commit 156c7581a8b9b7d9665c63f96e312093736c832e Author: Greg Kroah-Hartman Date: Wed Dec 11 22:38:07 2013 -0800 Linux 3.12.5 commit 012228e9c4841140fc6a3e5da6196b6550890f83 Author: Tom Lendacky Date: Thu Dec 5 13:09:53 2013 -0600 crypto: scatterwalk - Use sg_chain_ptr on chain entries commit 389a5390583a18e45bc4abd4439291abec5e7a63 upstream. Now that scatterwalk_sg_chain sets the chain pointer bit the sg_page call in scatterwalk_sg_next hits a BUG_ON when CONFIG_DEBUG_SG is enabled. Use sg_chain_ptr instead of sg_page on a chain entry. Signed-off-by: Tom Lendacky Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 97b054c2ee8ba8a3542f391641fd78f6e3e44f0a Author: Alan Cox Date: Tue Dec 3 13:56:56 2013 -0800 drivers/char/i8k.c: add Dell XPLS L421X commit 9aa5b0181bdf335f0b731d8502e128a862884bcd upstream. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=60772 Signed-off-by: Alan Cox Reported-by: Leho Kraav Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 90c06d2ba01742f7d0db83476e02d81dfa1d160a Author: David Cluytens Date: Tue Dec 3 14:18:57 2013 +0100 USB: cdc-acm: Added support for the Lenovo RD02-D400 USB Modem commit 3b59d16c513da258ec8f6a0b4db85f257a0380d6 upstream. Signed-off-by: David Cluytens Signed-off-by: Greg Kroah-Hartman commit 95502f5d08ed7e56ab909c93925f0f5ee506a1a0 Author: Colin Leitner Date: Fri Nov 8 22:53:11 2013 +0100 USB: spcp8x5: correct handling of CS5 setting commit 711fbdfbf2bc4827214a650afe3f64767a1aba16 upstream. This patch removes an erroneous check of CSIZE, which made it impossible to set CS5. Compiles clean, but couldn't test against hardware. Signed-off-by: Colin Leitner Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit cfc0fb79481a664520e2b7488148f889b3e7270e Author: Colin Leitner Date: Fri Nov 8 22:52:34 2013 +0100 USB: mos7840: correct handling of CS5 setting commit 78692cc3382e0603a47e1f2aaeffe0d99891994d upstream. This patch removes an erroneous check of CSIZE, which made it impossible to set CS5. Compiles clean, but couldn't test against hardware. Signed-off-by: Colin Leitner Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit caf2e52920cddef72922cbe7c2140e5d3a690bc6 Author: Colin Leitner Date: Tue Nov 5 18:02:34 2013 +0100 USB: ftdi_sio: fixed handling of unsupported CSIZE setting commit 8704211f65a2106ba01b6ac9727cdaf9ca11594c upstream. FTDI UARTs support only 7 or 8 data bits. Until now the ftdi_sio driver would only report this limitation for CS6 to dmesg and fail to reflect this fact to tcgetattr. This patch reverts the unsupported CSIZE setting and reports the fact with less severance to dmesg for both CS5 and CS6. To test the patch it's sufficient to call stty -F /dev/ttyUSB0 cs5 which will succeed without the patch and report an error with the patch applied. As an additional fix this patch ensures that the control request will always include a data bit size. Signed-off-by: Colin Leitner Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit b0e98c492680710765baf6c8b51e60883d22808c Author: Colin Leitner Date: Mon Nov 4 19:40:43 2013 +0100 USB: pl2303: fixed handling of CS5 setting commit a313249937820f8b1996133fc285efbd6aad2c5b upstream. This patch fixes the CS5 setting on the PL2303 USB-to-serial devices. CS5 has a value of 0 and the CSIZE setting has been skipped altogether by the enclosing if. Tested on 3.11.6 and the scope shows the correct output after the fix has been applied. Tagged to be added to stable, because it fixes a user visible driver bug and is simple enough to backport easily. Signed-off-by: Colin Leitner Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 8aa61f36bb68b7544a7c955658e29556f866bb6a Author: Peter Hurley Date: Fri Nov 29 12:56:10 2013 -0500 n_tty: Fix missing newline echo commit 39434abd942c8e4b9c14c06a03b3245beaf8467f upstream. When L_ECHONL is on, newlines are echoed regardless of the L_ECHO state; if set, ensure accumulated echoes are flushed before finishing the current input processing and before more output. Reported-by: Jason Gunthorpe Signed-off-by: Peter Hurley Signed-off-by: Greg Kroah-Hartman commit 003bd1d4842bb9a34cbd1513e19183e94323931f Author: Tomas Winkler Date: Thu Dec 5 09:34:44 2013 +0200 mei: add 9 series PCH mei device ids commit 76a9635979e543f04a5885198e68ff28e3311b67 upstream. And Lynx Point H Refresh and Wildcat Point LP device ids. Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman commit 56c4c4c9a6c972c45501ea5ae6852563b08bfd2b Author: Tomas Winkler Date: Wed Oct 16 12:09:43 2013 +0300 mei: me: add Lynx Point Wellsburg work station device id commit 838b3a6d62413b336f3dde15ecff161070358957 upstream. add missing device id for LPT based work station Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman commit b8a448cd9f2ff3145b5ef6c87f40e3bc43435d41 Author: Tom Gundersen Date: Thu Oct 31 00:44:49 2013 -0700 Input: mousedev - allow disabling even without CONFIG_EXPERT commit dfaaed08ecc01bd513248ba7999daf50ce028352 upstream. Moust (if not all) modern software, including X, uses /dev/eventX rather than the legacy /dev/mouseX devices. It therefore makes sense for general-purpose (distro) kernels to use MOUSEDV=m (or even n), so let's drop the EXPERT=y requirement. Signed-off-by: Tom Gundersen Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit ef949019278ccb1c2a9aff6f8454287e9ed6bda8 Author: Tom Gundersen Date: Thu Oct 31 00:38:30 2013 -0700 Input: allow deselecting serio drivers even without CONFIG_EXPERT commit bcd2623073e98f69f84720308db0b142c4da0bd6 upstream. There is plenty of consumer hardware (e.g., mac books) that does not use AT keyboards or PS/2 mice. It therefore makes sense for distro kernels to build the related drivers as modules to avoid loading them on hardware that does not need them. As such, these options should no longer be protected by EXPERT. Moreover, building these drivers as modules gets rid of the following ugly error during boot: [ 2.337745] i8042: PNP: No PS/2 controller found. Probing ports directly. [ 3.439537] i8042: No controller found Signed-off-by: Tom Gundersen Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 4412b433d6a5c990f69d763c9ed5d187d49bc63a Author: Ivan Vecera Date: Wed Nov 6 14:02:36 2013 +0100 tg3: avoid double-freeing of rx data memory commit 85aec73d595b8847f9c4ea571deb127913f0d508 upstream. If build_skb fails the memory associated with the ring buffer is freed but the ri->data member is not zeroed in this case. This causes a double-free of this memory in tg3_free_rings->... path. The patch moves this block after setting ri->data to NULL. It would be nice to fix this bug also in stable >= v3.4 trees. Cc: Nithin Nayak Sujir Cc: Michael Chan Signed-off-by: Ivan Vecera Acked-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 92a74362266f7fd5107ce3728452538824b1fa06 Author: Emmanuel Grumbach Date: Tue Oct 15 22:04:54 2013 +0300 iwlwifi: dvm: don't override mac80211's queue setting commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream. Since we set IEEE80211_HW_QUEUE_CONTROL, we can let mac80211 do the queue assignement and don't need to override its decisions. While reassiging the same values is harmless of course, it triggered a WARNING when iwlwifi and mac80211 came to different conclusions. This happened when mac80211 set IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the packet to the cab_queue because no stations were asleep. iwlwifi should not override mac80211's decicions for offchannel packets and packets to be sent after DTIM, but it should override mac80211's decision for AMPDUs since we have a special queue for them. So for AMPDU, we still override info->hw_queue by the AMPDU queue. This avoids: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883() Modules linked in: CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1 Hardware name: /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000 ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000 ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e Call Trace: [] ? dump_stack+0x41/0x51 [] ? warn_slowpath_common+0x78/0x90 [] ? iwlagn_tx_skb+0x6c5/0x883 [] ? iwlagn_tx_skb+0x6c5/0x883 [] ? put_cred+0x15/0x15 [] ? iwlagn_mac_tx+0x19/0x2f [] ? __ieee80211_tx+0x226/0x29b [] ? ieee80211_tx+0xa6/0xb5 [] ? ieee80211_monitor_start_xmit+0x1e9/0x204 [] ? dev_hard_start_xmit+0x271/0x3ec [] ? sch_direct_xmit+0x66/0x164 [] ? dev_queue_xmit+0x1e5/0x3c8 [] ? packet_sendmsg+0xac5/0xb3d [] ? sock_sendmsg+0x37/0x52 [] ? __do_fault+0x338/0x36b [] ? verify_iovec+0x44/0x94 [] ? ___sys_sendmsg+0x1f1/0x283 [] ? __inode_wait_for_writeback+0x67/0xae [] ? __cache_free.isra.46+0x178/0x187 [] ? kmem_cache_free+0x44/0x84 [] ? dentry_kill+0x13d/0x149 [] ? dput+0xe5/0xef [] ? fget_light+0x2e/0x7c [] ? __sys_sendmsg+0x39/0x57 [] ? system_call_fastpath+0x16/0x1b ---[ end trace 1b3eb79359c1d1e6 ]--- Reported-by: Sander Eikelenboom Reviewed-by: Johannes Berg Signed-off-by: Johannes Berg Signed-off-by: Emmanuel Grumbach Signed-off-by: Greg Kroah-Hartman commit aaca4317a24698e7ab51f1f64f1ab099b7521202 Author: Martin K. Petersen Date: Wed Oct 23 06:25:40 2013 -0400 SCSI: Disable WRITE SAME for RAID and virtual host adapter drivers commit 54b2b50c20a61b51199bedb6e5d2f8ec2568fb43 upstream. Some host adapters do not pass commands through to the target disk directly. Instead they provide an emulated target which may or may not accurately report its capabilities. In some cases the physical device characteristics are reported even when the host adapter is processing commands on the device's behalf. This can lead to adapter firmware hangs or excessive I/O errors. This patch disables WRITE SAME for devices connected to host adapters that provide an emulated target. Driver writers can disable WRITE SAME by setting the no_write_same flag in the host adapter template. [jejb: fix up rejections due to eh_deadline patch] Signed-off-by: Martin K. Petersen Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 6b3018c7695508599812528b7e7604ba4b7534d5 Author: H. Peter Anvin Date: Wed Nov 20 13:31:49 2013 -0800 x86-64, build: Always pass in -mno-sse commit 5551a34e5aeab868f8d37f70d8754868921b4ee5 upstream. Always pass in the -mno-sse argument, regardless if -preferred-stack-boundary is supported. We never want to generate SSE instructions in the kernel unless we *really* know what we're doing. According to H. J. Lu, any version of gcc new enough that we support it at all should handle the -mno-sse option, so just add it unconditionally. Reported-by: Kevin B. Smith Signed-off-by: H. Peter Anvin Cc: H. J. Lu Link: http://lkml.kernel.org/n/tip-j21wzqv790q834n7yc6g80j1@git.kernel.org Signed-off-by: Greg Kroah-Hartman commit e1ef48884d9934a86352f3e29d0e97aafb8042c7 Author: Shawn Landden Date: Sun Nov 24 22:36:28 2013 -0800 net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST commit d3f7d56a7a4671d395e8af87071068a195257bf6 upstream. Commit 35f9c09fe (tcp: tcp_sendpages() should call tcp_push() once) added an internal flag MSG_SENDPAGE_NOTLAST, similar to MSG_MORE. algif_hash, algif_skcipher, and udp used MSG_MORE from tcp_sendpages() and need to see the new flag as identical to MSG_MORE. This fixes sendfile() on AF_ALG. v3: also fix udp Cc: Tom Herbert Cc: Eric Dumazet Cc: David S. Miller Reported-and-tested-by: Shawn Landden Original-patch: Richard Weinberger Signed-off-by: Shawn Landden Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 51bb75cbab7e08ea1ee59c0cfcfa68d1d80dfea4 Author: Laxman Dewangan Date: Mon Nov 25 19:39:47 2013 +0530 irq: Enable all irqs unconditionally in irq_resume commit ac01810c9d2814238f08a227062e66a35a0e1ea2 upstream. When the system enters suspend, it disables all interrupts in suspend_device_irqs(), including the interrupts marked EARLY_RESUME. On the resume side things are different. The EARLY_RESUME interrupts are reenabled in sys_core_ops->resume and the non EARLY_RESUME interrupts are reenabled in the normal system resume path. When suspend_noirq() failed or suspend is aborted for any other reason, we might omit the resume side call to sys_core_ops->resume() and therefor the interrupts marked EARLY_RESUME are not reenabled and stay disabled forever. To solve this, enable all irqs unconditionally in irq_resume() regardless whether interrupts marked EARLY_RESUMEhave been already enabled or not. This might try to reenable already enabled interrupts in the non failure case, but the only affected platform is XEN and it has been confirmed that it does not cause any side effects. [ tglx: Massaged changelog. ] Signed-off-by: Laxman Dewangan Acked-by-and-tested-by: Konrad Rzeszutek Wilk Acked-by: Heiko Stuebner Reviewed-by: Pavel Machek Cc: Cc: Cc: Cc: Link: http://lkml.kernel.org/r/1385388587-16442-1-git-send-email-ldewangan@nvidia.com Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 4830959318d14bd8856437ad5beea6016ef8c484 Author: Hong Zhiguo Date: Wed Nov 20 10:35:05 2013 -0700 Update of blkg_stat and blkg_rwstat may happen in bh context. While u64_stats_fetch_retry is only preempt_disable on 32bit UP system. This is not enough to avoid preemption by bh and may read strange 64 bit value. commit 2c575026fae6e63771bd2a4c1d407214a8096a89 upstream. Signed-off-by: Hong Zhiguo Acked-by: Tejun Heo Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 7b549e29197626f361f29c0a3e444259f048702f Author: Konrad Rzeszutek Wilk Date: Tue Dec 3 10:59:58 2013 -0500 cpuidle: Check for dev before deregistering it. commit 813e8e3d6aaa0b511126cce15c16a931afffe768 upstream. If not, we could end up in the unfortunate situation where we dereference a NULL pointer b/c we have cpuidle disabled. This is the case when booting under Xen (which uses the ACPI P/C states but disables the CPU idle driver) - and can be easily reproduced when booting with cpuidle.off=1. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] cpuidle_unregister_device+0x2a/0x90 .. snip.. Call Trace: [] acpi_processor_power_exit+0x3c/0x5c [] acpi_processor_stop+0x61/0xb6 [] __device_release_driver+0fffff81421653>] device_release_driver+0x23/0x30 [] bus_remove_device+0x108/0x180 [] device_del+0x129/0x1c0 [] ? unregister_xenbus_watch+0x1f0/0x1f0 [] device_unregister+0x1e/0x60 [] unregister_cpu+0x39/0x60 [] arch_unregister_cpu+0x23/0x30 [] handle_vcpu_hotplug_event+0xc1/0xe0 [] xenwatch_thread+0x45/0x120 [] ? abort_exclusive_wait+0xb0/0xb0 [] kthread+0xd2/0xf0 [] ? kthread_create_on_node+0x180/0x180 [] ret_from_fork+0x7c/0xb0 [] ? kthread_create_on_node+0x180/0x180 This problem also appears in 3.12 and could be a candidate for backport. Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 8c89bc17f72f77a6b1cf86f075fa4d64214da35d Author: Mika Westerberg Date: Tue Nov 12 12:06:21 2013 +0200 spi/pxa2xx: add new ACPI IDs commit 54acbd9688e6324470671525c7916011f1ff8081 upstream. Newer Intel PCHs with LPSS have the same SPI controllers than Haswell but ACPI IDs are different. Add these IDs to the driver list. Signed-off-by: Mika Westerberg Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit cbea416b8e9f1e3324551d99c94cc35c025a23f6 Author: Matt Wilson Date: Wed Nov 20 12:11:35 2013 -0800 xen/gnttab: leave lazy MMU mode in the case of a m2p override failure commit 14883a75ec76b44759385fb12629f4a0f1aef4e3 upstream. Commit f62805f1 introduced a bug where lazy MMU mode isn't exited if a m2p_add/remove_override call fails. Acked-by: Stefano Stabellini Cc: Boris Ostrovsky Reviewed-by: David Vrabel Reviewed-by: Anthony Liguori Signed-off-by: Matt Wilson Signed-off-by: Konrad Rzeszutek Wilk Signed-off-by: Greg Kroah-Hartman commit 527c106d547866865ec9368f913b25f530f9f2a5 Author: Helge Deller Date: Wed Nov 20 23:07:42 2013 +0100 parisc: fix mmap(MAP_FIXED|MAP_SHARED) to already mmapped address commit 0576da2c08e3d332f1b0653030d28ab804585ab6 upstream. locale-gen on Debian showed a strange problem on parisc: mmap2(NULL, 536870912, PROT_NONE, MAP_SHARED, 3, 0) = 0x42a54000 mmap2(0x42a54000, 103860, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, 3, 0) = -1 EINVAL (Invalid argument) Basically it was just trying to re-mmap() a file at the same address which it was given by a previous mmap() call. But this remapping failed with EINVAL. The problem is, that when MAP_FIXED and MAP_SHARED flags were used, we didn't included the mapping-based offset when we verified the alignment of the given fixed address against the offset which we calculated it in the previous call. Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman commit 8dd478f2d7480ce2ba7e1fa89d00049fb03b6b94 Author: Liu Gang Date: Fri Nov 22 16:12:40 2013 +0800 powerpc/gpio: Fix the wrong GPIO input data on MPC8572/MPC8536 commit 1aeef303b5d9e243c41d5b80f8bb059366514a10 upstream. For MPC8572/MPC8536, the status of GPIOs defined as output cannot be determined by reading GPDAT register, so the code use shadow data register instead. But the code may give the wrong status of GPIOs defined as input under some scenarios: 1. If some pins were configured as inputs and were asserted high before booting the kernel, the shadow data has been initialized with those pin values. 2. Some pins have been configured as output first and have been set to the high value, then reconfigured as input. The above cases will make the shadow data for those input pins to be set to high. Then reading the pin status will always return high even if the actual pin status is low. The code should eliminate the effects of the shadow data to the input pins, and the status of those pins should be read directly from GPDAT. Acked-by: Scott Wood Acked-by: Anatolij Gustschin Signed-off-by: Liu Gang Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 90a01bfc77a797b9fb59d0f88224a9de02953700 Author: Martin Schwidefsky Date: Fri Nov 22 11:44:51 2013 -0800 time: Fix 1ns/tick drift w/ GENERIC_TIME_VSYSCALL_OLD commit 4be77398ac9d948773116b6be4a3c91b3d6ea18c upstream. Since commit 1e75fa8be9f (time: Condense timekeeper.xtime into xtime_sec - merged in v3.6), there has been an problem with the error accounting in the timekeeping code, such that when truncating to nanoseconds, we round up to the next nsec, but the balancing adjustment to the ntp_error value was dropped. This causes 1ns per tick drift forward of the clock. In 3.7, this logic was isolated to only GENERIC_TIME_VSYSCALL_OLD architectures (s390, ia64, powerpc). The fix is simply to balance the accounting and to subtract the added nanosecond from ntp_error. This allows the internal long-term clock steering to keep the clock accurate. While this fix removes the regression added in 1e75fa8be9f, the ideal solution is to move away from GENERIC_TIME_VSYSCALL_OLD and use the new VSYSCALL method, which avoids entirely the nanosecond granular rounding, and the resulting short-term clock adjustment oscillation needed to keep long term accurate time. [ jstultz: Many thanks to Martin for his efforts identifying this subtle bug, and providing the fix. ] Originally-from: Martin Schwidefsky Cc: Tony Luck Cc: Paul Mackerras Cc: Benjamin Herrenschmidt Cc: Andy Lutomirski Cc: Paul Turner Cc: Steven Rostedt Cc: Richard Cochran Cc: Prarit Bhargava Cc: Fenghua Yu Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1385149491-20307-1-git-send-email-john.stultz@linaro.org Signed-off-by: John Stultz Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 633dba4a3b3665c5cce839938f18c74e4e86570f Author: Dmitry Torokhov Date: Thu Dec 5 02:01:55 2013 +0100 PNP: fix restoring devices after hibernation commit 8a37ea50e7acf8db6821ba094ca41384e7d8c70c upstream. On returning from hibernation 'restore' callback is called, not 'resume'. Fix it. Fixes: eaf140b60ec9 (PNP: convert PNP driver bus legacy pm_ops to dev_pm_ops) Signed-off-by: Dmitry Torokhov Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman commit 09b35fb0e19ad13c66662ae7fefeb50b6a9888b7 Author: Trond Myklebust Date: Tue Nov 19 16:34:14 2013 -0500 NFSv4: Update list of irrecoverable errors on DELEGRETURN commit c97cf606e43b85a6cf158b810375dd77312024db upstream. If the DELEGRETURN errors out with something like NFS4ERR_BAD_STATEID then there is no recovery possible. Just quit without returning an error. Also, note that the client must not assume that the NFSv4 lease has been renewed when it sees an error on DELEGRETURN. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit fca692bdc16a23c46ee5b1917afcb4dd7be35b6c Author: Stephen M. Cameron Date: Fri Nov 1 11:02:25 2013 -0500 SCSI: hpsa: return 0 from driver probe function on success, not 1 commit 88bf6d62db4393fa03a58bada9d746312d5b496f upstream. A return value of 1 is interpreted as an error. See pci_driver. in local_pci_probe(). If you're wondering how this ever could have worked, it's because it used to be the case that only return values less than zero were interpreted as failure. But even in the current kernel if the driver registers its various entry points with the kernel, and then returns a value which is interpreted as failure, those registrations aren't undone, so the driver still mostly works. However, the driver's remove function wouldn't be called on rmmod, and pci power management functions wouldn't work. In the case of Smart Array, since it has a battery backed cache (or else no cache) even if the driver is not shut down properly as long as there is no outstanding i/o, nothing too bad happens, which is why it took so long to notice. Requesting backport to stable because the change to pci-driver.c which requires driver probe functions to return 0 occurred between 2.6.35 and 2.6.36 (the pci power management breakage) and again between 3.7 and 3.8 (pci_dev->driver getting set to NULL in local_pci_probe() preventing driver remove function from being called on rmmod.) Signed-off-by: Stephen M. Cameron Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 608bc2cb63738ec8b55a5c70225234b905ea4a00 Author: Stephen M. Cameron Date: Mon Sep 23 13:33:41 2013 -0500 SCSI: hpsa: do not discard scsi status on aborted commands commit 2e311fbabdc23b7eaec77313dc3b9a151a5407b5 upstream. We inadvertantly discarded the scsi status for aborted commands. For some commands (e.g. reads from tape drives) these can't be retried, and if we discarded the scsi status, the scsi mid layer couldn't notice anything was wrong and the error was not reported. Signed-off-by: Stephen M. Cameron Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 7510fa67b9110e498a12ead8991e62e53f987de0 Author: Dan Williams Date: Tue Oct 22 18:35:19 2013 -0700 SCSI: libsas: fix usage of ata_tf_to_fis commit ae5fbae0ccd982dfca0ce363036ed92f5b13f150 upstream. Since commit 110dd8f19df5 "[SCSI] libsas: fix scr_read/write users and update the libata documentation" we have been passing pmp=1 and is_cmd=0 to ata_tf_to_fis(). Praveen reports that eSATA attached drives do not discover correctly. His investigation found that the BIOS was passing pmp=0 while Linux was passing pmp=1 and failing to discover the drives. Update libsas to follow the libata example of pulling the pmp setting from the ata_link and correct is_cmd to be 1 since all tf's submitted through ->qc_issue are commands. Presumably libsas lldds do not care about is_cmd as they have sideband mechanisms to perform link management. http://marc.info/?l=linux-scsi&m=138179681726990 [jejb: checkpatch fix] Signed-off-by: Dan Williams Reported-by: Praveen Murali Tested-by: Praveen Murali Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit ccdc5fa75e43f67b006f63e26a551eefa4b0fb96 Author: James Bottomley Date: Fri Nov 15 14:58:00 2013 -0800 SCSI: enclosure: fix WARN_ON in dual path device removing commit a1470c7bf3a4676e62e4c0fb204e339399eb5c59 upstream. Bug report from: wenxiong@linux.vnet.ibm.com The issue is happened in dual controller configuration. We got the sysfs warnings when rmmod the ipr module. enclosure_unregister() in drivers/msic/enclosure.c, call device_unregister() for each componment deivce, device_unregister() ->device_del()->kobject_del() ->sysfs_remove_dir(). In sysfs_remove_dir(), set kobj->sd = NULL. For each componment device, enclosure_component_release()->enclosure_remove_links()->sysfs_remove_link() in which checking kobj->sd again, it has been set as NULL when doing device_unregister. So we saw all these sysfs WARNING. Tested-by: wenxiong@linux.vnet.ibm.com Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 1b1dd81ce7cadac3aada70fb7c5208748c28623f Author: Vijaya Mohan Guvva Date: Thu Nov 21 01:37:49 2013 -0800 SCSI: bfa: Fix crash when symb name set for offline vport commit 22a08538dca5c0630226f1c0c58dccd12e463d22 upstream. This patch fixes a crash when tried setting symbolic name for an offline vport through sysfs. Crash is due to uninitialized pointer lport->ns, which gets initialized only on linkup (port online). Signed-off-by: Vijaya Mohan Guvva Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit e25c1306c5780fa6108fb0180ba31ace928bc593 Author: Madper Xie Date: Fri Nov 29 15:58:57 2013 +0800 efi-pstore: Make efi-pstore return a unique id commit fdeadb43fdf1e7d5698c027b555c389174548e5a upstream. Pstore fs expects that backends provide a unique id which could avoid pstore making entries as duplication or denominating entries the same name. So I combine the timestamp, part and count into id. Signed-off-by: Madper Xie Cc: Seiji Aguchi Signed-off-by: Matt Fleming Signed-off-by: Greg Kroah-Hartman commit a24851a1fe45a78be42d28c0dea6084f0c5c3afe Author: Seiji Aguchi Date: Wed Oct 30 15:27:26 2013 -0400 efivars, efi-pstore: Hold off deletion of sysfs entry until the scan is completed commit e0d59733f6b1796b8d6692642c87d7dd862c3e3a upstream. Currently, when mounting pstore file system, a read callback of efi_pstore driver runs mutiple times as below. - In the first read callback, scan efivar_sysfs_list from head and pass a kmsg buffer of a entry to an upper pstore layer. - In the second read callback, rescan efivar_sysfs_list from the entry and pass another kmsg buffer to it. - Repeat the scan and pass until the end of efivar_sysfs_list. In this process, an entry is read across the multiple read function calls. To avoid race between the read and erasion, the whole process above is protected by a spinlock, holding in open() and releasing in close(). At the same time, kmemdup() is called to pass the buffer to pstore filesystem during it. And then, it causes a following lockdep warning. To make the dynamic memory allocation runnable without taking spinlock, holding off a deletion of sysfs entry if it happens while scanning it via efi_pstore, and deleting it after the scan is completed. To implement it, this patch introduces two flags, scanning and deleting, to efivar_entry. On the code basis, it seems that all the scanning and deleting logic is not needed because __efivars->lock are not dropped when reading from the EFI variable store. But, the scanning and deleting logic is still needed because an efi-pstore and a pstore filesystem works as follows. In case an entry(A) is found, the pointer is saved to psi->data. And efi_pstore_read() passes the entry(A) to a pstore filesystem by releasing __efivars->lock. And then, the pstore filesystem calls efi_pstore_read() again and the same entry(A), which is saved to psi->data, is used for resuming to scan a sysfs-list. So, to protect the entry(A), the logic is needed. [ 1.143710] ------------[ cut here ]------------ [ 1.144058] WARNING: CPU: 1 PID: 1 at kernel/lockdep.c:2740 lockdep_trace_alloc+0x104/0x110() [ 1.144058] DEBUG_LOCKS_WARN_ON(irqs_disabled_flags(flags)) [ 1.144058] Modules linked in: [ 1.144058] CPU: 1 PID: 1 Comm: systemd Not tainted 3.11.0-rc5 #2 [ 1.144058] 0000000000000009 ffff8800797e9ae0 ffffffff816614a5 ffff8800797e9b28 [ 1.144058] ffff8800797e9b18 ffffffff8105510d 0000000000000080 0000000000000046 [ 1.144058] 00000000000000d0 00000000000003af ffffffff81ccd0c0 ffff8800797e9b78 [ 1.144058] Call Trace: [ 1.144058] [] dump_stack+0x54/0x74 [ 1.144058] [] warn_slowpath_common+0x7d/0xa0 [ 1.144058] [] warn_slowpath_fmt+0x4c/0x50 [ 1.144058] [] ? vsscanf+0x57f/0x7b0 [ 1.144058] [] lockdep_trace_alloc+0x104/0x110 [ 1.144058] [] __kmalloc_track_caller+0x50/0x280 [ 1.144058] [] ? efi_pstore_read_func.part.1+0x12b/0x170 [ 1.144058] [] kmemdup+0x20/0x50 [ 1.144058] [] efi_pstore_read_func.part.1+0x12b/0x170 [ 1.144058] [] ? efi_pstore_read_func.part.1+0x170/0x170 [ 1.144058] [] efi_pstore_read_func+0xb4/0xe0 [ 1.144058] [] __efivar_entry_iter+0xfb/0x120 [ 1.144058] [] efi_pstore_read+0x3f/0x50 [ 1.144058] [] pstore_get_records+0x9a/0x150 [ 1.158207] [] ? selinux_d_instantiate+0x1c/0x20 [ 1.158207] [] ? parse_options+0x80/0x80 [ 1.158207] [] pstore_fill_super+0xa5/0xc0 [ 1.158207] [] mount_single+0xa2/0xd0 [ 1.158207] [] pstore_mount+0x18/0x20 [ 1.158207] [] mount_fs+0x39/0x1b0 [ 1.158207] [] ? __alloc_percpu+0x10/0x20 [ 1.158207] [] vfs_kern_mount+0x63/0xf0 [ 1.158207] [] do_mount+0x23e/0xa20 [ 1.158207] [] ? strndup_user+0x4b/0xf0 [ 1.158207] [] SyS_mount+0x83/0xc0 [ 1.158207] [] system_call_fastpath+0x16/0x1b [ 1.158207] ---[ end trace 61981bc62de9f6f4 ]--- Signed-off-by: Seiji Aguchi Tested-by: Madper Xie Signed-off-by: Matt Fleming Signed-off-by: Greg Kroah-Hartman commit a472bacfa164f336da006fcd879d785f2b30b7bc Author: Marc Kleine-Budde Date: Sun Nov 24 23:31:24 2013 +0100 can: c_can: don't call pm_runtime_get_sync() from interrupt context commit e35d46adc49b469fd92bdb64fea8af93640e6651 upstream. The c_can driver contians a callpath (c_can_poll -> c_can_state_change -> c_can_get_berr_counter) which may call pm_runtime_get_sync() from the IRQ handler, which is not allowed and results in "BUG: scheduling while atomic". This problem is fixed by introducing __c_can_get_berr_counter, which will not call pm_runtime_get_sync(). Reported-by: Andrew Glen Tested-by: Andrew Glen Signed-off-by: Andrew Glen Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman commit 617bf5aceea95873945f5d57fe114e1599cb6dc0 Author: Marc Kleine-Budde Date: Mon Nov 25 22:15:20 2013 +0100 can: flexcan: use correct clock as base for bit rate calculation commit 1a3e5173f5e72cbf7f0c8927b33082e361c16d72 upstream. The flexcan IP core uses the peripheral clock ("per") as basic clock for the bit timing calculation. However the driver uses the the wrong clock ("ipg"). This leads to wrong bit rates if the rates on both clock are different. This patch fixes the problem by using the correct clock for the bit rate calculation. Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman commit aea389e583d48fef7341834eba195bcb888061e5 Author: Oliver Hartkopp Date: Thu Nov 21 18:03:07 2013 +0100 can: sja1000: fix {pre,post}_irq() handling and IRQ handler return value commit 2fea6cd303c0d0cd9067da31d873b6a6d5bd75e7 upstream. This patch fixes the issue that the sja1000_interrupt() function may have returned IRQ_NONE without processing the optional pre_irq() and post_irq() function before. Further the irq processing counter 'n' is moved to the end of the while statement to return correct IRQ_[NONE|HANDLED] values at error conditions. Reported-by: Wolfgang Grandegger Acked-by: Wolfgang Grandegger Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman commit e431875ee9329bccd4ba204141cc90acf3adec19 Author: Linus Torvalds Date: Mon Dec 2 09:44:51 2013 -0800 vfs: fix subtle use-after-free of pipe_inode_info commit b0d8d2292160bb63de1972361ebed100c64b5b37 upstream. The pipe code was trying (and failing) to be very careful about freeing the pipe info only after the last access, with a pattern like: spin_lock(&inode->i_lock); if (!--pipe->files) { inode->i_pipe = NULL; kill = 1; } spin_unlock(&inode->i_lock); __pipe_unlock(pipe); if (kill) free_pipe_info(pipe); where the final freeing is done last. HOWEVER. The above is actually broken, because while the freeing is done at the end, if we have two racing processes releasing the pipe inode info, the one that *doesn't* free it will decrement the ->files count, and unlock the inode i_lock, but then still use the "pipe_inode_info" afterwards when it does the "__pipe_unlock(pipe)". This is *very* hard to trigger in practice, since the race window is very small, and adding debug options seems to just hide it by slowing things down. Simon originally reported this way back in July as an Oops in kmem_cache_allocate due to a single bit corruption (due to the final "spin_unlock(pipe->mutex.wait_lock)" incrementing a field in a different allocation that had re-used the free'd pipe-info), it's taken this long to figure out. Since the 'pipe->files' accesses aren't even protected by the pipe lock (we very much use the inode lock for that), the simple solution is to just drop the pipe lock early. And since there were two users of this pattern, create a helper function for it. Introduced commit ba5bb147330a ("pipe: take allocation and freeing of pipe_inode_info out of ->i_mutex"). Reported-by: Simon Kirby Reported-by: Ian Applegate Acked-by: Al Viro Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit d078852abfed1a7b195c1b0b1b8d0cc13865ac61 Author: Bo Shen Date: Tue Dec 3 18:04:54 2013 +0800 ASoC: wm8731: fix dsp mode configuration commit b4af6ef99a60c5b56df137d7accd81ba1ee1254e upstream. According to WM8731 "PD, Rev 4.9 October 2012" datasheet, when it works in DSP mode A, LRP = 1, while works in DSP mode B, LRP = 0. So, fix LRP for DSP mode as the datesheet specification. Signed-off-by: Bo Shen Acked-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit b185029b7b9def7faf2f90eb1aca6ffe01b582ed Author: Stephen Warren Date: Fri Nov 22 10:29:18 2013 -0700 ASoC: dapm: Use SND_SOC_DAPM_INIT_REG_VAL in SND_SOC_DAPM_MUX commit faf6615bf05bc5cecc6e22013b9cb21c77784fd1 upstream. SND_SOC_DAPM_MUX() doesn't currently initialize the .mask field. This results in the mux never affecting HW, since no bits are ever set or cleared. Fix SND_SOC_DAPM_MUX() to use SND_SOC_DAPM_INIT_REG_VAL() to set up the reg, shift, on_val, and off_val fields like almost all other SND_SOC_xxx() macros. It looks like this was a "typo" in the fixed commit linked below. This makes the speakers on the Toshiba AC100 (PAZ00) laptop work again. Fixes: de9ba98b6d26 ("ASoC: dapm: Make widget power register settings more flexible") Signed-off-by: Stephen Warren Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit a144036631b208be5b524a6734a60d16857e4141 Author: Mark Brown Date: Fri Nov 22 14:17:18 2013 +0000 ASoC: wm8990: Mark the register map as dirty when powering down commit 2ab2b74277a86afe0dd92976db695a2bb8b93366 upstream. Otherwise we'll skip sync on resume. Signed-off-by: Mark Brown Acked-by: Charles Keepax Signed-off-by: Greg Kroah-Hartman commit 0c5333720ebbd218a1a5357819235180df5e1c85 Author: Thomas Petazzoni Date: Mon Nov 25 17:26:47 2013 +0100 ARM: mvebu: re-enable PCIe on Armada 370 DB commit 96039f735e290281d0c8a08fc467de2cd610543d upstream. Commit 14fd8ed0a7fd19913 ("ARM: mvebu: Relocate Armada 370/XP PCIe device tree nodes") relocated the PCIe controller DT nodes one level up in the Device Tree, to reflect a more correct representation of the hardware introduced by the mvebu-mbus Device Tree binding. However, while most of the boards were properly adjusted accordingly, the Armada 370 DB board was left unchanged, and therefore, PCIe is seen as not enabled on this board. This patch fixes that by moving the PCIe controller node one level-up in armada-370-db.dts. Signed-off-by: Thomas Petazzoni Fixes: 14fd8ed0a7fd19913 "ARM: mvebu: Relocate Armada 370/XP PCIe device tree nodes" Signed-off-by: Jason Cooper Signed-off-by: Greg Kroah-Hartman commit 8bfd0f420b66474403231c3bd986795a8847df86 Author: Gregory CLEMENT Date: Mon Nov 25 17:26:46 2013 +0100 ARM: mvebu: use the virtual CPU registers to access coherency registers commit b6dda00cddcc71d2030668bc0cc0fed758c411c2 upstream. The Armada XP provides a mechanism called "virtual CPU registers" or "per-CPU register banking", to access the per-CPU registers of the current CPU, without having to worry about finding on which CPU we're running. CPU0 has its registers at 0x21800, CPU1 at 0x21900, CPU2 at 0x21A00 and CPU3 at 0x21B00. The virtual registers accessing the current CPU registers are at 0x21000. However, in the Device Tree node that provides the register addresses for the coherency unit (which is responsible for ensuring coherency between processors, and I/O coherency between processors and the DMA-capable devices), a mistake was made: the CPU0-specific registers were specified instead of the virtual CPU registers. This means that the coherency barrier needed for I/O coherency was not behaving properly when executed from a CPU different from CPU0. This patch fixes that by using the virtual CPU registers. Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Petazzoni Fixes: e60304f8cb7bb5 "arm: mvebu: Add hardware I/O Coherency support" Signed-off-by: Jason Cooper Signed-off-by: Greg Kroah-Hartman commit 145c633fa43fb0308dd2dcb579b2afa4878657a9 Author: Arnaud Ebalard Date: Tue Nov 5 21:46:02 2013 +0100 ARM: mvebu: fix second and third PCIe unit of Armada XP mv78260 commit 2163e61c92d9337e721a0d067d88ae62b52e0d3e upstream. mv78260 flavour of Marvell Armada XP SoC has 3 PCIe units. The two first units are both x4 and quad x1 capable. The third unit is only x4 capable. This patch fixes mv78260 .dtsi to reflect those capabilities. Signed-off-by: Arnaud Ebalard Acked-by: Thomas Petazzoni Signed-off-by: Jason Cooper Signed-off-by: Greg Kroah-Hartman commit 7a58767b2dda3ceab6abd2f69c41a32adb4acb41 Author: Arnaud Ebalard Date: Tue Nov 5 21:45:48 2013 +0100 ARM: mvebu: second PCIe unit of Armada XP mv78230 is only x1 capable commit 12b69a599745fc9e203f61fbb7160b2cc5f479dd upstream. Various Marvell datasheets advertise second PCIe unit of mv78230 flavour of Armada XP as x4/quad x1 capable. This second unit is in fact only x1 capable. This patch fixes current mv78230 .dtsi to reflect that, i.e. makes 1.0 the second interface (instead of 2.0 at the moment). This was successfully tested on a mv78230-based ReadyNAS 2120 platform with a x1 device (FL1009 XHCI controller) connected to this second interface. Signed-off-by: Arnaud Ebalard Acked-by: Thomas Petazzoni Signed-off-by: Jason Cooper Signed-off-by: Greg Kroah-Hartman commit 11ddbdec35d8209312cbe79c1c35f4ff209c5f10 Author: Ludovic Desroches Date: Fri Nov 22 17:08:43 2013 +0100 ARM: at91: sama5d3: reduce TWI internal clock frequency commit 58e7b1d5826ac6a64b1101d8a70162bc084a7d1e upstream. With some devices, transfer hangs during I2C frame transmission. This issue disappears when reducing the internal frequency of the TWI IP. Even if it is indicated that internal clock max frequency is 66MHz, it seems we have oversampling on I2C signals making TWI believe that a transfer in progress is done. This fix has no impact on the I2C bus frequency. Signed-off-by: Ludovic Desroches Acked-by: Wolfram Sang Acked-by: Jean-Christophe PLAGNIOL-VILLARD Signed-off-by: Nicolas Ferre Signed-off-by: Greg Kroah-Hartman commit a5d5b2552277039fd09018d8938176853eebfa29 Author: Aaro Koskinen Date: Mon Nov 11 20:41:38 2013 +0200 ARM: OMAPFB: panel-sony-acx565akm: fix bad unlock balance commit c37dd677988ca50bc8bc60ab5ab053720583c168 upstream. When booting Nokia N900 smartphone with v3.12 + omap2plus_defconfig (LOCKDEP enabled) and CONFIG_DISPLAY_PANEL_SONY_ACX565AKM enabled, the following BUG is seen during the boot: [ 7.302154] ===================================== [ 7.307128] [ BUG: bad unlock balance detected! ] [ 7.312103] 3.12.0-los.git-2093492-00120-g5e01dc7 #3 Not tainted [ 7.318450] ------------------------------------- [ 7.323425] kworker/u2:1/12 is trying to release lock (&ddata->mutex) at: [ 7.330657] [] acx565akm_enable+0x12c/0x18c [ 7.335998] but there are no more locks to release! Fix by removing double unlock and handling the locking completely inside acx565akm_panel_power_on() when doing the power on. Reported-by: Eduardo Valentin Signed-off-by: Aaro Koskinen Signed-off-by: Tomi Valkeinen Signed-off-by: Greg Kroah-Hartman commit 234907dba6f6e98c85b0030f435ba5d94525d52b Author: Balaji T K Date: Mon Dec 2 11:38:13 2013 -0800 ARM: dts: omap4-panda-common: Fix pin muxing for wl12xx commit 2ba2866f782f7f1c38abc3dd56d3295efd289264 upstream. pin mux wl12xx_gpio and wl12xx_pins should be part of omap4_pmx_core and not omap4_pmx_wkup. So, move wl12xx_* to omap4_pmx_core. Fix the following error message: pinctrl-single 4a31e040.pinmux: mux offset out of range: 0x38 (0x38) pinctrl-single 4a31e040.pinmux: could not add functions for pinmux_wl12xx_pins 56x SDIO card is not detected after moving pin mux to omap4_pmx_core since sdmmc5_clk pull is disabled. Enable Pull up on sdmmc5_clk to detect SDIO card. This fixes a regression where WLAN did not work after a warm reset or after one up/down cycle that happened when we move omap4 to boot using device tree only. For reference, the kernel bug is described at: https://bugzilla.kernel.org/show_bug.cgi?id=63821 Signed-off-by: Balaji T K [tony@atomide.com: update comments to describe the regression] Signed-off-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 5252555a295cdeb56353bece410994e8a5c0a335 Author: Olof Johansson Date: Tue Dec 3 10:21:49 2013 -0800 ARM: multi_v7_defconfig: enable SDHCI_BCM_KONA and MMC_BLOCK_MINORS=16 commit f39918eec72c841037f16475867dac1a2b0bfc01 upstream. Enable MMC/SD on the Broadcom mobile platforms, and increase the block minors from the default 8 to 16 (since the Broadcom board by default has root on the 8th partition). Signed-off-by: Olof Johansson Signed-off-by: Greg Kroah-Hartman commit 49470d7df55a6c21be98a1594847d8dd7eaf0086 Author: Russell King Date: Fri Nov 29 00:54:38 2013 +0000 ARM: footbridge: fix EBSA285 LEDs commit 67130c5464f50428aea0b4526a6729d61f9a1d53 upstream. - The LEDs register is write-only: it can't be read-modify-written. - The LEDs are write-1-for-off not 0. - The check for the platform was inverted. Fixes: cf6856d693dd ("ARM: mach-footbridge: retire custom LED code") Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 059846e0cc853adab39b281fdf049ab1abc96329 Author: Russell King Date: Thu Nov 28 21:55:41 2013 +0000 ARM: footbridge: fix VGA initialisation commit 43659222e7a0113912ed02f6b2231550b3e471ac upstream. It's no good setting vga_base after the VGA console has been initialised, because if we do that we get this: Unable to handle kernel paging request at virtual address 000b8000 pgd = c0004000 [000b8000] *pgd=07ffc831, *pte=00000000, *ppte=00000000 0Internal error: Oops: 5017 [#1] ARM Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 3.12.0+ #49 task: c03e2974 ti: c03d8000 task.ti: c03d8000 PC is at vgacon_startup+0x258/0x39c LR is at request_resource+0x10/0x1c pc : [] lr : [] psr: 60000053 sp : c03d9f68 ip : 000b8000 fp : c03d9f8c r10: 000055aa r9 : 4401a103 r8 : ffffaa55 r7 : c03e357c r6 : c051b460 r5 : 000000ff r4 : 000c0000 r3 : 000b8000 r2 : c03e0514 r1 : 00000000 r0 : c0304971 Flags: nZCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment kernel which is an access to the 0xb8000 without the PCI offset required to make it work. Fixes: cc22b4c18540 ("ARM: set vga memory base at run-time") Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit ddbf7e1c1143337cad2fbe68fbea7ba76e6720a4 Author: Russell King Date: Thu Nov 28 21:43:40 2013 +0000 ARM: fix booting low-vectors machines commit d8aa712c30148ba26fd89a5dc14de95d4c375184 upstream. Commit f6f91b0d9fd9 (ARM: allow kuser helpers to be removed from the vector page) required two pages for the vectors code. Although the code setting up the initial page tables was updated, the code which allocates page tables for new processes wasn't, neither was the code which tears down the mappings. Fix this. Fixes: f6f91b0d9fd9 ("ARM: allow kuser helpers to be removed from the vector page") Signed-off-by: Russell King Signed-off-by: Greg Kroah-Hartman commit 9f9cfbce8ee739a3f08c1a345417a3e049a423ae Author: Tom Lendacky Date: Tue Nov 12 11:46:04 2013 -0600 crypto: authenc - Find proper IV address in ablkcipher callback commit fc019c7122dfcd69c50142b57a735539aec5da95 upstream. When performing an asynchronous ablkcipher operation the authenc completion callback routine is invoked, but it does not locate and use the proper IV. The callback routine, crypto_authenc_encrypt_done, is updated to use the same method of calculating the address of the IV as is done in crypto_authenc_encrypt function which sets up the callback. Signed-off-by: Tom Lendacky Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 9a63ac8814ecf671e973702a146e3b6423b62077 Author: Horia Geanta Date: Thu Nov 28 15:11:15 2013 +0200 crypto: ccm - Fix handling of zero plaintext when computing mac commit 5638cabf3e4883f38dfb246c30980cebf694fbda upstream. There are cases when cryptlen can be zero in crypto_ccm_auth(): -encryptiom: input scatterlist length is zero (no plaintext) -decryption: input scatterlist contains only the mac plus the condition of having different source and destination buffers (or else scatterlist length = max(plaintext_len, ciphertext_len)). These are not handled correctly, leading to crashes like: root@p4080ds:~/crypto# insmod tcrypt.ko mode=45 ------------[ cut here ]------------ kernel BUG at crypto/scatterwalk.c:37! Oops: Exception in kernel mode, sig: 5 [#1] SMP NR_CPUS=8 P4080 DS Modules linked in: tcrypt(+) crc32c xts xcbc vmac pcbc ecb gcm ghash_generic gf128mul ccm ctr seqiv CPU: 3 PID: 1082 Comm: cryptomgr_test Not tainted 3.11.0 #14 task: ee12c5b0 ti: eecd0000 task.ti: eecd0000 NIP: c0204d98 LR: f9225848 CTR: c0204d80 REGS: eecd1b70 TRAP: 0700 Not tainted (3.11.0) MSR: 00029002 CR: 22044022 XER: 20000000 GPR00: f9225c94 eecd1c20 ee12c5b0 eecd1c28 ee879400 ee879400 00000000 ee607464 GPR08: 00000001 00000001 00000000 006b0000 c0204d80 00000000 00000002 c0698e20 GPR16: ee987000 ee895000 fffffff4 ee879500 00000100 eecd1d58 00000001 00000000 GPR24: ee879400 00000020 00000000 00000000 ee5b2800 ee607430 00000004 ee607460 NIP [c0204d98] scatterwalk_start+0x18/0x30 LR [f9225848] get_data_to_compute+0x28/0x2f0 [ccm] Call Trace: [eecd1c20] [f9225974] get_data_to_compute+0x154/0x2f0 [ccm] (unreliable) [eecd1c70] [f9225c94] crypto_ccm_auth+0x184/0x1d0 [ccm] [eecd1cb0] [f9225d40] crypto_ccm_encrypt+0x60/0x2d0 [ccm] [eecd1cf0] [c020d77c] __test_aead+0x3ec/0xe20 [eecd1e20] [c020f35c] test_aead+0x6c/0xe0 [eecd1e40] [c020f420] alg_test_aead+0x50/0xd0 [eecd1e60] [c020e5e4] alg_test+0x114/0x2e0 [eecd1ee0] [c020bd1c] cryptomgr_test+0x4c/0x60 [eecd1ef0] [c0047058] kthread+0xa8/0xb0 [eecd1f40] [c000eb0c] ret_from_kernel_thread+0x5c/0x64 Instruction dump: 0f080000 81290024 552807fe 0f080000 5529003a 4bffffb4 90830000 39400000 39000001 8124000c 2f890000 7d28579e <0f090000> 81240008 91230004 4e800020 ---[ end trace 6d652dfcd1be37bd ]--- Cc: Jussi Kivilinna Signed-off-by: Horia Geanta Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 2facb7852a50dbb2073d9ddf688e328e06805c74 Author: Tom Lendacky Date: Tue Nov 12 11:46:10 2013 -0600 crypto: scatterwalk - Set the chain pointer indication bit commit 41da8b5adba77e22584f8b45f9641504fa885308 upstream. The scatterwalk_crypto_chain function invokes the scatterwalk_sg_chain function to chain two scatterlists, but the chain pointer indication bit is not set. When the resulting scatterlist is used, for example, by sg_nents to count the number of scatterlist entries, a segfault occurs because sg_nents does not follow the chain pointer to the chained scatterlist. Update scatterwalk_sg_chain to set the chain pointer indication bit as is done by the sg_chain function. Signed-off-by: Tom Lendacky Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 272051255586c48a191c6748d0b5cfff2e4a4ff5 Author: Gerald Schaefer Date: Tue Nov 19 17:12:47 2013 +0100 crypto: s390 - Fix aes-xts parameter corruption commit 9dda2769af4f3f3093434648c409bb351120d9e8 upstream. Some s390 crypto algorithms incorrectly use the crypto_tfm structure to store private data. As the tfm can be shared among multiple threads, this can result in data corruption. This patch fixes aes-xts by moving the xts and pcc parameter blocks from the tfm onto the stack (48 + 96 bytes). Signed-off-by: Gerald Schaefer Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 5d57b0d77d2341c23f278eca536fef54649386e2 Author: David Henningsson Date: Fri Nov 29 15:10:20 2013 +0800 ALSA: hda - Add mono speaker quirk for Dell Inspiron 5439 commit eb82594b75b0cf54c667189e061934b7c49b5d42 upstream. This machine also has mono output if run through DAC node 0x03. BugLink: https://bugs.launchpad.net/bugs/1256212 Tested-by: David Chen Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit eceed9dbbb0d7ecbcd341882a7f998afd204729d Author: Takashi Iwai Date: Wed Dec 4 13:59:45 2013 +0100 ALSA: hda - Fix silent output on MacBook Air 2,1 commit 0756f09c4946fe2d9ce2ebcb6f2e3c58830d22a3 upstream. MacBook Air 2,1 has a fairly different pin assignment from its brother MBA 1,1, and yet another quirks are needed for pin 0x18 and 0x19, similarly like what iMac 9,1 requires, in order to make the sound working on it. Reported-and-tested-by: Bruno Prémont Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 4d44f47221dc6ad652c741c1a1fbedb72e2981da Author: Takashi Iwai Date: Mon Dec 2 13:19:45 2013 +0100 ALSA: hda - Fix bad EAPD setup for HP machines with AD1984A commit 1cd9b2f78bf29d5282e02b32f9b3ecebc5842a7c upstream. It seems that EAPD on NID 0x16 is the only control over all outputs on HP machines with AD1984A while turning EAPD on NID 0x12 breaks the output. Thus we need to avoid fiddling EAPD on NID. As a quick workaround, just set own_eapd_ctrl flag for the wrong EAPD, then implement finer EAPD controls. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66321 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit f4dbed48ef575305bb0d3249f66e5d6d4cc7fb17 Author: David Henningsson Date: Mon Dec 2 18:06:20 2013 +0800 ALSA: hda - Fix headset mic input after muted internal mic (Dell/Realtek) commit d59915d0655c5864b514f21daaeac98c047875dc upstream. By trial and error, I found this patch could work around an issue where the headset mic would stop working if you switch between the internal mic and the headset mic, and the internal mic was muted. It still takes a second or two before the headset mic actually starts working, but still better than nothing. Information update from Kailang: The verb was ADC digital mute(bit 6 default 1). Switch internal mic and headset mic will run alc_headset_mode_default. The coef index 0x11 will set to 0x0041. Because headset mode was fixed type. It doesn't need to run alc_determine_headset_type. So, the value still keep 0x0041. ADC was muted. BugLink: https://bugs.launchpad.net/bugs/1256840 Signed-off-by: David Henningsson Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 531a84b31b42e9676790b23957219426228c68ea Author: Takashi Iwai Date: Mon Dec 2 15:04:03 2013 +0100 ALSA: hda - Use always amps for auto-mute on AD1986A codec commit b3bd4fc3822a6b5883eaa556822487d87752d443 upstream. It seems that AD1986A cannot manage the dynamic pin on/off for auto-muting, but rather gets confused. Since each output has own amp, let's use it instead. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=64971 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit e0ee328dd389d72f0ac16d2cea5da2fa7323237a Author: Takashi Iwai Date: Mon Dec 2 15:27:19 2013 +0100 ALSA: hda - Another fixup for ASUS laptop with ALC660 codec commit e7ca237bfcf6a288702cb95e94ab94f642ccad88 upstream. ASUS Z35HL laptop also needs the very same fix as the previous one that was applied to ASUS W7J. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66231 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 86e9c99008677044678539ab1c7ef8b6dff7dc3d Author: Takashi Iwai Date: Fri Nov 29 12:47:34 2013 +0100 ALSA: hda - Fix silent output on ASUS W7J laptop commit 6ddf0fd1c462a418a3cbb8b0653820dc48ffbd98 upstream. The recent kernels got regressions on ASUS W7J with ALC660 codec where no sound comes out. After a long debugging session, we found out that setting the pin control on the unused NID 0x10 is mandatory for the outputs. And, it was found out that another magic of NID 0x0f that is required for other ASUS laptops isn't needed on this machine. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66081 Reported-and-tested-by: Andrey Lipaev Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman