Linux 3.0.77

commit bff066a411684d07e23307405f03cf7e7fc4afab
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Tue May 7 20:08:48 2013 -0700

    Linux 3.0.77

commit 97a0b301f6520690724602497c699890144ccff6
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Mon May 6 11:30:43 2013 -0700

    Revert :can: sja1000: fix handling on dt properties on little endian systems"

    This reverts commit 55fe10a686c3a8bce7bddc149e4ebb12f5a18c25 which is
    commit 0443de5fbf224abf41f688d8487b0c307dc5a4b4 upstream.

    This causes a build breakage on 3.0, so we shouldn't apply it to that
    tree.

    Reported-by: Jiri Slaby <jslaby@suse.cz>
    Cc: Christoph Fritz <chf.fritz@googlemail.com>
    Cc: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2232c3d8b3d44591be5e7426b368858da68048ac
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Apr 17 08:46:19 2013 -0700

    s390: move dummy io_remap_pfn_range() to asm/pgtable.h

    commit 4f2e29031e6c67802e7370292dd050fd62f337ee upstream.

    Commit b4cbb197c7e7 ("vm: add vm_iomap_memory() helper function") added
    a helper function wrapper around io_remap_pfn_range(), and every other
    architecture defined it in <asm/pgtable.h>.

    The s390 choice of <asm/io.h> may make sense, but is not very convenient
    for this case, and gratuitous differences like that cause unexpected errors like this:

       mm/memory.c: In function 'vm_iomap_memory':
       mm/memory.c:2439:2: error: implicit declaration of function 'io_remap_pfn_range' [-Werror=implicit-function-declaration]

    Glory be the kbuild test robot who noticed this, bisected it, and
    reported it to the guilty parties (ie me).

    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
    Cc: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eadb89490b7b35a5fbb169dfc59e7a3d07b4c492
Author: Lars-Peter Clausen <lars@metafoo.de>
Date:   Tue Feb 19 11:51:22 2013 +0100

    mfd: adp5520: Restore mode bits on resume

    commit c6cc25fda58da8685ecef3f179adc7b99c8253b2 upstream.

    The adp5520 unfortunately also clears the BL_EN bit when the nSTNDBY bit is
    cleared. So we need to make sure to restore it during resume if it was set
    before suspend.

    Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
    Acked-by: Michael Hennerich <michael.hennerich@analog.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 92e5cc743134cec1532b43fa2b97340effd956a8
Author: Philip Rakity <prakity@yahoo.com>
Date:   Thu Apr 4 20:18:11 2013 +0100

    mmc: core: Fix bit width test failing on old eMMC cards

    commit 836dc2fe89c968c10cada87e0dfae6626f8f9da3 upstream.

    PARTITION_SUPPORT needs to be set before doing the compare on version
    number so the bit width test does not get invalid data.  Before this
    patch, a Sandisk iNAND eMMC card would detect 1-bit width although
    the hardware supports 4-bit.

    Only affects old emmc devices - pre 4.4 devices.

    Reported-by: Elad Yi <elad.yi@gmail.com>
    Signed-off-by: Philip Rakity <prakity@yahoo.com>
    Signed-off-by: Chris Ball <cjb@laptop.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e34eca4c2d2f1783c94fad22d72ebb304c3f0728
Author: Li Fei <fei.li@intel.com>
Date:   Fri Apr 26 20:50:11 2013 +0800

    x86: Eliminate irq_mis_count counted in arch_irq_stat

    commit f7b0e1055574ce06ab53391263b4e205bf38daf3 upstream.

    With the current implementation, kstat_cpu(cpu).irqs_sum is also
    increased in case of irq_mis_count increment.

    So there is no need to count irq_mis_count in arch_irq_stat,
    otherwise irq_mis_count will be counted twice in the sum of
    /proc/stat.

    Reported-by: Liu Chuansheng <chuansheng.liu@intel.com>
    Signed-off-by: Li Fei <fei.li@intel.com>
    Acked-by: Liu Chuansheng <chuansheng.liu@intel.com>
    Cc: tomoki.sekiyama.qu@hitachi.com
    Cc: joe@perches.com
    Link: http://lkml.kernel.org/r/1366980611.32469.7.camel@fli24-HP-Compaq-8100-Elite-CMT-PC
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8b715460ae5db65f37aefdd3d1330189e193f789
Author: Theodore Ts'o <tytso@mit.edu>
Date:   Sun Apr 21 20:32:03 2013 -0400

    ext4: fix Kconfig documentation for CONFIG_EXT4_DEBUG

    commit 7f3e3c7cfcec148ccca9c0dd2dbfd7b00b7ac10f upstream.

    Fox the Kconfig documentation for CONFIG_EXT4_DEBUG to match the
    change made by commit a0b30c1229: ext4: use module parameters instead
    of debugfs for mballoc_debug

    Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b2bdb66b65fcbdd4f3a3d08c28e4c46b4a59364
Author: Robin Holt <holt@sgi.com>
Date:   Tue Apr 30 19:15:54 2013 -0700

    ipc: sysv shared memory limited to 8TiB

    commit d69f3bad4675ac519d41ca2b11e1c00ca115cecd upstream.

    Trying to run an application which was trying to put data into half of
    memory using shmget(), we found that having a shmall value below 8EiB-8TiB
    would prevent us from using anything more than 8TiB.  By setting
    kernel.shmall greater than 8EiB-8TiB would make the job work.

    In the newseg() function, ns->shm_tot which, at 8TiB is INT_MAX.

    ipc/shm.c:
     458 static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
     459 {
    ...
     465         int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
    ...
     474         if (ns->shm_tot + numpages > ns->shm_ctlall)
     475                 return -ENOSPC;

    [akpm@linux-foundation.org: make ipc/shm.c:newseg()'s numpages size_t, not int]
    Signed-off-by: Robin Holt <holt@sgi.com>
    Reported-by: Alex Thorlton <athorlton@sgi.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d2a51f02ccc6fac30f8cdb7e5f2791b2fe43d129
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Tue Apr 16 14:32:26 2013 +0200

    wireless: regulatory: fix channel disabling race condition

    commit 990de49f74e772b6db5208457b7aa712a5f4db86 upstream.

    When a full scan 2.4 and 5 GHz scan is scheduled, but then the 2.4 GHz
    part of the scan disables a 5.2 GHz channel due to, e.g. receiving
    country or frequency information, that 5.2 GHz channel might already
    be in the list of channels to scan next. Then, when the driver checks
    if it should do a passive scan, that will return false and attempt an
    active scan. This is not only wrong but can also lead to the iwlwifi
    device firmware crashing since it checks regulatory as well.

    Fix this by not setting the channel flags to just disabled but rather
    OR'ing in the disabled flag. That way, even if the race happens, the
    channel will be scanned passively which is still (mostly) correct.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cfb0a900641f0d5c84bc1e68bbf3e312ae37c549
Author: Bryan Schumaker <bjschuma@netapp.com>
Date:   Fri Apr 19 16:09:38 2013 -0400

    nfsd: Decode and send 64bit time values

    commit bf8d909705e9d9bac31d9b8eac6734d2b51332a7 upstream.

    The seconds field of an nfstime4 structure is 64bit, but we are assuming
    that the first 32bits are zero-filled.  So if the client tries to set
    atime to a value before the epoch (touch -t 196001010101), then the
    server will save the wrong value on disk.

    Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bc2da6406bec3dfffde77426330468e40243b1ea
Author: J. Bruce Fields <bfields@redhat.com>
Date:   Thu Mar 28 20:37:14 2013 -0400

    nfsd4: don't close read-write opens too soon

    commit 0c7c3e67ab91ec6caa44bdf1fc89a48012ceb0c5 upstream.

    Don't actually close any opens until we don't need them at all.

    This means being left with write access when it's not really necessary,
    but that's better than putting a file that might still have posix locks
    held on it, as we have been.

    Reported-by: Toralf Förster <toralf.foerster@gmx.de>
    Signed-off-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ebcd3f67c004ee5c51a9379d744e5546be73f227
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Mon Apr 1 15:34:05 2013 -0400

    NFSv4: Handle NFS4ERR_DELAY and NFS4ERR_GRACE in nfs4_open_delegation_recall

    commit 8b6cc4d6f841d31f72fe7478453759166d366274 upstream.

    A server shouldn't normally return NFS4ERR_GRACE if the client holds a
    delegation, since no conflicting lock reclaims can be granted, however
    the spec does not require the server to grant the open in this
    instance

    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3b5f7654971e0dcb6c422d14cbae7309686bb344
Author: Trond Myklebust <Trond.Myklebust@netapp.com>
Date:   Sun Apr 21 18:01:06 2013 -0400

    LOCKD: Ensure that nlmclnt_block resets block->b_status after a server reboot

    commit 1dfd89af8697a299e7982ae740d4695ecd917eef upstream.

    After a server reboot, the reclaimer thread will recover all the existing
    locks. For locks that are blocked, however, it will change the value
    of block->b_status to nlm_lck_denied_grace_period in order to signal that
    they need to wake up and resend the original blocking lock request.

    Due to a bug, however, the block->b_status never gets reset after the
    blocked locks have been woken up, and so the process goes into an
    infinite loop of resends until the blocked lock is satisfied.

    Reported-by: Marc Eshel <eshel@us.ibm.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a35089a9cc44f621e58af899b3483d206bb89284
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Thu Apr 25 11:45:53 2013 +0200

    clockevents: Set dummy handler on CPU_DEAD shutdown

    commit 6f7a05d7018de222e40ca003721037a530979974 upstream.

    Vitaliy reported that a per cpu HPET timer interrupt crashes the
    system during hibernation. What happens is that the per cpu HPET timer
    gets shut down when the nonboot cpus are stopped. When the nonboot
    cpus are onlined again the HPET code sets up the MSI interrupt which
    fires before the clock event device is registered. The event handler
    is still set to hrtimer_interrupt, which then crashes the machine due
    to highres mode not being active.

    See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700333

    There is no real good way to avoid that in the HPET code. The HPET
    code alrady has a mechanism to detect spurious interrupts when event
    handler == NULL for a similar reason.

    We can handle that in the clockevent/tick layer and replace the
    previous functional handler with a dummy handler like we do in
    tick_setup_new_device().

    The original clockevents code did this in clockevents_exchange_device(),
    but that got removed by commit 7c1e76897 (clockevents: prevent
    clockevent event_handler ending up handler_noop) which forgot to fix
    it up in tick_shutdown(). Same issue with the broadcast device.

    Reported-by: Vitaliy Fillipov <vitalif@yourcmc.ru>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Cc: 700333@bugs.debian.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed0a169166af3fc21e3b8ee9f3020298a93f9bd7
Author: Li Zefan <lizefan@huawei.com>
Date:   Tue Mar 12 15:36:00 2013 -0700

    cgroup: fix an off-by-one bug which may trigger BUG_ON()

    commit 3ac1707a13a3da9cfc8f242a15b2fae6df2c5f88 upstream.

    The 3rd parameter of flex_array_prealloc() is the number of elements,
    not the index of the last element.

    The effect of the bug is, when opening cgroup.procs, a flex array will
    be allocated and all elements of the array is allocated with
    GFP_KERNEL flag, but the last one is GFP_ATOMIC, and if we fail to
    allocate memory for it, it'll trigger a BUG_ON().

    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 10eb78f693be5d924d8ae19264efc8da2d6cb8a3
Author: Derek Basehore <dbasehore@chromium.org>
Date:   Mon Apr 29 16:20:23 2013 -0700

    drivers/rtc/rtc-cmos.c: don't disable hpet emulation on suspend

    commit e005715efaf674660ae59af83b13822567e3a758 upstream.

    There's a bug where rtc alarms are ignored after the rtc cmos suspends
    but before the system finishes suspend.  Since hpet emulation is
    disabled and it still handles the interrupts, a wake event is never
    registered which is done from the rtc layer.

    This patch reverts commit d1b2efa83fbf ("rtc: disable hpet emulation on
    suspend") which disabled hpet emulation.  To fix the problem mentioned
    in that commit, hpet_rtc_timer_init() is called directly on resume.

    Signed-off-by: Derek Basehore <dbasehore@chromium.org>
    Cc: Maxim Levitsky <maximlevitsky@gmail.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a0f25ff9b9e74174def19cdad1f1d2e7f4894683
Author: Prarit Bhargava <prarit@redhat.com>
Date:   Mon Apr 8 08:47:15 2013 -0400

    hrtimer: Add expiry time overflow check in hrtimer_interrupt

    commit 8f294b5a139ee4b75e890ad5b443c93d1e558a8b upstream.

    The settimeofday01 test in the LTP testsuite effectively does

            gettimeofday(current time);
            settimeofday(Jan 1, 1970 + 100 seconds);
            settimeofday(current time);

    This test causes a stack trace to be displayed on the console during the
    setting of timeofday to Jan 1, 1970 + 100 seconds:

    [  131.066751] ------------[ cut here ]------------
    [  131.096448] WARNING: at kernel/time/clockevents.c:209 clockevents_program_event+0x135/0x140()
    [  131.104935] Hardware name: Dinar
    [  131.108150] Modules linked in: sg nfsv3 nfs_acl nfsv4 auth_rpcgss nfs dns_resolver fscache lockd sunrpc nf_conntrack_netbios_ns nf_conntrack_broadcast ipt_MASQUERADE ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat nf_nat_ipv4 nf_nat iptable_mangle ipt_REJECT nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables kvm_amd kvm sp5100_tco bnx2 i2c_piix4 crc32c_intel k10temp fam15h_power ghash_clmulni_intel amd64_edac_mod pcspkr serio_raw edac_mce_amd edac_core microcode xfs libcrc32c sr_mod sd_mod cdrom ata_generic crc_t10dif pata_acpi radeon i2c_algo_bit drm_kms_helper ttm drm ahci pata_atiixp libahci libata usb_storage i2c_core dm_mirror dm_region_hash dm_log dm_mod
    [  131.176784] Pid: 0, comm: swapper/28 Not tainted 3.8.0+ #6
    [  131.182248] Call Trace:
    [  131.184684]  <IRQ>  [<ffffffff810612af>] warn_slowpath_common+0x7f/0xc0
    [  131.191312]  [<ffffffff8106130a>] warn_slowpath_null+0x1a/0x20
    [  131.197131]  [<ffffffff810b9fd5>] clockevents_program_event+0x135/0x140
    [  131.203721]  [<ffffffff810bb584>] tick_program_event+0x24/0x30
    [  131.209534]  [<ffffffff81089ab1>] hrtimer_interrupt+0x131/0x230
    [  131.215437]  [<ffffffff814b9600>] ? cpufreq_p4_target+0x130/0x130
    [  131.221509]  [<ffffffff81619119>] smp_apic_timer_interrupt+0x69/0x99
    [  131.227839]  [<ffffffff8161805d>] apic_timer_interrupt+0x6d/0x80
    [  131.233816]  <EOI>  [<ffffffff81099745>] ? sched_clock_cpu+0xc5/0x120
    [  131.240267]  [<ffffffff814b9ff0>] ? cpuidle_wrap_enter+0x50/0xa0
    [  131.246252]  [<ffffffff814b9fe9>] ? cpuidle_wrap_enter+0x49/0xa0
    [  131.252238]  [<ffffffff814ba050>] cpuidle_enter_tk+0x10/0x20
    [  131.257877]  [<ffffffff814b9c89>] cpuidle_idle_call+0xa9/0x260
    [  131.263692]  [<ffffffff8101c42f>] cpu_idle+0xaf/0x120
    [  131.268727]  [<ffffffff815f8971>] start_secondary+0x255/0x257
    [  131.274449] ---[ end trace 1151a50552231615 ]---

    When we change the system time to a low value like this, the value of
    timekeeper->offs_real will be a negative value.

    It seems that the WARN occurs because an hrtimer has been started in the time
    between the releasing of the timekeeper lock and the IPI call (via a call to
    on_each_cpu) in clock_was_set() in the do_settimeofday() code.  The end result
    is that a REALTIME_CLOCK timer has been added with softexpires = expires =
    KTIME_MAX.  The hrtimer_interrupt() fires/is called and the loop at
    kernel/hrtimer.c:1289 is executed.  In this loop the code subtracts the
    clock base's offset (which was set to timekeeper->offs_real in
    do_settimeofday()) from the current hrtimer_cpu_base->expiry value (which
    was KTIME_MAX):

    	KTIME_MAX - (a negative value) = overflow

    A simple check for an overflow can resolve this problem.  Using KTIME_MAX
    instead of the overflow value will result in the hrtimer function being run,
    and the reprogramming of the timer after that.

    Reviewed-by: Rik van Riel <riel@redhat.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Prarit Bhargava <prarit@redhat.com>
    [jstultz: Tweaked commit subject]
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0f97a448749144ed26634ed47323ce2217a7a4c
Author: David Engraf <david.engraf@sysgo.com>
Date:   Tue Mar 19 13:29:55 2013 +0100

    hrtimer: Fix ktime_add_ns() overflow on 32bit architectures

    commit 51fd36f3fad8447c487137ae26b9d0b3ce77bb25 upstream.

    One can trigger an overflow when using ktime_add_ns() on a 32bit
    architecture not supporting CONFIG_KTIME_SCALAR.

    When passing a very high value for u64 nsec, e.g. 7881299347898368000
    the do_div() function converts this value to seconds (7881299347) which
    is still to high to pass to the ktime_set() function as long. The result
    in is a negative value.

    The problem on my system occurs in the tick-sched.c,
    tick_nohz_stop_sched_tick() when time_delta is set to
    timekeeping_max_deferment(). The check for time_delta < KTIME_MAX is
    valid, thus ktime_add_ns() is called with a too large value resulting in
    a negative expire value. This leads to an endless loop in the ticker code:

    time_delta: 7881299347898368000
    expires = ktime_add_ns(last_update, time_delta)
    expires: negative value

    This fix caps the value to KTIME_MAX.

    This error doesn't occurs on 64bit or architectures supporting
    CONFIG_KTIME_SCALAR (e.g. ARM, x86-32).

    Signed-off-by: David Engraf <david.engraf@sysgo.com>
    [jstultz: Minor tweaks to commit message & header]
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 748026dd8039469e20429b3e8090bbfbba234089
Author: Dylan Reid <dgreid@chromium.org>
Date:   Tue Apr 16 20:02:34 2013 -0700

    ASoC: max98088: Fix logging of hardware revision.

    commit 98682063549bedd6e2d2b6b7222f150c6fbce68c upstream.

    The hardware revision of the codec is based at 0x40.  Subtract that
    before convering to ASCII.  The same as it is done for 98095.

    Signed-off-by: Dylan Reid <dgreid@chromium.org>
    Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 430c701136b9168fbb63b6391af0b8f4216817a9
Author: Takashi Iwai <tiwai@suse.de>
Date:   Thu Apr 25 07:38:15 2013 +0200

    ALSA: usb-audio: Fix autopm error during probing

    commit 60af3d037eb8c670dcce31401501d1271e7c5d95 upstream.

    We've got strange errors in get_ctl_value() in mixer.c during
    probing, e.g. on Hercules RMX2 DJ Controller:

      ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0xa00, type = 4
      ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x200, wIndex = 0xa00, type = 4
      ....

    It turned out that the culprit is autopm: snd_usb_autoresume() returns
    -ENODEV when called during card->probing = 1.

    Since the call itself during card->probing = 1 is valid, let's fix the
    return value of snd_usb_autoresume() as success.

    Reported-and-tested-by: Daniel Schürmann <daschuer@mixxx.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7d4dcfcf2e4351369720bbd8e6a65df56e0458d7
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Mon Apr 15 15:59:51 2013 +0200

    ALSA: usb-audio: disable autopm for MIDI devices

    commit cbc200bca4b51a8e2406d4b654d978f8503d430b upstream.

    Commit 88a8516a2128 (ALSA: usbaudio: implement USB autosuspend)
    introduced autopm for all USB audio/MIDI devices.  However, many MIDI
    devices, such as synthesizers, do not merely transmit MIDI messages but
    use their MIDI inputs to control other functions.  With autopm, these
    devices would get powered down as soon as the last MIDI port device is
    closed on the host.

    Even some plain MIDI interfaces could get broken: they automatically
    send Active Sensing messages while powered up, but as soon as these
    messages cease, the receiving device would interpret this as an
    accidental disconnection.

    Commit f5f165418cab (ALSA: usb-audio: Fix missing autopm for MIDI input)
    introduced another regression: some devices (e.g. the Roland GAIA SH-01)
    are self-powered but do a reset whenever the USB interface's power state
    changes.

    To work around all this, just disable autopm for all USB MIDI devices.

    Reported-by: Laurens Holst
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 204435f3d3f96513892dfd13aa65298abfeed130
Author: Anurup m <anurup.m@huawei.com>
Date:   Mon Apr 29 15:05:52 2013 -0700

    fs/fscache/stats.c: fix memory leak

    commit ec686c9239b4d472052a271c505d04dae84214cc upstream.

    There is a kernel memory leak observed when the proc file
    /proc/fs/fscache/stats is read.

    The reason is that in fscache_stats_open, single_open is called and the
    respective release function is not called during release.  Hence fix
    with correct release function - single_release().

    Addresses https://bugzilla.kernel.org/show_bug.cgi?id=57101

    Signed-off-by: Anurup m <anurup.m@huawei.com>
    Cc: shyju pv <shyju.pv@huawei.com>
    Cc: Sanil kumar <sanil.kumar@huawei.com>
    Cc: Nataraj m <nataraj.m@huawei.com>
    Cc: Li Zefan <lizefan@huawei.com>
    Cc: David Howells <dhowells@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2f0441ee08f711413b85c8c3a75734913fc6bca9
Author: Stephan Schreiber <info@fs-driver.org>
Date:   Tue Mar 19 15:27:12 2013 -0700

    Wrong asm register contraints in the kvm implementation

    commit de53e9caa4c6149ef4a78c2f83d7f5b655848767 upstream.

    The Linux Kernel contains some inline assembly source code which has
    wrong asm register constraints in arch/ia64/kvm/vtlb.c.

    I observed this on Kernel 3.2.35 but it is also true on the most
    recent Kernel 3.9-rc1.

    File arch/ia64/kvm/vtlb.c:

    u64 guest_vhpt_lookup(u64 iha, u64 *pte)
    {
    	u64 ret;
    	struct thash_data *data;

    	data = __vtr_lookup(current_vcpu, iha, D_TLB);
    	if (data != NULL)
    		thash_vhpt_insert(current_vcpu, data->page_flags,
    			data->itir, iha, D_TLB);

    	asm volatile (
    			"rsm psr.ic|psr.i;;"
    			"srlz.d;;"
    			"ld8.s r9=[%1];;"
    			"tnat.nz p6,p7=r9;;"
    			"(p6) mov %0=1;"
    			"(p6) mov r9=r0;"
    			"(p7) extr.u r9=r9,0,53;;"
    			"(p7) mov %0=r0;"
    			"(p7) st8 [%2]=r9;;"
    			"ssm psr.ic;;"
    			"srlz.d;;"
    			"ssm psr.i;;"
    			"srlz.d;;"
    			: "=r"(ret) : "r"(iha), "r"(pte):"memory");

    	return ret;
    }

    The list of output registers is
    			: "=r"(ret) : "r"(iha), "r"(pte):"memory");
    The constraint "=r" means that the GCC has to maintain that these vars
    are in registers and contain valid info when the program flow leaves
    the assembly block (output registers).
    But "=r" also means that GCC can put them in registers that are used
    as input registers. Input registers are iha, pte on the example.
    If the predicate p7 is true, the 8th assembly instruction
    			"(p7) mov %0=r0;"
    is the first one which writes to a register which is maintained by the
    register constraints; it sets %0. %0 means the first register operand;
    it is ret here.
    This instruction might overwrite the %2 register (pte) which is needed
    by the next instruction:
    			"(p7) st8 [%2]=r9;;"
    Whether it really happens depends on how GCC decides what registers it
    uses and how it optimizes the code.

    The attached patch  fixes the register operand constraints in
    arch/ia64/kvm/vtlb.c.
    The register constraints should be
    			: "=&r"(ret) : "r"(iha), "r"(pte):"memory");
    The & means that GCC must not use any of the input registers to place
    this output register in.

    This is Debian bug#702639
    (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702639).

    The patch is applicable on Kernel 3.9-rc1, 3.2.35 and many other versions.

    Signed-off-by: Stephan Schreiber <info@fs-driver.org>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 40b1161af55b80168e0188e9e34ee39b3dd8e2ed
Author: Stephan Schreiber <info@fs-driver.org>
Date:   Tue Mar 19 15:22:27 2013 -0700

    Wrong asm register contraints in the futex implementation

    commit 136f39ddc53db3bcee2befbe323a56d4fbf06da8 upstream.

    The Linux Kernel contains some inline assembly source code which has
    wrong asm register constraints in arch/ia64/include/asm/futex.h.

    I observed this on Kernel 3.2.23 but it is also true on the most
    recent Kernel 3.9-rc1.

    File arch/ia64/include/asm/futex.h:

    static inline int
    futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    			      u32 oldval, u32 newval)
    {
    	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    		return -EFAULT;

    	{
    		register unsigned long r8 __asm ("r8");
    		unsigned long prev;
    		__asm__ __volatile__(
    			"	mf;;					\n"
    			"	mov %0=r0				\n"
    			"	mov ar.ccv=%4;;				\n"
    			"[1:]	cmpxchg4.acq %1=[%2],%3,ar.ccv		\n"
    			"	.xdata4 \"__ex_table\", 1b-., 2f-.	\n"
    			"[2:]"
    			: "=r" (r8), "=r" (prev)
    			: "r" (uaddr), "r" (newval),
    			  "rO" ((long) (unsigned) oldval)
    			: "memory");
    		*uval = prev;
    		return r8;
    	}
    }

    The list of output registers is
    			: "=r" (r8), "=r" (prev)
    The constraint "=r" means that the GCC has to maintain that these vars
    are in registers and contain valid info when the program flow leaves
    the assembly block (output registers).
    But "=r" also means that GCC can put them in registers that are used
    as input registers. Input registers are uaddr, newval, oldval on the
    example.
    The second assembly instruction
    			"	mov %0=r0				\n"
    is the first one which writes to a register; it sets %0 to 0. %0 means
    the first register operand; it is r8 here. (The r0 is read-only and
    always 0 on the Itanium; it can be used if an immediate zero value is
    needed.)
    This instruction might overwrite one of the other registers which are
    still needed.
    Whether it really happens depends on how GCC decides what registers it
    uses and how it optimizes the code.

    The objdump utility can give us disassembly.
    The futex_atomic_cmpxchg_inatomic() function is inline, so we have to
    look for a module that uses the funtion. This is the
    cmpxchg_futex_value_locked() function in
    kernel/futex.c:

    static int cmpxchg_futex_value_locked(u32 *curval, u32 __user *uaddr,
    				      u32 uval, u32 newval)
    {
    	int ret;

    	pagefault_disable();
    	ret = futex_atomic_cmpxchg_inatomic(curval, uaddr, uval, newval);
    	pagefault_enable();

    	return ret;
    }

    Now the disassembly. At first from the Kernel package 3.2.23 which has
    been compiled with GCC 4.4, remeber this Kernel seemed to work:
    objdump -d linux-3.2.23/debian/build/build_ia64_none_mckinley/kernel/futex.o

    0000000000000230 <cmpxchg_futex_value_locked>:
          230:	0b 18 80 1b 18 21 	[MMI]       adds r3=3168,r13;;
          236:	80 40 0d 00 42 00 	            adds r8=40,r3
          23c:	00 00 04 00       	            nop.i 0x0;;
          240:	0b 50 00 10 10 10 	[MMI]       ld4 r10=[r8];;
          246:	90 08 28 00 42 00 	            adds r9=1,r10
          24c:	00 00 04 00       	            nop.i 0x0;;
          250:	09 00 00 00 01 00 	[MMI]       nop.m 0x0
          256:	00 48 20 20 23 00 	            st4 [r8]=r9
          25c:	00 00 04 00       	            nop.i 0x0;;
          260:	08 10 80 06 00 21 	[MMI]       adds r2=32,r3
          266:	00 00 00 02 00 00 	            nop.m 0x0
          26c:	02 08 f1 52       	            extr.u r16=r33,0,61
          270:	05 40 88 00 08 e0 	[MLX]       addp4 r8=r34,r0
          276:	ff ff 0f 00 00 e0 	            movl r15=0xfffffffbfff;;
          27c:	f1 f7 ff 65
          280:	09 70 00 04 18 10 	[MMI]       ld8 r14=[r2]
          286:	00 00 00 02 00 c0 	            nop.m 0x0
          28c:	f0 80 1c d0       	            cmp.ltu p6,p7=r15,r16;;
          290:	08 40 fc 1d 09 3b 	[MMI]       cmp.eq p8,p9=-1,r14
          296:	00 00 00 02 00 40 	            nop.m 0x0
          29c:	e1 08 2d d0       	            cmp.ltu p10,p11=r14,r33
          2a0:	56 01 10 00 40 10 	[BBB] (p10) br.cond.spnt.few 2e0
    <cmpxchg_futex_value_locked+0xb0>
          2a6:	02 08 00 80 21 03 	      (p08) br.cond.dpnt.few 2b0
    <cmpxchg_futex_value_locked+0x80>
          2ac:	40 00 00 41       	      (p06) br.cond.spnt.few 2e0
    <cmpxchg_futex_value_locked+0xb0>
          2b0:	0a 00 00 00 22 00 	[MMI]       mf;;
          2b6:	80 00 00 00 42 00 	            mov r8=r0
          2bc:	00 00 04 00       	            nop.i 0x0
          2c0:	0b 00 20 40 2a 04 	[MMI]       mov.m ar.ccv=r8;;
          2c6:	10 1a 85 22 20 00 	            cmpxchg4.acq r33=[r33],r35,ar.ccv
          2cc:	00 00 04 00       	            nop.i 0x0;;
          2d0:	10 00 84 40 90 11 	[MIB]       st4 [r32]=r33
          2d6:	00 00 00 02 00 00 	            nop.i 0x0
          2dc:	20 00 00 40       	            br.few 2f0
    <cmpxchg_futex_value_locked+0xc0>
          2e0:	09 40 c8 f9 ff 27 	[MMI]       mov r8=-14
          2e6:	00 00 00 02 00 00 	            nop.m 0x0
          2ec:	00 00 04 00       	            nop.i 0x0;;
          2f0:	0b 58 20 1a 19 21 	[MMI]       adds r11=3208,r13;;
          2f6:	20 01 2c 20 20 00 	            ld4 r18=[r11]
          2fc:	00 00 04 00       	            nop.i 0x0;;
          300:	0b 88 fc 25 3f 23 	[MMI]       adds r17=-1,r18;;
          306:	00 88 2c 20 23 00 	            st4 [r11]=r17
          30c:	00 00 04 00       	            nop.i 0x0;;
          310:	11 00 00 00 01 00 	[MIB]       nop.m 0x0
          316:	00 00 00 02 00 80 	            nop.i 0x0
          31c:	08 00 84 00       	            br.ret.sptk.many b0;;

    The lines
          2b0:	0a 00 00 00 22 00 	[MMI]       mf;;
          2b6:	80 00 00 00 42 00 	            mov r8=r0
          2bc:	00 00 04 00       	            nop.i 0x0
          2c0:	0b 00 20 40 2a 04 	[MMI]       mov.m ar.ccv=r8;;
          2c6:	10 1a 85 22 20 00 	            cmpxchg4.acq r33=[r33],r35,ar.ccv
          2cc:	00 00 04 00       	            nop.i 0x0;;
    are the instructions of the assembly block.
    The line
          2b6:	80 00 00 00 42 00 	            mov r8=r0
    sets the r8 register to 0 and after that
          2c0:	0b 00 20 40 2a 04 	[MMI]       mov.m ar.ccv=r8;;
    prepares the 'oldvalue' for the cmpxchg but it takes it from r8. This
    is wrong.
    What happened here is what I explained above: An input register is
    overwritten which is still needed.
    The register operand constraints in futex.h are wrong.

    (The problem doesn't occur when the Kernel is compiled with GCC 4.6.)

    The attached patch fixes the register operand constraints in futex.h.
    The code after patching of it:

    static inline int
    futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    			      u32 oldval, u32 newval)
    {
    	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    		return -EFAULT;

    	{
    		register unsigned long r8 __asm ("r8") = 0;
    		unsigned long prev;
    		__asm__ __volatile__(
    			"	mf;;					\n"
    			"	mov ar.ccv=%4;;				\n"
    			"[1:]	cmpxchg4.acq %1=[%2],%3,ar.ccv		\n"
    			"	.xdata4 \"__ex_table\", 1b-., 2f-.	\n"
    			"[2:]"
    			: "+r" (r8), "=&r" (prev)
    			: "r" (uaddr), "r" (newval),
    			  "rO" ((long) (unsigned) oldval)
    			: "memory");
    		*uval = prev;
    		return r8;
    	}
    }

    I also initialized the 'r8' var with the C programming language.
    The _asm qualifier on the definition of the 'r8' var forces GCC to use
    the r8 processor register for it.
    I don't believe that we should use inline assembly for zeroing out a
    local variable.
    The constraint is
    "+r" (r8)
    what means that it is both an input register and an output register.
    Note that the page fault handler will modify the r8 register which
    will be the return value of the function.
    The real fix is
    "=&r" (prev)
    The & means that GCC must not use any of the input registers to place
    this output register in.

    Patched the Kernel 3.2.23 and compiled it with GCC4.4:

    0000000000000230 <cmpxchg_futex_value_locked>:
          230:	0b 18 80 1b 18 21 	[MMI]       adds r3=3168,r13;;
          236:	80 40 0d 00 42 00 	            adds r8=40,r3
          23c:	00 00 04 00       	            nop.i 0x0;;
          240:	0b 50 00 10 10 10 	[MMI]       ld4 r10=[r8];;
          246:	90 08 28 00 42 00 	            adds r9=1,r10
          24c:	00 00 04 00       	            nop.i 0x0;;
          250:	09 00 00 00 01 00 	[MMI]       nop.m 0x0
          256:	00 48 20 20 23 00 	            st4 [r8]=r9
          25c:	00 00 04 00       	            nop.i 0x0;;
          260:	08 10 80 06 00 21 	[MMI]       adds r2=32,r3
          266:	20 12 01 10 40 00 	            addp4 r34=r34,r0
          26c:	02 08 f1 52       	            extr.u r16=r33,0,61
          270:	05 40 00 00 00 e1 	[MLX]       mov r8=r0
          276:	ff ff 0f 00 00 e0 	            movl r15=0xfffffffbfff;;
          27c:	f1 f7 ff 65
          280:	09 70 00 04 18 10 	[MMI]       ld8 r14=[r2]
          286:	00 00 00 02 00 c0 	            nop.m 0x0
          28c:	f0 80 1c d0       	            cmp.ltu p6,p7=r15,r16;;
          290:	08 40 fc 1d 09 3b 	[MMI]       cmp.eq p8,p9=-1,r14
          296:	00 00 00 02 00 40 	            nop.m 0x0
          29c:	e1 08 2d d0       	            cmp.ltu p10,p11=r14,r33
          2a0:	56 01 10 00 40 10 	[BBB] (p10) br.cond.spnt.few 2e0
    <cmpxchg_futex_value_locked+0xb0>
          2a6:	02 08 00 80 21 03 	      (p08) br.cond.dpnt.few 2b0
    <cmpxchg_futex_value_locked+0x80>
          2ac:	40 00 00 41       	      (p06) br.cond.spnt.few 2e0
    <cmpxchg_futex_value_locked+0xb0>
          2b0:	0b 00 00 00 22 00 	[MMI]       mf;;
          2b6:	00 10 81 54 08 00 	            mov.m ar.ccv=r34
          2bc:	00 00 04 00       	            nop.i 0x0;;
          2c0:	09 58 8c 42 11 10 	[MMI]       cmpxchg4.acq r11=[r33],r35,ar.ccv
          2c6:	00 00 00 02 00 00 	            nop.m 0x0
          2cc:	00 00 04 00       	            nop.i 0x0;;
          2d0:	10 00 2c 40 90 11 	[MIB]       st4 [r32]=r11
          2d6:	00 00 00 02 00 00 	            nop.i 0x0
          2dc:	20 00 00 40       	            br.few 2f0
    <cmpxchg_futex_value_locked+0xc0>
          2e0:	09 40 c8 f9 ff 27 	[MMI]       mov r8=-14
          2e6:	00 00 00 02 00 00 	            nop.m 0x0
          2ec:	00 00 04 00       	            nop.i 0x0;;
          2f0:	0b 88 20 1a 19 21 	[MMI]       adds r17=3208,r13;;
          2f6:	30 01 44 20 20 00 	            ld4 r19=[r17]
          2fc:	00 00 04 00       	            nop.i 0x0;;
          300:	0b 90 fc 27 3f 23 	[MMI]       adds r18=-1,r19;;
          306:	00 90 44 20 23 00 	            st4 [r17]=r18
          30c:	00 00 04 00       	            nop.i 0x0;;
          310:	11 00 00 00 01 00 	[MIB]       nop.m 0x0
          316:	00 00 00 02 00 80 	            nop.i 0x0
          31c:	08 00 84 00       	            br.ret.sptk.many b0;;

    Much better.
    There is a
          270:	05 40 00 00 00 e1 	[MLX]       mov r8=r0
    which was generated by C code r8 = 0. Below
          2b6:	00 10 81 54 08 00 	            mov.m ar.ccv=r34
    what means that oldval is no longer overwritten.

    This is Debian bug#702641
    (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702641).

    The patch is applicable on Kernel 3.9-rc1, 3.2.23 and many other versions.

    Signed-off-by: Stephan Schreiber <info@fs-driver.org>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3c567a40a1538c96c7cfaa86d944301203e2810d
Author: Yinghai Lu <yinghai@kernel.org>
Date:   Thu Mar 28 04:28:58 2013 +0000

    PCI / ACPI: Don't query OSC support with all possible controls

    commit 545d6e189a41c94c11f55045a771118eccc9d9eb upstream.

    Found problem on system that firmware that could handle pci aer.
    Firmware get error reporting after pci injecting error, before os boots.
    But after os boots, firmware can not get report anymore, even pci=noaer
    is passed.

    Root cause: BIOS _OSC has problem with query bit checking.
    It turns out that BIOS vendor is copying example code from ACPI Spec.
    In ACPI Spec 5.0, page 290:

    	If (Not(And(CDW1,1))) // Query flag clear?
    	{	// Disable GPEs for features granted native control.
    		If (And(CTRL,0x01)) // Hot plug control granted?
    		{
    			Store(0,HPCE) // clear the hot plug SCI enable bit
    			Store(1,HPCS) // clear the hot plug SCI status bit
    		}
    	...
    	}

    When Query flag is set, And(CDW1,1) will be 1, Not(1) will return 0xfffffffe.
    So it will get into code path that should be for control set only.
    BIOS acpi code should be changed to "If (LEqual(And(CDW1,1), 0)))"

    Current kernel code is using _OSC query to notify firmware about support
    from OS and then use _OSC to set control bits.
    During query support, current code is using all possible controls.
    So will execute code that should be only for control set stage.

    That will have problem when pci=noaer or aer firmware_first is used.
    As firmware have that control set for os aer already in query support stage,
    but later will not os aer handling.

    We should avoid passing all possible controls, just use osc_control_set
    instead.
    That should workaround BIOS bugs with affected systems on the field
    as more bios vendors are copying sample code from ACPI spec.

    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7baad48c3986e9949a7d42a41dd5081e2177044
Author: Tony Luck <tony.luck@intel.com>
Date:   Wed Mar 20 10:30:15 2013 -0700

    Fix initialization of CMCI/CMCP interrupts

    commit d303e9e98fce56cdb3c6f2ac92f626fc2bd51c77 upstream.

    Back 2010 during a revamp of the irq code some initializations
    were moved from ia64_mca_init() to ia64_mca_late_init() in

    	commit c75f2aa13f5b268aba369b5dc566088b5194377c
    	Cannot use register_percpu_irq() from ia64_mca_init()

    But this was hideously wrong. First of all these initializations
    are now down far too late. Specifically after all the other cpus
    have been brought up and initialized their own CMC vectors from
    smp_callin(). Also ia64_mca_late_init() may be called from any cpu
    so the line:
    	ia64_mca_cmc_vector_setup();       /* Setup vector on BSP */
    is generally not executed on the BSP, and so the CMC vector isn't
    setup at all on that processor.

    Make use of the arch_early_irq_init() hook to get this code executed
    at just the right moment: not too early, not too late.

    Reported-by: Fred Hartnett <fred.hartnett@hp.com>
    Tested-by: Fred Hartnett <fred.hartnett@hp.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9702319c6eb4ebedc334ea5825ccce3b210c4a32
Author: Steven A. Falco <sfalco@harris.com>
Date:   Mon Apr 22 09:34:39 2013 +0000

    i2c: xiic: must always write 16-bit words to TX_FIFO

    commit c39e8e4354ce4daf23336de5daa28a3b01f00aa6 upstream.

    The TX_FIFO register is 10 bits wide.  The lower 8 bits are the data to be
    written, while the upper two bits are flags to indicate stop/start.

    The driver apparently attempted to optimize write access, by only writing a
    byte in those cases where the stop/start bits are zero.  However, we have
    seen cases where the lower byte is duplicated onto the upper byte by the
    hardware, which causes inadvertent stop/starts.

    This patch changes the write access to the transmit FIFO to always be 16 bits
    wide.

    Signed off by: Steven A. Falco <sfalco@harris.com>
    Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 08181f491cd016e610d072dd42e8d0e7bda4a789
Author: Namhyung Kim <namhyung.kim@lge.com>
Date:   Thu Apr 11 16:01:38 2013 +0900

    tracing: Reset ftrace_graph_filter_enabled if count is zero

    commit 9f50afccfdc15d95d7331acddcb0f7703df089ae upstream.

    The ftrace_graph_count can be decreased with a "!" pattern, so that
    the enabled flag should be updated too.

    Link: http://lkml.kernel.org/r/1365663698-2413-1-git-send-email-namhyung@kernel.org

    Signed-off-by: Namhyung Kim <namhyung@kernel.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Namhyung Kim <namhyung.kim@lge.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e81e6f4a69ddf39b89e29a4191a23372d4b1007a
Author: Namhyung Kim <namhyung.kim@lge.com>
Date:   Wed Apr 10 09:18:12 2013 +0900

    tracing: Check return value of tracing_init_dentry()

    commit ed6f1c996bfe4b6e520cf7a74b51cd6988d84420 upstream.

    Check return value and bail out if it's NULL.

    Link: http://lkml.kernel.org/r/1365553093-10180-2-git-send-email-namhyung@kernel.org

    Signed-off-by: Namhyung Kim <namhyung@kernel.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Namhyung Kim <namhyung.kim@lge.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61857764da0a6fa75f3407e06fbaf05f7cac3d84
Author: Namhyung Kim <namhyung.kim@lge.com>
Date:   Mon Apr 1 21:46:24 2013 +0900

    tracing: Fix off-by-one on allocating stat->pages

    commit 39e30cd1537937d3c00ef87e865324e981434e5b upstream.

    The first page was allocated separately, so no need to start from 0.

    Link: http://lkml.kernel.org/r/1364820385-32027-2-git-send-email-namhyung@kernel.org

    Signed-off-by: Namhyung Kim <namhyung@kernel.org>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: Namhyung Kim <namhyung.kim@lge.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 13f475a567de775169fd7e69a5d84fc41c168c3e
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Mar 13 23:34:22 2013 -0400

    tracing: Remove most or all of stack tracer stack size from stack_max_size

    commit 4df297129f622bdc18935c856f42b9ddd18f9f28 upstream.

    Currently, the depth reported in the stack tracer stack_trace file
    does not match the stack_max_size file. This is because the stack_max_size
    includes the overhead of stack tracer itself while the depth does not.

    The first time a max is triggered, a calculation is not performed that
    figures out the overhead of the stack tracer and subtracts it from
    the stack_max_size variable. The overhead is stored and is subtracted
    from the reported stack size for comparing for a new max.

    Now the stack_max_size corresponds to the reported depth:

     # cat stack_max_size
    4640

     # cat stack_trace
            Depth    Size   Location    (48 entries)
            -----    ----   --------
      0)     4640      32   _raw_spin_lock+0x18/0x24
      1)     4608     112   ____cache_alloc+0xb7/0x22d
      2)     4496      80   kmem_cache_alloc+0x63/0x12f
      3)     4416      16   mempool_alloc_slab+0x15/0x17
    [...]

    While testing against and older gcc on x86 that uses mcount instead
    of fentry, I found that pasing in ip + MCOUNT_INSN_SIZE let the
    stack trace show one more function deep which was missing before.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53318264d21af2445edd1eb47b4189717d53f288
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Mar 13 21:25:35 2013 -0400

    tracing: Fix stack tracer with fentry use

    commit d4ecbfc49b4b1d4b597fb5ba9e4fa25d62f105c5 upstream.

    When gcc 4.6 on x86 is used, the function tracer will use the new
    option -mfentry which does a call to "fentry" at every function
    instead of "mcount". The significance of this is that fentry is
    called as the first operation of the function instead of the mcount
    usage of being called after the stack.

    This causes the stack tracer to show some bogus results for the size
    of the last function traced, as well as showing "ftrace_call" instead
    of the function. This is due to the stack frame not being set up
    by the function that is about to be traced.

     # cat stack_trace
            Depth    Size   Location    (48 entries)
            -----    ----   --------
      0)     4824     216   ftrace_call+0x5/0x2f
      1)     4608     112   ____cache_alloc+0xb7/0x22d
      2)     4496      80   kmem_cache_alloc+0x63/0x12f

    The 216 size for ftrace_call includes both the ftrace_call stack
    (which includes the saving of registers it does), as well as the
    stack size of the parent.

    To fix this, if CC_USING_FENTRY is defined, then the stack_tracer
    will reserve the first item in stack_dump_trace[] array when
    calling save_stack_trace(), and it will fill it in with the parent ip.
    Then the code will look for the parent pointer on the stack and
    give the real size of the parent's stack pointer:

     # cat stack_trace
            Depth    Size   Location    (14 entries)
            -----    ----   --------
      0)     2640      48   update_group_power+0x26/0x187
      1)     2592     224   update_sd_lb_stats+0x2a5/0x4ac
      2)     2368     160   find_busiest_group+0x31/0x1f1
      3)     2208     256   load_balance+0xd9/0x662

    I'm Cc'ing stable, although it's not urgent, as it only shows bogus
    size for item #0, the rest of the trace is legit. It should still be
    corrected in previous stable releases.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f42aa66c19796fd453f434be29a039707aec435f
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Wed Mar 13 20:43:57 2013 -0400

    tracing: Use stack of calling function for stack tracer

    commit 87889501d0adfae10e3b0f0e6f2d7536eed9ae84 upstream.

    Use the stack of stack_trace_call() instead of check_stack() as
    the test pointer for max stack size. It makes it a bit cleaner
    and a little more accurate.

    Adding stable, as a later fix depends on this patch.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02f1fef6377f64ae0ea5b542a39eddf1424b505d
Author: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Date:   Mon Apr 22 14:19:26 2013 +0300

    fbcon: when font is freed, clear also vc_font.data

    commit e6637d5427d2af9f3f33b95447bfc5347e5ccd85 upstream.

    commit ae1287865f5361fa138d4d3b1b6277908b54eac9
    Author: Dave Airlie <airlied@redhat.com>
    Date:   Thu Jan 24 16:12:41 2013 +1000

        fbcon: don't lose the console font across generic->chip driver switch

    uses a pointer in vc->vc_font.data to load font into the new driver.
    However if the font is actually freed, we need to clear the data
    so that we don't reload font from dangling pointer.

    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=892340
    Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5022cf90d4bb8bed51c8176ce57ac7ccf87ed3d4
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed May 1 07:32:21 2013 -0700

    tty: fix up atime/mtime mess, take three

    commit b0b885657b6c8ef63a46bc9299b2a7715d19acde upstream.

    We first tried to avoid updating atime/mtime entirely (commit
    b0de59b5733d: "TTY: do not update atime/mtime on read/write"), and then
    limited it to only update it occasionally (commit 37b7f3c76595: "TTY:
    fix atime/mtime regression"), but it turns out that this was both
    insufficient and overkill.

    It was insufficient because we let people attach to the shared ptmx node
    to see activity without even reading atime/mtime, and it was overkill
    because the "only once a minute" means that you can't really tell an
    idle person from an active one with 'w'.

    So this tries to fix the problem properly.  It marks the shared ptmx
    node as un-notifiable, and it lowers the "only once a minute" to a few
    seconds instead - still long enough that you can't time individual
    keystrokes, but short enough that you can tell whether somebody is
    active or not.

    Reported-by: Simon Kirby <sim@hostway.ca>
    Acked-by: Jiri Slaby <jslaby@suse.cz>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70f4184b8eeb04a2b8ad2778a76ffac3a0d4e4d2
Author: Federico Vaga <federico.vaga@gmail.com>
Date:   Mon Apr 15 16:01:07 2013 +0200

    serial_core.c: add put_device() after device_find_child()

    commit 5a65dcc04cda41f4122aacc37a5a348454645399 upstream.

    The serial core uses device_find_child() but does not drop the reference to
    the retrieved child after using it. This patch add the missing put_device().

    What I have done to test this issue.

    I used a machine with an AMBA PL011 serial driver. I tested the patch on
    next-20120408 because the last branch [next-20120415] does not boot on this
    board.

    For test purpose, I added some pr_info() messages to print the refcount
    after device_find_child() (lines: 1937,2009), and after put_device()
    (lines: 1947, 2021).

    Boot the machine *without* put_device(). Then:

    echo reboot > /sys/power/disk
    echo disk > /sys/power/state
    [   87.058575] uart_suspend_port:1937 refcount 4
    [   87.058582] uart_suspend_port:1947 refcount 4
    [   87.098083] uart_resume_port:2009refcount 5
    [   87.098088] uart_resume_port:2021 refcount 5

    echo disk > /sys/power/state
    [  103.055574] uart_suspend_port:1937 refcount 6
    [  103.055580] uart_suspend_port:1947 refcount 6
    [  103.095322] uart_resume_port:2009 refcount 7
    [  103.095327] uart_resume_port:2021 refcount 7

    echo disk > /sys/power/state
    [  252.459580] uart_suspend_port:1937 refcount 8
    [  252.459586] uart_suspend_port:1947 refcount 8
    [  252.499611] uart_resume_port:2009 refcount 9
    [  252.499616] uart_resume_port:2021 refcount 9

    The refcount continuously increased.

    Boot the machine *with* this patch. Then:

    echo reboot > /sys/power/disk
    echo disk > /sys/power/state
    [  159.333559] uart_suspend_port:1937 refcount 4
    [  159.333566] uart_suspend_port:1947 refcount 3
    [  159.372751] uart_resume_port:2009 refcount 4
    [  159.372755] uart_resume_port:2021 refcount 3

    echo disk > /sys/power/state
    [  185.713614] uart_suspend_port:1937 refcount 4
    [  185.713621] uart_suspend_port:1947 refcount 3
    [  185.752935] uart_resume_port:2009 refcount 4
    [  185.752940] uart_resume_port:2021 refcount 3

    echo disk > /sys/power/state
    [  207.458584] uart_suspend_port:1937 refcount 4
    [  207.458591] uart_suspend_port:1947 refcount 3
    [  207.498598] uart_resume_port:2009 refcount 4
    [  207.498605] uart_resume_port:2021 refcount 3

    The refcount correctly handled.

    Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f7cfcd277732f50bbdaf56880546faddbb2a73ba
Author: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date:   Tue Apr 16 15:18:00 2013 -0400

    xen/time: Fix kasprintf splat when allocating timer%d IRQ line.

    commit 7918c92ae9638eb8a6ec18e2b4a0de84557cccc8 upstream.

    When we online the CPU, we get this splat:

    smpboot: Booting Node 0 Processor 1 APIC 0x2
    installing Xen timer for CPU 1
    BUG: sleeping function called from invalid context at /home/konrad/ssd/konrad/linux/mm/slab.c:3179
    in_atomic(): 1, irqs_disabled(): 0, pid: 0, name: swapper/1
    Pid: 0, comm: swapper/1 Not tainted 3.9.0-rc6upstream-00001-g3884fad #1
    Call Trace:
     [<ffffffff810c1fea>] __might_sleep+0xda/0x100
     [<ffffffff81194617>] __kmalloc_track_caller+0x1e7/0x2c0
     [<ffffffff81303758>] ? kasprintf+0x38/0x40
     [<ffffffff813036eb>] kvasprintf+0x5b/0x90
     [<ffffffff81303758>] kasprintf+0x38/0x40
     [<ffffffff81044510>] xen_setup_timer+0x30/0xb0
     [<ffffffff810445af>] xen_hvm_setup_cpu_clockevents+0x1f/0x30
     [<ffffffff81666d0a>] start_secondary+0x19c/0x1a8

    The solution to that is use kasprintf in the CPU hotplug path
    that 'online's the CPU. That is, do it in in xen_hvm_cpu_notify,
    and remove the call to in xen_hvm_setup_cpu_clockevents.

    Unfortunatly the later is not a good idea as the bootup path
    does not use xen_hvm_cpu_notify so we would end up never allocating
    timer%d interrupt lines when booting. As such add the check for
    atomic() to continue.

    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d44632e6253a87c8fdad2329b266cfc9c1d5c83c
Author: Heiko Carstens <heiko.carstens@de.ibm.com>
Date:   Thu Apr 25 10:03:15 2013 +0200

    s390/memory hotplug: prevent offline of active memory increments

    commit 94c163663fc1dcfc067a5fb3cc1446b9469975ce upstream.

    In case a machine supports memory hotplug all active memory increments
    present at IPL time have been initialized with a "usecount" of 1.
    This is wrong if the memory increment size is larger than the memory
    section size of the memory hotplug code. If that is the case the
    usecount must be initialized with the number of memory sections that
    fit into one memory increment.
    Otherwise it is possible to put a memory increment into standby state
    even if there are still active sections.
    Afterwards addressing exceptions might happen which cause the kernel
    to panic.
    However even worse, if a memory increment was put into standby state
    and afterwards into active state again, it's contents would have been
    zeroed, leading to memory corruption.

    This was only an issue for machines that support standby memory and
    have at least 256GB memory.

    This is broken since commit fdb1bb15 "[S390] sclp/memory hotplug: fix
    initial usecount of increments".

    Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 42753c725c8233d5efbd682e34d0f3215a7c7aaa
Author: Tormod Volden <debian.tormod@gmail.com>
Date:   Sat Apr 20 14:24:04 2013 +0200

    usb-storage: CY7C68300A chips do not support Cypress ATACB

    commit 671b4b2ba9266cbcfe7210a704e9ea487dcaa988 upstream.

    Many cards based on CY7C68300A/B/C use the USB ID 04b4:6830 but only the
    B and C variants (EZ-USB AT2LP) support the ATA Command Block
    functionality, according to the data sheets. The A variant (EZ-USB AT2)
    locks up if ATACB is attempted, until a typical 30 seconds timeout runs
    out and a USB reset is performed.

    https://bugs.launchpad.net/bugs/428469

    It seems that one way to spot a CY7C68300A (at least where the card
    manufacturer left Cypress' EEPROM default vaules, against Cypress'
    recommendations) is to look at the USB string descriptor indices.

    A http://media.digikey.com/pdf/Data%20Sheets/Cypress%20PDFs/CY7C68300A.pdf
    B http://www.farnell.com/datasheets/43456.pdf
    C http://www.cypress.com/?rID=14189

    Note that a CY7C68300B/C chip appears as CY7C68300A if it is running
    in Backward Compatibility Mode, and if ATACB would be supported in this
    case there is anyway no way to tell which chip it really is.

    For 5 years my external USB drive has been locking up for half a minute
    when plugged in and ata_id is run by udev, or anytime hdparm or similar
    is run on it.

    Finally looking at the /correct/ datasheet I think I found the reason. I
    am aware the quirk in this patch is a bit hacky, but the hardware
    manufacturers haven't made it easy for us.

    Signed-off-by: Tormod Volden <debian.tormod@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60306774f3716df189a69d226d2a59fcf57b4aa9
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Tue Apr 16 11:08:33 2013 +0200

    usbfs: Always allow ctrl requests with USB_RECIP_ENDPOINT on the ctrl ep

    commit 1361bf4b9f9ef45e628a5b89e0fd9bedfdcb7104 upstream.

    When usbfs receives a ctrl-request from userspace it calls check_ctrlrecip,
    which for a request with USB_RECIP_ENDPOINT tries to map this to an interface
    to see if this interface is claimed, except for ctrl-requests with a type of
    USB_TYPE_VENDOR.

    When trying to use this device: http://www.akaipro.com/eiepro
    redirected to a Windows vm running on qemu on top of Linux.

    The windows driver makes a ctrl-req with USB_TYPE_CLASS and
    USB_RECIP_ENDPOINT with index 0, and the mapping of the endpoint (0) to
    the interface fails since ep 0 is the ctrl endpoint and thus never is
    part of an interface.

    This patch fixes this ctrl-req failing by skipping the checkintf call for
    USB_RECIP_ENDPOINT ctrl-reqs on the ctrl endpoint.

    Reported-by: Dave Stikkolorum <d.r.stikkolorum@hhs.nl>
    Tested-by: Dave Stikkolorum <d.r.stikkolorum@hhs.nl>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 131541cdce961e10b4a6f10246c19075ed845729
Author: Adrian Thomasset <adrian.thomasset@st.com>
Date:   Tue Apr 23 12:46:29 2013 +0100

    USB: ftdi_sio: correct ST Micro Connect Lite PIDs

    commit 9f06d15f8db6946e41f73196a122b84a37938878 upstream.

    The current ST Micro Connect Lite uses the FT4232H hi-speed quad USB
    UART FTDI chip. It is also possible to drive STM reference targets
    populated with an on-board JTAG debugger based on the FT2232H chip with
    the same STMicroelectronics tools.

    For this reason, the ST Micro Connect Lite PIDs should be
    ST_STMCLT_2232_PID: 0x3746
    ST_STMCLT_4232_PID: 0x3747

    Signed-off-by: Adrian Thomasset <adrian.thomasset@st.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 525df18348e4c2a144b957f3ab6eb02386700f1b
Author: Stefani Seibold <stefani@seibold.net>
Date:   Sun Apr 7 12:08:55 2013 +0200

    USB: add ftdi_sio USB ID for GDM Boost V1.x

    commit 58f8b6c4fa5a13cb2ddb400e26e9e65766d71e38 upstream.

    This patch add a missing usb device id for the GDMBoost V1.x device

    The patch is against 3.9-rc5

    Signed-off-by: Stefani Seibold <stefani@seibold.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6f3894d0531ec8aa8c111919af5f5d5c997d5106
Author: Ben Jencks <ben@bjencks.net>
Date:   Tue Apr 2 00:35:08 2013 -0400

    usb/misc/appledisplay: Add 24" LED Cinema display

    commit e7d3b6e22c871ba36d052ca99bc8ceca4d546a60 upstream.

    Add the Apple 24" LED Cinema display to the supported devices.

    Signed-off-by: Ben Jencks <ben@bjencks.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f4fd63017f8d28fa7719aebf1abca98f31685b2e
Author: Bjørn Mork <bjorn@mork.no>
Date:   Tue Apr 9 11:26:02 2013 +0200

    USB: option: add a D-Link DWM-156 variant

    commit a2a2d6c7f93e160b52a4ad0164db1f43f743ae0f upstream.

    Adding support for a Mediatek based device labelled as
    D-Link Model: DWM-156, H/W Ver: A7

    Also adding two other device IDs found in the Debian(!)
    packages included on the embedded device driver CD.

    This is a composite MBIM + serial ports + card reader device:

    T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480  MxCh= 0
    D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=2001 ProdID=7d01 Rev= 3.00
    S:  Manufacturer=D-Link,Inc
    S:  Product=D-Link DWM-156
    C:* #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
    A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
    I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
    E:  Ad=88(I) Atr=03(Int.) MxPS=  64 Ivl=125us
    I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
    I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
    E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
    E:  Ad=87(I) Atr=03(Int.) MxPS=  64 Ivl=500us
    E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
    E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    I:* If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
    E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
    E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5e0c24d1ff9f94c0c1721b4b00b927aa6ecfe8fc
Author: Filippo Turato <nnj7585@gmail.com>
Date:   Sat Apr 20 15:04:08 2013 +0200

    USB: serial: option: Added support Olivetti Olicard 145

    commit d19bf5cedfd7d53854a3bd699c98b467b139833b upstream.

    This adds PID for Olivetti Olicard 145 in option.c

    Signed-off-by: Filippo Turato <nnj7585@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ea70316c0e035731348f6be194e6332388944029
Author: Michael Ellerman <michael@ellerman.id.au>
Date:   Tue Apr 23 15:13:14 2013 +0000

    powerpc/spufs: Initialise inode->i_ino in spufs_new_inode()

    commit 6747e83235caecd30b186d1282e4eba7679f81b7 upstream.

    In commit 85fe402 (fs: do not assign default i_ino in new_inode), the
    initialisation of i_ino was removed from new_inode() and pushed down
    into the callers. However spufs_new_inode() was not updated.

    This exhibits as no files appearing in /spu, because all our dirents
    have a zero inode, which readdir() seems to dislike.

    Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 74f31cf3c186bc0189ad560fadfc03dd9aa2f806
Author: Michael Neuling <michael.neuling@au1.ibm.com>
Date:   Wed Apr 24 00:30:09 2013 +0000

    powerpc: Add isync to copy_and_flush

    commit 29ce3c5073057991217916abc25628e906911757 upstream.

    In __after_prom_start we copy the kernel down to zero in two calls to
    copy_and_flush.  After the first call (copy from 0 to copy_to_here:)
    we jump to the newly copied code soon after.

    Unfortunately there's no isync between the copy of this code and the
    jump to it.  Hence it's possible that stale instructions could still be
    in the icache or pipeline before we branch to it.

    We've seen this on real machines and it's results in no console output
    after:
      calling quiesce...
      returning from prom_init

    The below adds an isync to ensure that the copy and flushing has
    completed before any branching to the new instructions occurs.

    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.0.78

commit ea88a24912c191babee3a3a2658ade2d53b880a9
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat May 11 13:38:25 2013 -0700

    Linux 3.0.78

commit 1183e651202ae381263309f6f122e0bf1234b5e2
Author: Andre Przywara <andre.przywara@amd.com>
Date:   Wed Oct 31 17:20:50 2012 +0100

    Revert "x86, amd: Disable way access filter on Piledriver CPUs" it is duplicated

    Revert 5e3fe67e02c53e5a5fcf0e2b0d91dd93f757d50b which is
    commit 2bbf0a1427c377350f001fbc6260995334739ad7 upstream.

    Willy pointed out that I messed up and applied this one twice to the
    3.0-stable tree, so revert the second instance of it.

    Reported by: Willy Tarreau <w@1wt.eu>
    Cc: Andre Przywara <osp@andrep.de>
    Cc: H. Peter Anvin <hpa@linux.intel.com>
    Cc: CAI Qian <caiqian@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    reverted:

commit dadd72be605e99445bedfacce8d07a85ac84eb41
Author: Jerry Hoemann <jerry.hoemann@hp.com>
Date:   Tue Apr 30 15:15:55 2013 -0600

    x86/mm: account for PGDIR_SIZE alignment

    Patch for -stable.  Function find_early_table_space removed upstream.

    Fixes panic in alloc_low_page due to pgt_buf overflow during
    init_memory_mapping.

    find_early_table_space sizes pgt_buf based upon the size of the
    memory being mapped, but it does not take into account the alignment
    of the memory.  When the region being mapped spans a 512GB (PGDIR_SIZE)
    alignment, a panic from alloc_low_pages occurs.

    kernel_physical_mapping_init takes into account PGDIR_SIZE alignment.
    This causes an extra call to alloc_low_page to be made.  This extra call
    isn't accounted for by find_early_table_space and causes a kernel panic.

    Change is to take into account PGDIR_SIZE alignment in find_early_table_space.

    Signed-off-by: Jerry Hoemann <jerry.hoemann@hp.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d47f90f3cb58908bb6f6720b678e37e57028a590
Author: Chen Gang <gang.chen@asianux.com>
Date:   Mon Apr 29 15:05:19 2013 -0700

    kernel/audit_tree.c: tree will leak memory when failure occurs in audit_trim_trees()

    commit 12b2f117f3bf738c1a00a6f64393f1953a740bd4 upstream.

    audit_trim_trees() calls get_tree().  If a failure occurs we must call
    put_tree().

    [akpm@linux-foundation.org: run put_tree() before mutex_lock() for small scalability improvement]
    Signed-off-by: Chen Gang <gang.chen@asianux.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Eric Paris <eparis@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 07bdcd24805f6c492c5871dac365f7ce0a331044
Author: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
Date:   Fri Mar 15 13:10:35 2013 -0400

    tracing: Fix ftrace_dump()

    commit 7fe70b579c9e3daba71635e31b6189394e7b79d3 upstream.

    ftrace_dump() had a lot of issues. What ftrace_dump() does, is when
    ftrace_dump_on_oops is set (via a kernel parameter or sysctl), it
    will dump out the ftrace buffers to the console when either a oops,
    panic, or a sysrq-z occurs.

    This was written a long time ago when ftrace was fragile to recursion.
    But it wasn't written well even for that.

    There's a possible deadlock that can occur if a ftrace_dump() is happening
    and an NMI triggers another dump. This is because it grabs a lock
    before checking if the dump ran.

    It also totally disables ftrace, and tracing for no good reasons.

    As the ring_buffer now checks if it is read via a oops or NMI, where
    there's a chance that the buffer gets corrupted, it will disable
    itself. No need to have ftrace_dump() do the same.

    ftrace_dump() is now cleaned up where it uses an atomic counter to
    make sure only one dump happens at a time. A simple atomic_inc_return()
    is enough that is needed for both other CPUs and NMIs. No need for
    a spinlock, as if one CPU is running the dump, no other CPU needs
    to do it too.

    The tracing_on variable is turned off and not turned on. The original
    code did this, but it wasn't pretty. By just disabling this variable
    we get the result of not seeing traces that happen between crashes.

    For sysrq-z, it doesn't get turned on, but the user can always write
    a '1' to the tracing_on file. If they are using sysrq-z, then they should
    know about tracing_on.

    The new code is much easier to read and less error prone. No more
    deadlock possibility when an NMI triggers here.

    Reported-by: zhangwei(Jovi) <jovi.zhangwei@huawei.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 82bab2b3b6d6029b06a4e85156ccf99bf95cc2f2
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Apr 25 09:29:17 2013 -0400

    drm/radeon: fix possible segfault when parsing pm tables

    commit f8e6bfc2ce162855fa4f9822a45659f4b542c960 upstream.

    If we have a empty power table, bail early and allocate
    the default power state.

    Should fix:
    https://bugs.freedesktop.org/show_bug.cgi?id=63865

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b085d867934932a43188297161a5fbbe07565b4c
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed Apr 24 14:39:31 2013 -0400

    drm/radeon: fix endian bugs in atom_allocate_fb_scratch()

    commit beb71fc61c2cad64e347f164991b8ef476529e64 upstream.

    Reviwed-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 370112b115a3867b2ebf0ac6a2f44f11425fe818
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Apr 11 12:45:34 2013 -0400

    drm/radeon/evergreen+: don't enable HPD interrupts on eDP/LVDS

    commit 2e97be73e5f74a317232740ae82eb8f95326a660 upstream.

    Avoids potential interrupt storms when the display is disabled.

    May fix:
    https://bugzilla.kernel.org/show_bug.cgi?id=56041

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b1459cd57d01eb554821bf263463ef18bc1f59ef
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Mar 18 17:12:50 2013 -0400

    drm/radeon: don't use get_engine_clock() on APUs

    commit bf05d9985111f85ed6922c134567b96eb789283b upstream.

    It doesn't work reliably.  Just report back the currently
    selected engine clock.

    Partially fixes:
    https://bugs.freedesktop.org/show_bug.cgi?id=62493

    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c2fde23d77ebcf4577fdd703af8b1600f3c87f69
Author: David Müller <d.mueller@elsoft.ch>
Date:   Fri Apr 19 10:41:50 2013 +0200

    drm/i915: Fall back to bit banging mode for DVO transmitter detection

    commit e4bfff54ed3f5de88f5358504c78c2cb037813aa upstream.

    As discussed in this thread
    http://lists.freedesktop.org/archives/dri-devel/2013-April/037411.html
    GMBUS based DVO transmitter detection seems to be unreliable which could
    result in an unusable DVO port.

    The attached patch fixes this by falling back to bit banging mode for
    the time DVO transmitter detection is in progress.

    Signed-off-by: David Müller <d.mueller@elsoft.ch>
    Tested-by: David Müller <d.mueller@elsoft.ch>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit df859ddd0675a729e4108da5bd9c3ac9618441f2
Author: Christian Lamparter <chunkeey@googlemail.com>
Date:   Wed Apr 3 14:34:11 2013 +0200

    drm/i915: Add no-lvds quirk for Fujitsu Esprimo Q900

    commit 9e9dd0e889c76c786e8f2e164c825c3c06dea30c upstream.

    The "Mobile Sandy Bridge CPUs" in the Fujitsu Esprimo Q900
    mini desktop PCs are probably misleading the LVDS detection
    code in intel_lvds_supported. Nothing is connected to the
    LVDS ports in these systems.

    Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 332400ff82e7d3ea465bf62d46c87953f59a118b
Author: Hans Schillstrom <hans@schillstrom.com>
Date:   Sat Apr 27 20:06:14 2013 +0200

    ipvs: ip_vs_sip_fill_param() BUG: bad check of return value

    commit f7a1dd6e3ad59f0cfd51da29dfdbfd54122c5916 upstream.

    The reason for this patch is crash in kmemdup
    caused by returning from get_callid with uniialized
    matchoff and matchlen.

    Removing Zero check of matchlen since it's done by ct_sip_get_header()

    BUG: unable to handle kernel paging request at ffff880457b5763f
    IP: [<ffffffff810df7fc>] kmemdup+0x2e/0x35
    PGD 27f6067 PUD 0
    Oops: 0000 [#1] PREEMPT SMP
    Modules linked in: xt_state xt_helper nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle xt_connmark xt_conntrack ip6_tables nf_conntrack_ftp ip_vs_ftp nf_nat xt_tcpudp iptable_mangle xt_mark ip_tables x_tables ip_vs_rr ip_vs_lblcr ip_vs_pe_sip ip_vs nf_conntrack_sip nf_conntrack bonding igb i2c_algo_bit i2c_core
    CPU 5
    Pid: 0, comm: swapper/5 Not tainted 3.9.0-rc5+ #5                  /S1200KP
    RIP: 0010:[<ffffffff810df7fc>]  [<ffffffff810df7fc>] kmemdup+0x2e/0x35
    RSP: 0018:ffff8803fea03648  EFLAGS: 00010282
    RAX: ffff8803d61063e0 RBX: 0000000000000003 RCX: 0000000000000003
    RDX: 0000000000000003 RSI: ffff880457b5763f RDI: ffff8803d61063e0
    RBP: ffff8803fea03658 R08: 0000000000000008 R09: 0000000000000011
    R10: 0000000000000011 R11: 00ffffffff81a8a3 R12: ffff880457b5763f
    R13: ffff8803d67f786a R14: ffff8803fea03730 R15: ffffffffa0098e90
    FS:  0000000000000000(0000) GS:ffff8803fea00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffff880457b5763f CR3: 0000000001a0c000 CR4: 00000000001407e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process swapper/5 (pid: 0, threadinfo ffff8803ee18c000, task ffff8803ee18a480)
    Stack:
     ffff8803d822a080 000000000000001c ffff8803fea036c8 ffffffffa000937a
     ffffffff81f0d8a0 000000038135fdd5 ffff880300000014 ffff880300110000
     ffffffff150118ac ffff8803d7e8a000 ffff88031e0118ac 0000000000000000
    Call Trace:
     <IRQ>

     [<ffffffffa000937a>] ip_vs_sip_fill_param+0x13a/0x187 [ip_vs_pe_sip]
     [<ffffffffa007b209>] ip_vs_sched_persist+0x2c6/0x9c3 [ip_vs]
     [<ffffffff8107dc53>] ? __lock_acquire+0x677/0x1697
     [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
     [<ffffffff8100972e>] ? native_sched_clock+0x3c/0x7d
     [<ffffffff810649bc>] ? sched_clock_cpu+0x43/0xcf
     [<ffffffffa007bb1e>] ip_vs_schedule+0x181/0x4ba [ip_vs]
    ...

    Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Signed-off-by: Simon Horman <horms@verge.net.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eda948e04f7804886db45005eae5793a6ffb0bbc
Author: David Jeffery <djeffery@redhat.com>
Date:   Mon May 6 13:49:30 2013 +0800

    autofs - remove autofs dentry mount check

    commit ce8a5dbdf9e709bdaf4618d7ef8cceb91e8adc69 upstream.

    When checking if an autofs mount point is busy it isn't sufficient to
    only check if it's a mount point.

    For example, if the mount of an offset mountpoint in a tree is denied
    for this host by its export and the dentry becomes a process working
    directory the check incorrectly returns the mount as not in use at
    expire.

    This can happen since the default when mounting within a tree is
    nostrict, which means ingnore mount fails on mounts within the tree and
    continue.  The nostrict option is meant to allow mounting in this case.

    Signed-off-by: David Jeffery <djeffery@redhat.com>
    Signed-off-by: Ian Kent <raven@themaw.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5013bcf5cbd6969b8873b964e0d7aaab430cf643
Author: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
Date:   Fri Mar 22 05:49:35 2013 +0000

    powerpc: fix numa distance for form0 device tree

    commit 7122beeee7bc1757682049780179d7c216dd1c83 upstream.

    The following commit breaks numa distance setup for old powerpc
    systems that use form0 encoding in device tree.

    commit 41eab6f88f24124df89e38067b3766b7bef06ddb
    powerpc/numa: Use form 1 affinity to setup node distance

    Device tree node /rtas/ibm,associativity-reference-points would
    index into /cpus/PowerPCxxxx/ibm,associativity based on form0 or
    form1 encoding detected by ibm,architecture-vec-5 property.

    All modern systems use form1 and current kernel code is correct.
    However, on older systems with form0 encoding, the numa distance
    will get hard coded as LOCAL_DISTANCE for all nodes.  This causes
    task scheduling anomaly since scheduler will skip building numa
    level domain (topmost domain with all cpus) if all numa distances
    are same.  (value of 'level' in sched_init_numa() will remain 0)

    Prior to the above commit:
    ((from) == (to) ? LOCAL_DISTANCE : REMOTE_DISTANCE)

    Restoring compatible behavior with this patch for old powerpc systems
    with device tree where numa distance are encoded as form0.

    Signed-off-by: Vaidyanathan Srinivasan <svaidy@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'cm-10.1-wip' into cm-10.1