_fault.

    This fix simply considers the fault as fixed in this case, because the
    race winner has successfully installed the pte.

    [akpm@linux-foundation.org: use conventional (and consistent) comment layout]
    Reported-by: David Sadler <dsadler@us.ibm.com>
    Signed-off-by: Carsten Otte <cotte@de.ibm.com>
    Reported-by: Louis Alex Eisner <leisner@cs.ucsd.edu>
    Cc: Hugh Dickins <hughd@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 73632d80356dcadfcacc8e20a319850b112abb9b
Author: Nikolaus Voss <n.voss@weinmann.de>
Date:   Tue Jan 17 10:28:33 2012 +0100

    at_hdmac: bugfix for enabling channel irq

    commit bda3a47c886664e86ee14eb79e9072b9e341f575 upstream.

    commit 463894705e4089d0ff69e7d877312d496ac70e5b deleted redundant
    chan_id and chancnt initialization in dma drivers as this is done
    in dma_async_device_register().

    However, atc_enable_irq() relied on chan_id set before registering
    the device, what left only channel 0 functional for this driver.

    This patch introduces atc_enable/disable_chan_irq() as a variant
    of atc_enable/disable_irq() with the channel as explicit argument.

    Signed-off-by: Nikolaus Voss <n.voss@weinmann.de>
    Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 603b63484725a6e88e4ae5da58716efd88154b1e
Author: Jiang Liu <liuj97@gmail.com>
Date:   Fri Feb 3 15:37:16 2012 -0800

    kprobes: fix a memory leak in function pre_handler_kretprobe()

    commit 55ca6140e9bb307efc97a9301a4f501de02a6fd6 upstream.

    In function pre_handler_kretprobe(), the allocated kretprobe_instance
    object will get leaked if the entry_handler callback returns non-zero.
    This may cause all the preallocated kretprobe_instance objects exhausted.

    This issue can be reproduced by changing
    samples/kprobes/kretprobe_example.c to probe "mutex_unlock".  And the fix
    is straightforward: just put the allocated kretprobe_instance object back
    onto the free_instances list.

    [akpm@linux-foundation.org: use raw_spin_lock/unlock]
    Signed-off-by: Jiang Liu <jiang.liu@huawei.com>
    Acked-by: Jim Keniston <jkenisto@us.ibm.com>
    Acked-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
    Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
    Cc: "David S. Miller" <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 55d9f089521b1355cdd6914d1186ae02ddc0f74f
Author: Jack Morgenstein <jackm@mellanox.com>
Date:   Thu Jan 26 16:41:33 2012 +0200

    IB/mlx4: pass SMP vendor-specific attribute MADs to firmware

    commit a6f7feae6d19e84253918d88b04153af09d3a243 upstream.

    In the current code, vendor-specific MADs (e.g with the FDR-10
    attribute) are silently dropped by the driver, resulting in timeouts
    at the sending side and inability to query/configure the relevant
    feature.  However, the ConnectX firmware is able to handle such MADs.
    For unsupported attributes, the firmware returns a GET_RESPONSE MAD
    containing an error status.

    For example, for a FDR-10 node with LID 11:

        # ibstat mlx4_0 1

        CA: 'mlx4_0'
        Port 1:
        State: Active
        Physical state: LinkUp
        Rate: 40 (FDR10)
        Base lid: 11
        LMC: 0
        SM lid: 24
        Capability mask: 0x02514868
        Port GUID: 0x0002c903002e65d1
        Link layer: InfiniBand

    Extended Port Query (EPI) vendor mad timeouts before the patch:

        # smpquery MEPI 11 -d

        ibwarn: [4196] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
        ibwarn: [4196] _do_madrpc: retry 1 (timeout 1000 ms)
        ibwarn: [4196] _do_madrpc: retry 2 (timeout 1000 ms)
        ibwarn: [4196] _do_madrpc: timeout after 3 retries, 3000 ms
        ibwarn: [4196] mad_rpc: _do_madrpc failed; dport (Lid 11)
        smpquery: iberror: [pid 4196] main: failed: operation EPI: ext port info query failed

    EPI query works OK with the patch:

        # smpquery MEPI 11 -d

        ibwarn: [6548] smp_query_via: attr 0xff90 mod 0x0 route Lid 11
        ibwarn: [6548] mad_rpc: data offs 64 sz 64
        mad data
        0000 0000 0000 0001 0000 0001 0000 0001
        0000 0000 0000 0000 0000 0000 0000 0000
        0000 0000 0000 0000 0000 0000 0000 0000
        0000 0000 0000 0000 0000 0000 0000 0000
        # Ext Port info: Lid 11 port 0
        StateChangeEnable:...............0x00
        LinkSpeedSupported:..............0x01
        LinkSpeedEnabled:................0x01
        LinkSpeedActive:.................0x01

    Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Acked-by: Ira Weiny <weiny2@llnl.gov>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2f8080ae4ebf8d860addf050536b1ec71c53e19
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sun Jan 29 12:41:15 2012 +0100

    firewire: ohci: disable MSI on Ricoh controllers

    commit 320cfa6ce0b3dc794fedfa4bae54c0f65077234d upstream.

    The PCIe device

        FireWire (IEEE 1394) [0c00]: Ricoh Co Ltd FireWire Host Controller
        [1180:e832] (prog-if 10 [OHCI])

    is unable to access attached FireWire devices when MSI is enabled but
    works if MSI is disabled.
    http://www.mail-archive.com/alsa-user@lists.sourceforge.net/msg28251.html

    Hence add the "disable MSI" quirks flag for this device, or in fact for
    safety and simplicity for all current (R5U230, R5U231, R5U240) and
    future Ricoh PCIe 1394 controllers.

    Reported-by: Stefan Thomas <kontrapunktstefan@googlemail.com>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 914dcd6a7120a034c515605ca509cb7e6767f52c
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Thu Jan 26 22:05:58 2012 +0100

    firewire: ohci: add reset packet quirk for SB Audigy

    commit d1bb399ad03c11e792f6dea198d3b1e23061f094 upstream.

    The Audigy's SB1394 controller is actually from Texas Instruments
    and has the same bus reset packet generation bug, so it needs the
    same quirk entry.

    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0053779e04bbfabe31287245d89ad10bb66e758a
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:15:11 2012 +0100

    proc: make sure mem_open() doesn't pin the target's memory

    commit 6d08f2c7139790c268820a2e590795cb8333181a upstream.

    Once /proc/pid/mem is opened, the memory can't be released until
    mem_release() even if its owner exits.

    Change mem_open() to do atomic_inc(mm_count) + mmput(), this only
    pins mm_struct. Change mem_rw() to do atomic_inc_not_zero(mm_count)
    before access_remote_vm(), this verifies that this mm is still alive.

    I am not sure what should mem_rw() return if atomic_inc_not_zero()
    fails. With this patch it returns zero to match the "mm == NULL" case,
    may be it should return -EINVAL like it did before e268337d.

    Perhaps it makes sense to add the additional fatal_signal_pending()
    check into the main loop, to ensure we do not hold this memory if
    the target task was oom-killed.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b49767a65a6454f7d546068a785e25dbb0eabbcd
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:14:54 2012 +0100

    proc: unify mem_read() and mem_write()

    commit 572d34b946bae070debd42db1143034d9687e13f upstream.

    No functional changes, cleanup and preparation.

    mem_read() and mem_write() are very similar. Move this code into the
    new common helper, mem_rw(), which takes the additional "int write"
    argument.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 401f63716ca0bca1728e55ccf2132fb3785cf5da
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Jan 31 17:14:38 2012 +0100

    proc: mem_release() should check mm != NULL

    commit 71879d3cb3dd8f2dfdefb252775c1b3ea04a3dd4 upstream.

    mem_release() can hit mm == NULL, add the necessary check.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 344d390bcb4c796b4b7797395cfc07e2c43d935d
Author: Samuel Thibault <samuel.thibault@ens-lyon.org>
Date:   Fri Feb 3 15:37:15 2012 -0800

    drivers/tty/vt/vt_ioctl.c: fix KDFONTOP 32bit compatibility layer

    commit cbcb8346054073d000ecac324763372d6abd44ac upstream.

    KDFONTOP(GET) currently fails with EIO when being run in a 32bit userland
    with a 64bit kernel if the font width is not 8.

    This is because of the setting of the KD_FONT_FLAG_OLD flag, which makes
    con_font_get return EIO in such case.

    This flag should *not* be set for KDFONTOP, since it's actually the whole
    point of this flag (see comment in con_font_set for instance).

    Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
    Reviewed-by: Arnd Bergmann <arnd@arndb.de>
    Cc: Arthur Taylor <art@ified.ca>
    Cc: Jiri Slaby <jslaby@suse.cz>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 17f272d8e4349543de855ea63e4eea4a67a7abc5
Author: Yegor Yefremov <yegor_sub1@visionsystems.de>
Date:   Mon Jan 23 08:32:23 2012 +0100

    ARM: OMAP2+: GPMC: fix device size setup

    commit 8ef5d844cc3a644ea6f7665932a4307e9fad01fa upstream.

    following statement can only change device size from 8-bit(0) to 16-bit(1),
    but not vice versa:

    regval |= GPMC_CONFIG1_DEVICESIZE(wval);

    so as this field has 1 reserved bit, that could be used in future,
    just clear both bits and then OR with the desired value

    Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
    Signed-off-by: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e358073331debaab9e14b3139bc469184288aa48
Author: Will Deacon <will.deacon@arm.com>
Date:   Mon Jan 30 20:23:29 2012 +0100

    ARM: 7308/1: vfp: flush thread hwstate before copying ptrace registers

    commit 8130b9d7b9d858aa04ce67805e8951e3cb6e9b2f upstream.

    If we are context switched whilst copying into a thread's
    vfp_hard_struct then the partial copy may be corrupted by the VFP
    context switching code (see "ARM: vfp: flush thread hwstate before
    restoring context from sigframe").

    This patch updates the ptrace VFP set code so that the thread state is
    flushed before the copy, therefore disabling VFP and preventing
    corruption from occurring.

    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae3939e12cc597be0ba28d5f3b3d8f158f2d6d70
Author: Dave Martin <dave.martin@linaro.org>
Date:   Mon Jan 30 20:22:28 2012 +0100

    ARM: 7307/1: vfp: fix ptrace regset modification race

    commit 247f4993a5974e6759606c4d380748eecfd273ff upstream.

    In a preemptible kernel, vfp_set() can be preempted, causing the
    hardware VFP context to be switched while the thread vfp state is
    being read and modified.  This leads to a race condition which can
    cause the thread vfp state to become corrupted if lazy VFP context
    save occurs due to preemption in between the time thread->vfpstate
    is read and the time the modified state is written back.

    This may occur if preemption occurs during the execution of a
    ptrace() call which modifies the VFP register state of a thread.
    Such instances should be very rare in most realistic scenarios --
    none has been reported, so far as I am aware.  Only uniprocessor
    systems should be affected, since VFP context save is not currently
    lazy in SMP kernels.

    The problem was introduced by my earlier patch migrating to use
    regsets to implement ptrace.

    This patch does a vfp_sync_hwstate() before reading
    thread->vfpstate, to make sure that the thread's VFP state is not
    live in the hardware registers while the registers are modified.

    Thanks to Will Deacon for spotting this.

    Signed-off-by: Dave Martin <dave.martin@linaro.org>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 886d462b0c92357a2f0ca0fc19f5877efbb1f638
Author: Will Deacon <will.deacon@arm.com>
Date:   Mon Jan 30 20:21:42 2012 +0100

    ARM: 7306/1: vfp: flush thread hwstate before restoring context from sigframe

    commit 2af276dfb1722e97b190bd2e646b079a2aa674db upstream.

    Following execution of a signal handler, we currently restore the VFP
    context from the ucontext in the signal frame. This involves copying
    from the user stack into the current thread's vfp_hard_struct and then
    flushing the new data out to the hardware registers.

    This is problematic when using a preemptible kernel because we could be
    context switched whilst updating the vfp_hard_struct. If the current
    thread has made use of VFP since the last context switch, the VFP
    notifier will copy from the hardware registers into the vfp_hard_struct,
    overwriting any data that had been partially copied by the signal code.

    Disabling preemption across copy_from_user calls is a terrible idea, so
    instead we move the VFP thread flush *before* we update the
    vfp_hard_struct. Since the flushing is performed lazily, this has the
    effect of disabling VFP and clearing the CPU's VFP state pointer,
    therefore preventing the thread from being updated with stale data on
    the next context switch.

    Tested-by: Peter Maydell <peter.maydell@linaro.org>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2eeb4b984210336662a9ebdbecb96efd8823ff2
Author: UK KIM <w0806.kim@samsung.com>
Date:   Sat Jan 28 01:52:22 2012 +0900

    ASoC: wm_hubs: fix wrong bits for LINEOUT2 N/P mixer

    commit 114395c61ad2eb5a7a5cd163fcadb2414e48245a upstream.

    Signed-off-by: UK KIM <w0806.kim@samsung.com>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2cf7d6f29728c367ac742e7e17d89d8d9b6caeba
Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
Date:   Fri Jan 20 12:19:43 2012 +0000

    ASoC: wm_hubs: Enable line out VMID buffer for single ended line outputs

    commit 77231abe55433aa17eca712718745275853fa66d upstream.

    For optimal performance the single ended line outputs require that the
    line output VMID buffer be enabled.

    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3fe10cf8e23ed6e32c09c05303df7e66abdb7e39
Author: David Henningsson <david.henningsson@canonical.com>
Date:   Wed Feb 1 12:05:41 2012 +0100

    ALSA: HDA: Fix duplicated output to more than one codec

    commit 54c2a89f60fd71b924d0f848ac892442951401a6 upstream.

    This typo caused the wrong codec's nid to be checked for wcaps type.
    As a result, sometimes speakers would duplicate the output sent to
    HDMI output.

    BugLink: https://bugs.launchpad.net/bugs/924320
    Signed-off-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99067d691614385f824b42f9a02da9708e66dbb6
Author: Shaohua Li <shaohua.li@intel.com>
Date:   Fri Feb 3 15:37:17 2012 -0800

    readahead: fix pipeline break caused by block plug

    commit 3deaa7190a8da38453c4fabd9dec7f66d17fff67 upstream.

    Herbert Poetzl reported a performance regression since 2.6.39.  The test
    is a simple dd read, but with big block size.  The reason is:

    T1: ra (A, A+128k), (A+128k, A+256k)
    T2: lock_page for page A, submit the 256k
    T3: hit page A+128K, ra (A+256k, A+384). the range isn't submitted
    because of plug and there isn't any lock_page till we hit page A+256k
    because all pages from A to A+256k is in memory
    T4: hit page A+256k, ra (A+384, A+ 512). Because of plug, the range isn't
    submitted again.
    T5: lock_page A+256k, so (A+256k, A+512k) will be submitted. The task is
    waitting for (A+256k, A+512k) finish.

    There is no request to disk in T3 and T4, so readahead pipeline breaks.

    We really don't need block plug for generic_file_aio_read() for buffered
    I/O.  The readahead already has plug and has fine grained control when I/O
    should be submitted.  Deleting plug for buffered I/O fixes the regression.

    One side effect is plug makes the request size 256k, the size is 128k
    without it.  This is because default ra size is 128k and not a reason we
    need plug here.

    Vivek said:

    : We submit some readahead IO to device request queue but because of nested
    : plug, queue never gets unplugged.  When read logic reaches a page which is
    : not in page cache, it waits for page to be read from the disk
    : (lock_page_killable()) and that time we flush the plug list.
    :
    : So effectively read ahead logic is kind of broken in parts because of
    : nested plugging.  Removing top level plug (generic_file_aio_read()) for
    : buffered reads, will allow unplugging queue earlier for readahead.

    Signed-off-by: Shaohua Li <shaohua.li@intel.com>
    Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
    Reported-by: Herbert Poetzl <herbert@13thfloor.at>
    Tested-by: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Christoph Hellwig <hch@infradead.org>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Vivek Goyal <vgoyal@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>