ALSA: hda - HDMI: Fix MCP7x audio infoframe checksums

BugLink: http://bugs.launchpad.net/bugs/761134

commit 1f348522844bb1f6e7b10d50b9e8aa89a2511b09 upstream.

The MCP7x hardware computes the audio infoframe channel count
automatically, but requires the audio driver to set the audio
infoframe checksum manually via the Nv_VERB_SET_Info_Frame_Checksum
control verb.

When audio starts playing, nvhdmi_8ch_7x_pcm_prepare sets the checksum
to (0x71 - chan - chanmask).  For example, for 2ch audio, chan == 1
and chanmask == 0 so the checksum is set to 0x70.  When audio playback
finishes and the device is closed, nvhdmi_8ch_7x_pcm_close resets the
channel formats, causing the channel count to revert to 8ch.  Since
the checksum is not reset, the hardware starts generating audio
infoframes with invalid checksums.  This causes some displays to blank
the video.

Fix this by updating the checksum and channel mask when the device is
closed and also when it is first initialized.  In addition, make sure
that the channel mask is appropriate for an 8ch infoframe by setting
it to 0x13 (FL FR LFE FC RL RR RLC RRC).

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Acked-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: ens1371: fix Creative Ectiva support

BugLink: http://bugs.launchpad.net/bugs/761134

commit 6ebb8a4a43e34f999ab36f27f972f3cd751cda4f upstream.

To make the EV1938 chip work, add a magic bit and an extra delay.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Tested-by: Tino Schmidt <mailtinoshomepage@gmx.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ASoC: Fix CODEC device name for Corgi

BugLink: http://bugs.launchpad.net/bugs/761134

commit 326b9bdc2a0e4d556a0f444085dca103bcd505de upstream.

Got typoed in the multi-component changes.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ASoC: imx: fix burstsize for DMA

BugLink: http://bugs.launchpad.net/bugs/761134

commit e1bb31b444668bc957c337d33803db7cb3330745 upstream.

SSI counts in words, the DMA engine in bytes. (Wrong) factor got removed
in bf974a0 (ASoC i.MX: switch to new DMA api).

Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ASoC: imx: set watermarks for mx2-dma

BugLink: http://bugs.launchpad.net/bugs/761134

commit 2c4cf17a52f04fbe929977252d5b8ab81d2c6e9b upstream.

They got accidently removed by f0fba2a (ASoC: multi-component - ASoC
Multi-Component Support). Reintroduce them and get rid of the
superfluous defines because the fiq-driver has its own hardcoded values.

Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ASoC: Explicitly say registerless widgets have no register

BugLink: http://bugs.launchpad.net/bugs/761134

commit 0ca03cd7d0fa3bfbd56958136a10f19733c4ce12 upstream.

This stops code that handles widgets generically from attempting to access
registers for these widgets.

Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Liam Girdwood <lrg@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

nilfs2: fix data loss in mmap page write for hole blocks

BugLink: http://bugs.launchpad.net/bugs/761134

commit 34094537943113467faee98fe67c8a3d3f9a0a8b upstream.

From the result of a function test of mmap, mmap write to shared pages
turned out to be broken for hole blocks.  It doesn't write out filled
blocks and the data will be lost after umount.  This is due to a bug
that the target file is not queued for log writer when filling hole
blocks.

Also, nilfs_page_mkwrite function exits normal code path even after
successfully filled hole blocks due to a change of block_page_mkwrite
function; just after nilfs was merged into the mainline,
block_page_mkwrite() started to return VM_FAULT_LOCKED instead of zero
by the patch "mm: close page_mkwrite races" (commit:
b827e496c893de0c).  The current nilfs_page_mkwrite() is not handling
this value properly.

This corrects nilfs_page_mkwrite() and will resolve the data loss
problem in mmap write.

[This should be applied to every kernel since 2.6.30 but a fix is
 needed for 2.6.37 and prior kernels]

Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

powerpc: Fix accounting of softirq time when idle

BugLink: http://bugs.launchpad.net/bugs/761134

commit ad5d1c888e556bc00c4e86f452cad4a3a87d22c1 upstream.

commit cf9efce0ce31 (powerpc: Account time using timebase rather
than PURR) used in_irq() to detect if the time was spent in
interrupt processing. This only catches hardirq context so if we
are in softirq context and in the idle loop we end up accounting it
as idle time. If we instead use in_interrupt() we catch both softirq
and hardirq time.

The issue was found when running a network intensive workload. top
showed the following:

0.0%us,  1.1%sy,  0.0%ni, 85.7%id,  0.0%wa,  9.9%hi,  3.3%si,  0.0%st

85.7% idle. But this was wildly different to the perf events data.
To confirm the suspicion I ran something to keep the core busy:

# yes > /dev/null &

8.2%us,  0.0%sy,  0.0%ni,  0.0%id,  0.0%wa, 10.3%hi, 81.4%si,  0.0%st

We only got 8.2% of the CPU for the userspace task and softirq has
shot up to 81.4%.

With the patch below top shows the correct stats:

0.0%us,  0.0%sy,  0.0%ni,  5.3%id,  0.0%wa, 13.3%hi, 81.3%si,  0.0%st

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

irda: prevent heap corruption on invalid nickname

BugLink: http://bugs.launchpad.net/bugs/761134

commit d50e7e3604778bfc2dc40f440e0742dbae399d54 upstream.

Invalid nicknames containing only spaces will result in an underflow in
a memcpy size calculation, subsequently destroying the heap and
panicking.

v2 also catches the case where the provided nickname is longer than the
buffer size, which can result in controllable heap corruption.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

irda: validate peer name and attribute lengths

BugLink: http://bugs.launchpad.net/bugs/761134

commit d370af0ef7951188daeb15bae75db7ba57c67846 upstream.

Length fields provided by a peer for names and attributes may be longer
than the destination array sizes.  Validate lengths to prevent stack
buffer overflows.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

watchdog: Convert release_resource to release_region/release_mem_region

BugLink: http://bugs.launchpad.net/bugs/761134

commit f712eacf02ecfbf4f1686addb8c569841549b0b7 upstream.

Request_mem_region should be used with release_mem_region, not
release_resource.

In pnx4008_wdt.c, a missing clk_put is added as well.

The semantic match that finds the first problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,E;
@@
*x = request_mem_region(...)
... when != release_mem_region(x)
    when != x = E
* release_resource(x);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

watchdog: s3c2410_wdt.c: Convert release_resource to release_region/release_mem_region

BugLink: http://bugs.launchpad.net/bugs/761134

commit f72401e94d159bc4b2beab51d74e956da2c32e0a upstream.

Request_mem_region should be used with release_mem_region, not
release_resource.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression x,E;
@@
*x = request_mem_region(...)
... when != release_mem_region(x)
    when != x = E
* release_resource(x);
// </smpl>

Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

amd64_edac: Fix potential memleak

BugLink: http://bugs.launchpad.net/bugs/761134

commit a9f0fbe2bbf328f869fc5ee5a12c6a4118c32689 upstream.

We check the pointers together but at least one of them could be invalid
due to failed allocation. Since we cannot continue if either of the two
allocations has failed, exit early by freeing them both.

Reported-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

xfs: register the inode cache shrinker before quotachecks

BugLink: http://bugs.launchpad.net/bugs/761134

commit 704b2907c2d47ceb187c0e25a6bbc2174b198f2f upstream.

During mount, we can do a quotacheck that involves a bulkstat pass
on all inodes. If there are more inodes in the filesystem than can
be held in memory, we require the inode cache shrinker to run to
ensure that we don't run out of memory.

Unfortunately, the inode cache shrinker is not registered until we
get to the end of the superblock setup process, which is after a
quotacheck is run if it is needed. Hence we need to register the
inode cache shrinker earlier in the mount process so that we don't
OOM during mount. This requires that we also initialise the syncd
work before we register the shrinker, so we nee dto juggle that
around as well.

While there, make sure that we have set up the block sizes in the
VFS superblock correctly before the quotacheck is run so that any
inodes that are cached as a result of the quotacheck have their
block size fields set up correctly.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Alex Elder <aelder@sgi.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: hv: Fix GARP not sent after Quick Migration

BugLink: http://bugs.launchpad.net/bugs/761134

commit c996edcf1c451b81740abbcca5257ed7e353fcc6 upstream.

After Quick Migration, the network is not immediately operational in the
current context when receiving RNDIS_STATUS_MEDIA_CONNECT event. So, I added
another netif_notify_peers() into a scheduled work, otherwise GARP packet will
not be sent after quick migration, and cause network disconnection.

Thanks to Mike Surcouf <mike@surcouf.co.uk> for reporting the bug and
testing the patch.

Reported-by: Mike Surcouf <mike@surcouf.co.uk>
Tested-by: Mike Surcouf <mike@surcouf.co.uk>
Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Hank Janssen <hjanssen@microsoft.com>
Signed-off-by: Abhishek Kane <v-abkane@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: hv: use sync_bitops when interacting with the hypervisor

BugLink: http://bugs.launchpad.net/bugs/761134

commit 22356585712d1ff08fbfed152edd8b386873b238 upstream.

Locking is required when tweaking bits located in a shared page, use the
sync_ version of bitops. Without this change vmbus_on_event() will miss
events and as a result, vmbus_isr() will not schedule the receive tasklet.

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Acked-by: Haiyang Zhang <haiyangz@microsoft.com>
Acked-by: Hank Janssen <hjanssen@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: usbip: bugfix for isochronous packets and optimization

BugLink: http://bugs.launchpad.net/bugs/761134

commit 28276a28d8b3cd19f4449991faad4945fe557656 upstream.

For isochronous packets the actual_length is the sum of the actual
length of each of the packets, however between the packets might be
padding, so it is not sufficient to just send the first actual_length
bytes of the buffer. To fix this and simultanesouly optimize the
bandwidth the content of the isochronous packets are send without the
padding, the padding is restored on the receiving end.

Signed-off-by: Arjan Mels <arjan.mels@gmx.net>
Cc: Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>
Cc: Max Vozeler <max@vozeler.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: usbip: bugfix add number of packets for isochronous frames

BugLink: http://bugs.launchpad.net/bugs/761134

commit 1325f85fa49f57df034869de430f7c302ae23109 upstream.

The number_of_packets was not transmitted for RET_SUBMIT packets. The
linux client used the stored number_of_packet from the submitted
request. The windows userland client does not do this however and needs
to know the number_of_packets to determine the size of the transmission.

Signed-off-by: Arjan Mels <arjan.mels@gmx.net>
Cc: Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>
Cc: Max Vozeler <max@vozeler.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: usbip: bugfixes related to kthread conversion

BugLink: http://bugs.launchpad.net/bugs/761134

commit d2dd0b07c3e725d386d20294ec906f7ddef207fa upstream.

When doing a usb port reset do a queued reset instead to prevent a
deadlock: the reset will cause the driver to unbind, causing the
usb_driver_lock_for_reset to stall.

Signed-off-by: Arjan Mels <arjan.mels@gmx.net>
Cc: Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>
Cc: Max Vozeler <max@vozeler.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

crypto: aesni-intel - fixed problem with packets that are not multiple of 64bytes

BugLink: http://bugs.launchpad.net/bugs/761134

commit 60af520cf264ea26b2af3a6871bbd71850522aea upstream.

This patch fixes problem with packets that are not multiple of 64bytes.

Signed-off-by: Adrian Hoban <adrian.hoban@intel.com>
Signed-off-by: Aidan O'Mahony <aidan.o.mahony@intel.com>
Signed-off-by: Gabriele Paoloni <gabriele.paoloni@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix

BugLink: http://bugs.launchpad.net/bugs/761134

commit 1821df040ac3cd6a57518739f345da6d50ea9d3f upstream.

The pointer '(*auth_tok_key)' is set to NULL in case request_key()
fails, in order to prevent its use by functions calling
ecryptfs_keyring_auth_tok_for_sig().

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eCryptfs: Unlock page in write_begin error path

BugLink: http://bugs.launchpad.net/bugs/761134

commit 50f198ae16ac66508d4b8d5a40967a8507ad19ee upstream.

Unlock the page in error path of ecryptfs_write_begin(). This may
happen, for example, if decryption fails while bring the page
up-to-date.

Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

PCI/ACPI: Report ASPM support to BIOS if not disabled from command line

BugLink: http://bugs.launchpad.net/bugs/761134

commit 8b8bae901ce23addbdcdb54fa1696fb2d049feb5 upstream.

We need to distinguish the situation in which ASPM support is
disabled from the command line or through .config from the situation
in which it is disabled, because the hardware or BIOS can't handle
it.  In the former case we should not report ASPM support to the BIOS
through ACPI _OSC, but in the latter case we should do that.

Introduce pcie_aspm_support_enabled() that can be used by
acpi_pci_root_add() to determine whether or not it should report ASPM
support to the BIOS through _OSC.

References: https://bugzilla.kernel.org/show_bug.cgi?id=29722
References: https://bugzilla.kernel.org/show_bug.cgi?id=20232
Reported-and-tested-by: Ortwin Glück <odi@odi.ch>
Reviewed-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Tested-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ses: Avoid kernel panic when lun 0 is not mapped

BugLink: http://bugs.launchpad.net/bugs/761134

commit d1e12de804f9d8ad114786ca7c2ce593cba79891 upstream.

During device discovery, scsi mid layer sends INQUIRY command to LUN
0. If the LUN 0 is not mapped to host, it creates a temporary
scsi_device with LUN id 0 and sends REPORT_LUNS command to it. After
the REPORT_LUNS succeeds, it walks through the LUN table and adds each
LUN found to sysfs. At the end of REPORT_LUNS lun table scan, it will
delete the temporary scsi_device of LUN 0.

When scsi devices are added to sysfs, it calls add_dev function of all
the registered class interfaces. If ses driver has been registered,
ses_intf_add() of ses module will be called. This function calls
scsi_device_enclosure() to check the inquiry data for EncServ
bit. Since inquiry was not allocated for temporary LUN 0 scsi_device,
it will cause NULL pointer exception.

To fix the problem, sdev->inquiry is checked for NULL before reading it.

Signed-off-by: Somasundaram Krishnasamy <Somasundaram.Krishnasamy@lsi.com>
Signed-off-by: Babu Moger <babu.moger@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ses: show devices for enclosures with no page 7

BugLink: http://bugs.launchpad.net/bugs/761134

commit 877a55979c189c590e819a61cbbe2b7947875f17 upstream.

enclosure page 7 gives us the "pretty" names of the enclosure slots.
Without a page 7, we can still use the enclosure code as long as we
make up numeric names for the slots. Unfortunately, the current code
fails to add any devices because the check for page 10 is in the wrong
place if we have no page 7.  Fix it so that devices show up even if
the enclosure has no page 7.

Signed-off-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

mac80211: initialize sta->last_rx in sta_info_alloc

BugLink: http://bugs.launchpad.net/bugs/761134

commit 8bc8aecdc5e26cfda12dbd6867af4aa67836da6a upstream.

This field is used to determine the inactivity time. When in AP mode,
hostapd uses it for kicking out inactive clients after a while. Without this
patch, hostapd immediately deauthenticates a new client if it checks the
inactivity time before the client sends its first data frame.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

sound/oss/opl3: validate voice and channel indexes

BugLink: http://bugs.launchpad.net/bugs/761134

commit 4d00135a680727f6c3be78f8befaac009030e4df upstream.

User-controllable indexes for voice and channel values may cause reading
and writing beyond the bounds of their respective arrays, leading to
potentially exploitable memory corruption.  Validate these indexes.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ath9k: Fix kernel panic in AR2427

BugLink: http://bugs.launchpad.net/bugs/761134

commit 61e1b0b00c793ad5a32fe2181c9f77115fed5dc4 upstream.

Kernel panic occurs just after AR2427 establishes connection with AP.
Unless aggregation is enabled we don't initialize the TID structure.
Thus accesing the elements of the TID structure when aggregation is
disabled, leads to NULL pointer dereferencing.

[  191.320358] Call Trace:
[  191.320364]  [<fd250ea7>] ? ath9k_tx+0xa7/0x200 [ath9k]
[  191.320376]  [<fd1ec7fc>] ? __ieee80211_tx+0x5c/0x1e0 [mac80211]
[  191.320386]  [<fd1edd2b>] ? ieee80211_tx+0x7b/0x90 [mac80211]
[  191.320395]  [<fd1edddd>] ? ieee80211_xmit+0x9d/0x1d0 [mac80211]
[  191.320401]  [<c014218f>] ? wake_up_state+0xf/0x20
[  191.320405]  [<c015dbc8>] ? signal_wake_up+0x28/0x40
[  191.320410]  [<c012a578>] ? default_spin_lock_flags+0x8/0x10
[  191.320420]  [<fd1ee308>] ? ieee80211_subif_start_xmit+0x2e8/0x7c0
[mac80211]
[  191.320425]  [<c058f905>] ? do_page_fault+0x295/0x3a0
[  191.320431]  [<c04c4a3d>] ? dev_hard_start_xmit+0x1ad/0x210
[  191.320436]  [<c04d96b5>] ? sch_direct_xmit+0x105/0x170
[  191.320445]  [<fd1f161a>] ? get_sta_flags+0x2a/0x40 [mac80211]
[  191.320449]  [<c04c780f>] ? dev_queue_xmit+0x37f/0x4b0
[  191.320452]  [<c04d75b0>] ? eth_header+0x0/0xb0
[  191.320456]  [<c04cc479>] ? neigh_resolve_output+0xe9/0x310
[  191.320461]  [<c053d295>] ? ip6_output_finish+0xa5/0x110
[  191.320464]  [<c053e354>] ? ip6_output2+0x134/0x250
[  191.320468]  [<c053f7dd>] ? ip6_output+0x6d/0x100
[  191.320471]  [<c0559665>] ? mld_sendpack+0x395/0x3e0
[  191.320475]  [<c0557f81>] ? add_grhead+0x31/0xa0
[  191.320478]  [<c055a83c>] ? mld_send_cr+0x1bc/0x2b0
[  191.320482]  [<c01535d9>] ? irq_exit+0x39/0x70
[  191.320485]  [<c055a940>] ? mld_ifc_timer_expire+0x10/0x40
[  191.320489]  [<c015b92e>] ? run_timer_softirq+0x13e/0x2c0
[  191.320493]  [<c0103a30>] ? common_interrupt+0x30/0x40
[  191.320498]  [<c055a930>] ? mld_ifc_timer_expire+0x0/0x40
[  191.320502]  [<c0153358>] ? __do_softirq+0x98/0x1b0
[  191.320506]  [<c01534b5>] ? do_softirq+0x45/0x50
[  191.320509]  [<c0153605>] ? irq_exit+0x65/0x70
[  191.320513]  [<c05917dc>] ? smp_apic_timer_interrupt+0x5c/0x8b
[  191.320516]  [<c0103df1>] ? apic_timer_interrupt+0x31/0x40
[  191.320521]  [<c016007b>] ? k_getrusage+0x12b/0x2f0
[  191.320525]  [<c039e384>] ? acpi_idle_enter_simple+0x117/0x148
[  191.320529]  [<c04a20da>] ? cpuidle_idle_call+0x7a/0x100
[  191.320532]  [<c01021d4>] ? cpu_idle+0x94/0xd0
[  191.320536]  [<c057ab88>] ? rest_init+0x58/0x60
[  191.320541]  [<c07a58ec>] ? start_kernel+0x351/0x357
[  191.320544]  [<c07a53c7>] ? unknown_bootoption+0x0/0x19e
[  191.320548]  [<c07a50aa>] ? i386_start_kernel+0xaa/0xb1
[  191.320550] Code: 03 66 3d 00 03 0f 84 7c 02 00 00 83 c3 18 0f b6 03
8b 4d e0 89 c3 83 e3 0f 6b c3 48 89 5d d8 8d 04 06 8d 50 0c 89 55 d0 8b
40 20 <8b> 00 3b 01 0f 85 8e 02 00 00 f6 47 20 40 0f 84 29 ff ff ff 8b
[  191.320634] EIP: [<fd2586d4>] ath_tx_start+0x474/0x770 [ath9k] SS:ESP
0068:c0761a90
[  191.320642] CR2: 0000000000000000
[  191.320647] ---[ end trace 9296ef23b9076ece ]---
[  191.320650] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

cciss: fix lost command issue

BugLink: http://bugs.launchpad.net/bugs/761134

commit 1ddd5049545e0aa1a0ed19bca4d9c9c3ce1ac8a2 upstream.

Under certain workloads a command may seem to get lost. IOW, the Smart Array
thinks all commands have been completed but we still have commands in our
completion queue. This may lead to system instability, filesystems going
read-only, or even panics depending on the affected filesystem. We add an
extra read to force the write to complete.

Testing shows this extra read avoids the problem.

Signed-off-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Jens Axboe <jaxboe@fusionio.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

myri10ge: fix rmmod crash

BugLink: http://bugs.launchpad.net/bugs/761134

commit cda6587c21a887254c8ed4b58da8fcc4040ab557 upstream.

Rmmod myri10ge crash at free_netdev() -> netif_napi_del(), because napi
structures are already deallocated. To fix call netif_napi_del() before
kfree() at myri10ge_free_slices().

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

perf: Better fit max unprivileged mlock pages for tools needs

BugLink: http://bugs.launchpad.net/bugs/761134

commit 880f57318450dbead6a03f9e31a1468924d6dd88 upstream.

The maximum kilobytes of locked memory that an unprivileged user
can reserve is of 512 kB = 128 pages by default, scaled to the
number of onlined CPUs, which fits well with the tools that use
128 data pages by default.

However tools actually use 129 pages, because they need one more
for the user control page. Thus the default mlock threshold is
not sufficient for the default tools needs and we always end up
to evaluate the constant mlock rlimit policy, which doesn't have
this scaling with the number of online CPUs.

Hence, on systems that have more than 16 CPUs, we overlap the
rlimit threshold and fail to mmap:

$ perf record ls
Error: failed to mmap with 1 (Operation not permitted)

Just increase the max unprivileged mlock threshold by one page
so that it supports well perf tools even after 16 CPUs.

Reported-by: Han Pingtian <phan@redhat.com>
Reported-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Stephane Eranian <eranian@google.com>
LKML-Reference: <1300904979-5508-1-git-send-email-fweisbec@gmail.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: vmalloc buffers should use normal mmap

BugLink: http://bugs.launchpad.net/bugs/761134

commit 3674f19dabd15f9541079a588149a370d888f4e6 upstream.

It's a big no-no to use pgprot_noncached() when mmap'ing such buffers
into userspace since they are mapped cachable in kernel space.

This can cause all sort of interesting things ranging from to garbled
sound to lockups on various architectures. I've observed that usb-audio
is broken on powerpc 4xx for example because of that.

Also remove the now unused snd_pcm_lib_mmap_noncached(). It's
an arch business to know when to use uncached mappings, there's
already hacks for MIPS inside snd_pcm_default_mmap() and other
archs are supposed to use dma_mmap_coherent().

(See my separate patch that adds dma_mmap_coherent() to powerpc)

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: Fix yet another race in disconnection

BugLink: http://bugs.launchpad.net/bugs/761134

commit a45e3d6b13e97506b616980c0f122c3389bcefa4 upstream.

This patch fixes a race between snd_card_file_remove() and
snd_card_disconnect().  When the card is added to shutdown_files list
in snd_card_disconnect(), but it's freed in snd_card_file_remove() at
the same time, the shutdown_files list gets corrupted.  The list member
must be freed in snd_card_file_remove() as well.

Reported-and-tested-by: Russ Dill <russ.dill@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: hda - Fix SPDIF out regression on ALC889

BugLink: http://bugs.launchpad.net/bugs/761134

commit 20b67dddcc5f29d3d0c900225d85e0ac655bc69d upstream.

The commit 5a8cfb4e8ae317d283f84122ed20faa069c5e0c4
    ALSA: hda - Use ALC_INIT_DEFAULT for really default initialization
changed to use the default initialization method for ALC889, but
this caused a regression on SPDIF output on some machines.
This seems due to the COEF setup included in the default init procedure.
For making SPDIF working again, the COEF-setup has to be avoided for
the id 0889.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=24342
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: kvm: fix push of wrong eip when doing softint

When doing a soft int, we need to bump eip before pushing it to
the stack.  Otherwise we'll do the int a second time.

[apw@canonical.com: merged eip update as per Jan's recommendation.]
BugLink: http://bugs.launchpad.net/bugs/747090
Signed-off-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: Bump ABI

Ignore: yes
Signed-off-by: Brad Figg <brad.figg@canonical.com>

UBUNTU: Start new release

Ignore: yes
Signed-off-by: Brad Figg <brad.figg@canonical.com>

UBUNTU: Ubuntu-2.6.38-8.42

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: SAUCE: Revert "Bluetooth: Add new PID for Atheros 3011"

This reverts commit be93112accb42c5586a459683d71975cc70673ca.

Bug https://bugzilla.kernel.org/show_bug.cgi?id=27402 reported that some
devices are not working after this commit, so as I don't have the hardware
I'll revert it until a solution comes.

Conflicts:

drivers/bluetooth/ath3k.c
drivers/bluetooth/btusb.c

Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
BugLink: http://bugs.launchpad.net/bugs/720949
cherry-picked from git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6.git
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] Make linux-libc-dev coinstallable under multiarch

BugLink: http://bugs.launchpad.net/bugs/750585

Signed-off-by: Steve Langasek <slangasek@ubuntu.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] Disable CONFIG_RTS_PSTOR for armel, powerpc

Results in multiple build failures on arm and powerpc:

error: implicit declaration of function 'vmalloc'
error: #error only <linux/bitops.h> can be included directly
error: implicit declaration of function 'BIT_MASK'
error: implicit declaration of function 'BIT_WORD'
etc...

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

x86, hibernate: Initialize mmu_cr4_features during boot

Restore the initialization of mmu_cr4_features during boot, which was
removed without comment in checkin e5f15b45ddf3afa2bbbb10c7ea34fb32b6de0a0e

x86: Cleanup highmap after brk is concluded

thereby breaking resume from hibernate.  This restores previous
functionality in approximately the same place, and corrects the
reading of %cr4 on pre-CPUID hardware (%cr4 exists if and only if
CPUID is supported.)

However, part of the problem is that the hibernate suspend/resume
sequence should manage the save/restore of %cr4 explicitly.

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: Yinghai Lu <yinghai@kernel.org>
LKML-Reference: <201104020154.57136.rjw@sisk.pl>
(cherry picked from commit 4da9484bdece39ab0b098fa711e095e3e9fc8684)
Tested-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
BugLink: http://bugs.launchpad.net/bugs/752870
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: set lun_mode in a different place

BugLink: http://bugs.launchpad.net/bugs/698006

In sony notebook, card reader will be configured as two-lun mode
through EFUSE. In this situation, MS card can't be recognized
properly because driver does only support single-lun mode in default.
In this patch, lun_mode is set in a different place, so driver can
detect the EFUSE configuation automatically.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: modify initial card clock

BugLink: http://bugs.launchpad.net/bugs/698006

Modify initial card clock to avoid over spec

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: AppArmor: Fix masking of capabilities in complain mode

BugLink: http://bugs.launchpad.net/bugs/748656

AppArmor is masking the capabilities returned by capget against the
capabilities mask in the profile.  This is wrong, in complain mode the
profile has effectively all capabilities, as the profile restrictions are
not being enforced, merely tested against to determine is an access is
known by the profile.

This can result in the wrong behavior of security conscience applications
like sshd which examine their capability set, and change their behavior
accordingly.  In this case because of the masked capability set being
returned sshd fails due to DAC checks, even when the profile is complain
mode.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Revert "tcp: disallow bind() to reuse addr/port"

BugLink: http://bugs.launchpad.net/bugs/731878

http://marc.info/?t=130176746300003&r=1&w=2

This reverts commit c191a836a908d1dd6b40c503741f91b914de3348.

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

staging: rts_pstor: MSXC card power class

BugLink: http://bugs.launchpad.net/bugs/698006

1, Initialize chip->ms_power_class_en in rtsx_init_options;
2, In reset_ms_pro, set different initial value of change_power_class
according to chip->ms_power_class_en.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 9fe341e834bec1cad92c3f320931d0563674e112)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: optimize kmalloc to kzalloc

BugLink: http://bugs.launchpad.net/bugs/698006

Use kzalloc rather than kmalloc followed by memset with 0.
Found by coccinelle.

Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 1840c15b0a504fed6ee08b475245a964336b76e6)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: fix a bug that a greenhouse sd card can't be recognized

BugLink: http://bugs.launchpad.net/bugs/698006

A greenhouse sd card can't be recognized using rts5209.
To fix this bug, these modifications are applied:
1, Move some codes which clear sd internal variables from sd_init_type to
sd_prepare_reset. So sd_init_type is useless any more and is removed
entirely;
2, If a sd card can't pass sd3.0 mode, the action of tunning phase should be
avoided when retrying sd2.0 mode.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 2d2322b269c2524996a259024f82c7e318719696)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: fix sparse warning

BugLink: http://bugs.launchpad.net/bugs/698006

Add static modifier before some functions and global variables.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 6680d2cab316a0c0e4cea0727e6d63426a77bb12)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: delete a function

BugLink: http://bugs.launchpad.net/bugs/698006

Delete a function named rtsx_transfer_sglist which won't be called.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 7eb90a3682fc42c5607cff931e5d0f6a9d52dc03)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Staging: rts_pstor: fix read past end of buffer

BugLink: http://bugs.launchpad.net/bugs/698006

We read one space past the end of the buffer because we add 1.

Also I changed it to use ARRAY_SIZE() instead of manually calculating
the size.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 7e79f78b331632c1812ce9c07443550aa2b6c0fe)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: rts_pstor: potential NULL dereference

BugLink: http://bugs.launchpad.net/bugs/698006

pci_get_bus_and_slot() may return NULL, but the caller checks
wrong variable.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 37af07d19a53924a70ae42faebf968c04a631c8c)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Staging: rts_pstor: fixed some brace code styling issues

BugLink: http://bugs.launchpad.net/bugs/698006

Fixed all brace coding style issues in the following files:
drivers/staging/rts_pstor/rtsx_card.h
drivers/staging/rts_pstor/spi.c
drivers/staging/rts_pstor/trace.h
drivers/staging/rts_pstor/xd.c

Signed-off-by: Timo von Holtz <tvh@informatik.uni-kiel.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 0838b87cae7e81e497218b5eba3c8e9ca6f3ddbe)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: fix rts_pstor build errors

BugLink: http://bugs.launchpad.net/bugs/698006

Fix multiple rts_pstor build errors.

When CONFIG_PCI is not enabled:

drivers/staging/rts_pstor/rtsx.c: In function 'rtsx_acquire_irq':
drivers/staging/rts_pstor/rtsx.c:324: error: implicit declaration of function 'pci_intx'
drivers/staging/rts_pstor/rtsx.c: In function 'rtsx_read_pci_cfg_byte':
drivers/staging/rts_pstor/rtsx.c:336: error: implicit declaration of function 'pci_get_domain_bus_and_slot'
drivers/staging/rts_pstor/rtsx.c:336: warning: assignment makes pointer from integer without a cast
drivers/staging/rts_pstor/rtsx.c: In function 'rtsx_shutdown':
drivers/staging/rts_pstor/rtsx.c:462: error: implicit declaration of function 'pci_disable_msi'
drivers/staging/rts_pstor/rtsx.c: In function 'rtsx_probe':
drivers/staging/rts_pstor/rtsx.c:981: error: implicit declaration of function 'pci_enable_msi'

When CONFIG_SCSI is not enabled:

In file included from drivers/staging/rts_pstor/rtsx.h:45,
                 from drivers/staging/rts_pstor/rtsx.c:28:
include/scsi/scsi_cmnd.h:27:25: warning: "BLK_MAX_CDB" is not defined
include/scsi/scsi_cmnd.h:28:3: error: #error MAX_COMMAND_SIZE can not be bigger than BLK_MAX_CDB
In file included from drivers/staging/rts_pstor/rtsx.h:45,
                 from drivers/staging/rts_pstor/rtsx.c:28:
include/scsi/scsi_cmnd.h: In function 'scsi_bidi_cmnd':
include/scsi/scsi_cmnd.h:184: error: implicit declaration of function 'blk_bidi_rq'
include/scsi/scsi_cmnd.h:185: error: dereferencing pointer to incomplete type
include/scsi/scsi_cmnd.h: In function 'scsi_in':
include/scsi/scsi_cmnd.h:191: error: dereferencing pointer to incomplete type
include/scsi/scsi_cmnd.h: In function 'scsi_get_lba':  CC      drivers/gpu/drm/nouveau/nv04_tv.o

include/scsi/scsi_cmnd.h:269: error: implicit declaration of function 'blk_rq_pos'
In file included from drivers/staging/rts_pstor/rtsx.h:48,
                 from drivers/staging/rts_pstor/rtsx.c:28:
include/scsi/scsi_eh.h: At top level:
include/scsi/scsi_eh.h:84: error: 'BLK_MAX_CDB' undeclared here (not in a function)
drivers/staging/rts_pstor/rtsx.c: In function 'slave_configure':
drivers/staging/rts_pstor/rtsx.c:107: error: implicit declaration of function 'blk_queue_dma_alignment'

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: wei_wang@realsil.com.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 27a16811ab4dc819eebbd4e7b07d485f6e8f0134)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

staging: add rts_pstor for Realtek PCIE cardreader

BugLink: http://bugs.launchpad.net/bugs/698006

rts_pstor is used to support Realtek PCI-E card readers,
including rts5209, rts5208, Barossa.

Signed-off-by: wwang <wei_wang@realsil.com.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(cherry picked from commit 77d89b08766c878a2594b15d203e513acf952340)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] CONFIG_RTS_PSTOR=m

BugLink: http://bugs.launchpad.net/bugs/698006

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: (drop after 2.6.39) v4l: make sure drivers supply a zeroed struct v4l2_subdev

Some v4l drivers currently don't initialize their struct v4l2_subdev
with zeros, and this is a problem since some of the v4l2 code expects
this. One example is the addition of internal_ops in commit 45f6f84,
after that we are at risk of random oopses with these drivers when code
in v4l2_device_register_subdev tries to dereference sd->internal_ops->*,
as can be shown by the report at http://bugs.launchpad.net/bugs/745213
and analysis of its crash at https://lkml.org/lkml/2011/4/1/168

Use kzalloc within problematic drivers to ensure we have a zeroed struct
v4l2_subdev.

BugLink: http://bugs.launchpad.net/bugs/745213
Cc: <stable@kernel.org>
Acked-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

watchdog: sp5100_tco.c: Check if firmware has set correct value in tcobase.

Stefano found SP5100 TCO watchdog driver using wrong address.

[    9.148536] SP5100 TCO timer: SP5100 TCO WatchDog Timer Driver v0.01
[    9.148628] DEBUG __ioremap_caller WARNING address=b8fe00 size=8 valid=1 reserved=1

and e820 said that range is RAM.

We should check if we can use that reading out. BIOS could just program wrong address there.

Reported-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by:Yinghai Lu <yinghai@kernel.org>
Acked-by: Mike Waychison <mikew@google.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Cc: stable <stable@kernel.org>

(cherry picked from commit 90d241edd13bdeef70f264b569f7e150bf23621e)
BugLink: http://bugs.launchpad.net/bugs/740011
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

KVM: SVM: Load %gs earlier if CONFIG_X86_32_LAZY_GS=n

With CONFIG_CC_STACKPROTECTOR, we need a valid %gs at all times, so disable
lazy reload and do an eager reload immediately after the vmexit.

Reported-by: IVAN ANGELOV <ivangotoy@gmail.com>
Acked-By: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
(cherry picked from commit 831ca6093ca486060721f5c3c74f97b10f3172b9)
BugLink: http://bugs.launchpad.net/bugs/729085
Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Input: sparse-keymap - report KEY_UNKNOWN for unknown scan codes

This allows for debugging non-functional keys easily from
userspace.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
(cherry picked from commit 170531bae648c0ef8d56b44dc5bd8d67717b0db9)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

Input: sparse-keymap - report scancodes with key events

Scancodes are useful debugging aids when incorrect keycodes
are being sent, as is common with laptop hotkeys.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
(cherry picked from commit f3cf5c4fedbe13880cd80a9fa1aebae79ebef20e)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: (drop after 2.6.38) ALSA: HDA: Fix dock mic for Lenovo X220-tablet

Without the "thinkpad" quirk, the dock mic in
Lenovo X220 tablet edition won't work.

BugLink: http://bugs.launchpad.net/bugs/751033
Cc: stable@kernel.org
Tested-by: James Ferguson <james.ferguson@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: HDA: New AD1984A model for Dell Precision R5500

For codec AD1984A, add a new model to support Dell Precision R5500
or the microphone jack won't work correctly.

BugLink: http://bugs.launchpad.net/bugs/741516
Tested-by: Kent Baxley <kent.baxley@canonical.com>
Cc: stable@kernel.org
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit 677cd904aba939bc4cfdc3c1eada8ec46582127e)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: HDA: Add dock mic quirk for Lenovo Thinkpad X220

This quirk is needed for the docking station mic of
Lenovo Thinkpad X220 to function correctly.

BugLink: http://bugs.launchpad.net/bugs/746259
Cc: stable@kernel.org
Tested-by: James Ferguson <james.ferguson@canonical.com>
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit 840126579da56edae8ecc4a0d85198f742982f10)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: (drop after 2.6.38) add support for Lenovo tablet ID (0xE6)

Patch was submitted upstream, upstream has changed the way
resolutions are reported, so I need to rework the upstream
patch based on for-linus tree. Not sure when the upstream
patches will get merged to linus tree. More information here:
https://lkml.org/lkml/2011/3/31/403

BugLink: http://bugs.launchpad.net/bugs/746652

Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: Start new release

Ignore: yes
Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: Ubuntu-2.6.38-8.41

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo

Commit da48524eb206 ("Prevent rt_sigqueueinfo and rt_tgsigqueueinfo
from spoofing the signal code") made the check on si_code too strict.
There are several legitimate places where glibc wants to queue a
negative si_code different from SI_QUEUE:

 - This was first noticed with glibc's aio implementation, which wants
   to queue a signal with si_code SI_ASYNCIO; the current kernel
   causes glibc's tst-aio4 test to fail because rt_sigqueueinfo()
   fails with EPERM.

 - Further examination of the glibc source shows that getaddrinfo_a()
   wants to use SI_ASYNCNL (which the kernel does not even define).
   The timer_create() fallback code wants to queue signals with SI_TIMER.

As suggested by Oleg Nesterov <oleg@redhat.com>, loosen the check to
forbid only the problematic SI_TKILL case.

Reported-by: Klaus Dittrich <kladit@arcor.de>
Acked-by: Julien Tinnes <jln@google.com>
Cc: <stable@kernel.org>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 243b422af9ea9af4ead07a8ad54c90d4f9b6081a)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

ALSA: pcm: fix infinite loop in snd_pcm_update_hw_ptr0()

When period interrupts are disabled, snd_pcm_update_hw_ptr0() compares
the current time against the time estimated for the current hardware
pointer to detect xruns.  The somewhat fuzzy threshold in the while loop
makes it possible that hdelta becomes negative; the comparison being
done with unsigned types then makes the loop go through the entire 263
negative range, and, depending on the value, never reach an unsigned
value that is small enough to stop the loop.  Doing this with interrupts
disabled results in the machine locking up.

To prevent this, ensure that the loop condition uses signed types for
both operands so that the comparison is correctly done.

Many thanks to Kelly Anderson for debugging this.

Reported-by: Nix <nix@esperi.org.uk>
Reported-by: "Christopher K." <c.krooss@googlemail.com>
Reported-and-tested-by: Kelly Anderson <kelly@silka.with-linux.com>
Signed-off-by: Kelly Anderson <kelly@silka.with-linux.com>
[cl: remove unneeded casts; use a temp variable]
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: 2.6.38 <stable@kernel.org>

Signed-off-by: Takashi Iwai <tiwai@suse.de>
(cherry picked from commit 12ff414e2e4512f59fe191dc18e856e2939a1c79)

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] Build some framebuffer drivers as modules for powerpc kernels.

At some point in the past with config update/consolidation, some framebuffer
drivers got built into the powerpc kernels. This config change builds these
drivers as modules, as the OpenFirmware framebuffer driver is already in the
kernel. This also allows DRM modules to take priority in the case of radeon
cards.

Signed-off-by: Luke Yelavich <themuso@ubuntu.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] Disable CONFIG_DRM_RADEON_KMS on powerpc kernels

Radeon KMS on powerpc gives an oops on startup, leaving the user with a blank
screen. Disable KMS for now so that machines with radeon hardware will at
least work in the console/X.

Signed-off-by: Luke Yelavich <themuso@ubuntu.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: [Config] Disable CONFIG_CRASH_DUMP on 32-bit powerpc kernels

BugLink: https://launchpad.net/bugs/745358

With CONFIG_CRASH_DUMP enabled, the 32-bit powerpc kernels are unbootable,
even with the latest yaboot in natty. Disable it for now so we can have
bootable kernels and disk images again.

Signed-off-by: Luke Yelavich <themuso@ubuntu.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: Increase the default hard limit for open FDs to 4096

BugLink: http://bugs.launchpad.net/bugs/663090

This presumes that INR_OPEN is 1024.

Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: (drop after 2.6.38) eeepc-wmi: Add support for T101MT Home/Express Gate key

This key is different than other hotkeys, having seperate scan
codes for press, release, and hold, so it requires some special
filtering. Press and release events are passed on, and hold events
are ignored since sparse-keymap does not support hardware
autorepeat. Instead, the input core's software autorepeat is
enabled for the input device.

Note that "Home" in the context of this button doesn't mean the
same thing as the usual Home key, and it really isn't clear at
all what is meant by "Home". The manufacurer's description of the
button indicates that it should launch some sort of touch screen
settings interface on short press and apply a desktop rotation on
long press.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: Start new release

Ignore: yes
Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: Ubuntu-2.6.38-8.40

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: SAUCE: nx-emu: further clarify dmesg reporting

When booting a 32bit non-PAE kernel on a CPU that supports hardware NX,
dmesg did not indicate that NX emulation was being used. This changes
the dmesg reporting to be more clear. Warnings about lacking hardware
NX remain, and the state of NX-emulation is reported when enabled.

BugLink: https://launchpad.net/bugs/745181

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: SAUCE: thinkpad-acpi: module autoloading for newer Lenovo ThinkPads.

This patch was submitted upstream and acked by maintainer but not yet in
linus tree.

Signed-off-by: Manoj Iyer <manoj.iyer@canonical.com>

BugLink: http://launchpad.net/bugs/745217
Acked-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: reorder device ids

Each device seems to be in a "group" (devid >> 16 & 0xFF).

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 43815941efb1374c2f71eb1fb0a2814b049030eb)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add touchpad sysfs file

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 4615bb661352acb7032796185c8c5573e47dfa1d)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: comments keymap to clarify the meaning of some keys

Found while checking PDF manuals...

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 77ca5b0197138db1260bbbb95ce3fd015dd10437)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: real touchpad led device id is 0x001000012

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 8571d75d614702e3e0278c92892012dbf7c2e65b)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: respect wireless_hotplug setting

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit c14d4b8ea799515cd44134b8eddd8f789f0b6286)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: support backlight power (bl_power) attribute

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit b71872650fe967eb0a38aa0d7dcbe9c60d160032)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: set the right key code for 0xe9

This key should power off the backlight, not the display,
it is also used in acpi/video.c to do the same thing.

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 54c799a50f58285f5f6a93d87470cba1847943a3)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add wimax support

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 2e9e159d8e18c37d60a7d5040314f579a40f4c63)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add camera and card reader support

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 9e1565bc390123d3c74b940ba3466faf196970ec)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: use the presence bit correctly

I checked some more DSDT, and it seems that I wasn't
totally right about the meaning of DSTS return value.
Bit 0 is clearly the status of the device, and I discovered
that bit 16 is set when the device is present.

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit aafa719dcd0cb0c05bb0690c816b13263c8b36e6)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: reorder defines

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 33e0e6fed04dc6067562c65e3e6d551dc0eb11fc)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: switch to platform_create_bundle()

This allow to remove ~30 lines of code.

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit a04ce290bffe6b39edf18bac0fdb302503a53a4e)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add hibernate/resume callbacks

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 0773d7f9f1c0ad5fb86d23ad7e4ef5bfd2f48b5e)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add an helper using simple return codes

eeepc_wmi_get_devstate returns an acpi_status, so each
call need extra logic to handle the return code. This
patch add a simple getter, returning a boolean (or a
negative error code).

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 5c95638d115f9c6661fff254b3beb14b19f88e41)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: return proper error code in eeepc_rfkill_set()

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 7898cf1a3665d22c4d16308f73e981c6464be81b)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: serialize access to wmi method

\AMW0.WMBC, which is the main method that we use,
is not reentrant. When wireless hotpluging is enabled,
toggling the status of the wireless device using WMBC will
trigger a notification and the notification handler need to
call WMBC again to get the new status of the device, this
will trigger the following error:

ACPI Error (dswload-0802): [_T_0] Namespace lookup failure, AE_ALREADY_EXISTS
ACPI Exception: AE_ALREADY_EXISTS, During name lookup/catalog (20100428/psloop-231)
ACPI Error (psparse-0537): Method parse/execution failed [\AMW0.WMBC] (Node f7023b88), AE_ALREADY_EXISTS
ACPI: Marking method WMBC as Serialized because of AE_ALREADY_EXISTS error

Since there is currently no way to tell the acpi subsystem to mark
a method as serialized, we do it in eeepc-wmi.

Of course, we could let the first call fail, and then it would work,
but it doesn't seems really clean, and it will make the first
WMBC call return a random value.

This patch was tested on EeePc 1000H with a RaLink RT2860
wireless card using the rt2800pci driver. rt2860sta driver
seems to deadlock when we remove the pci device...

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit 279f8f95493c9aaa0a85520c863ccba87c4bf930)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

eeepc-wmi: add hotplug code for Eeepc 1000H

Implement wireless like hotplug handling (code stolen from eeepc-laptop).

Reminder: on some models rfkill is implemented by logically unplugging the
wireless card from the PCI bus. Despite sending ACPI notifications, this does
not appear to be implemented using standard ACPI hotplug - nor does the
firmware provide the _OSC method required to support native PCIe hotplug.
The only sensible choice appears to be to handle the hotplugging directly in
the platform driver.

Signed-off-by: Corentin Chary <corentincj@iksaif.net>
Signed-off-by: Matthew Garrett <mjg@redhat.com>
(cherry picked from commit afa7c886578ce264d9b66d4bcb1fea51fac47925)

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

UBUNTU: rebase to v2.6.38.2

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: [Config] update configs after v2.6.38.1 rebase

Basically, enable HID_ACRUX=m

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: rebase to v2.6.38.1

Signed-off-by: Leann Ogasawara <leann.ogasawara@canonical.com>

UBUNTU: [Config] packaging: adjust perms on vmlinuz as well

Since kernel symbols are resolvable internally to the kernel, the kernel
itself has a map of the symbols. Continuing the tradition of frustrating
off-the-shelf kernel exploits, make vmlinuz unreadable for non-root, just
like has been done for System.map, etc.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>