{"head":"1908b6b85eebd973fc29e4caeb34b5d6fef979d4","size":34,"push_id":46612466,"ref":"refs/heads/linux-3.0.y-thinkpad","commits":[{"sha":"ca64baea4dd045516046a84a8860c3f9809b8984","author":{"name":"David S. Miller","email":"fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net"},"url":"https://api.github.com/repos/gdamjan/linux/commits/ca64baea4dd045516046a84a8860c3f9809b8984","message":"sparc64: Force the execute bit in OpenFirmware's translation entries.\n\nIn the OF 'translations' property, the template TTEs in the mappings\nnever specify the executable bit.  This is the case even though some\nof these mappings are for OF's code segment.\n\nTherefore, we need to force the execute bit on in every mapping.\n\nThis problem can only really trigger on Niagara/sun4v machines and the\nhistory behind this is a little complicated.\n\nPrevious to sun4v, the sun4u TTE entries lacked a hardware execute\npermission bit.  So OF didn't have to ever worry about setting\nanything to handle executable pages.  Any valid TTE loaded into the\nI-TLB would be respected by the chip.\n\nBut sun4v Niagara chips have a real hardware enforced executable bit\nin their TTEs.  So it has to be set or else the I-TLB throws an\ninstruction access exception with type code 6 (protection violation).\n\nWe've been extremely fortunate to not get bitten by this in the past.\n\nThe best I can tell is that the OF's mappings for it's executable code\nwere mapped using permanent locked mappings on sun4v in the past.\nTherefore, the fact that we didn't have the exec bit set in the OF\ntranslations we would use did not matter in practice.\n\nThanks to Greg Onufer for helping me track this down.\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"113f8b8f997cd3a70e6e4c95ced9232d50b7a308","author":{"name":"Shawn Bohrer","email":"2bfef4e2b953b8463910cf5c5571c19ecd7a208a@rgmadvisors.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/113f8b8f997cd3a70e6e4c95ced9232d50b7a308","message":"sched/rt: Migrate equal priority tasks to available CPUs\n\ncommit 3be209a8e22cedafc1b6945608b7bb8d9887ab61 upstream.\n\nCommit 43fa5460fe60dea5c610490a1d263415419c60f6 (\"sched: Try not to\nmigrate higher priority RT tasks\") also introduced a change in behavior\nwhich keeps RT tasks on the same CPU if there is an equal priority RT\ntask currently running even if there are empty CPUs available.\n\nThis can cause unnecessary wakeup latencies, and can prevent the\nscheduler from balancing all RT tasks across available CPUs.\n\nThis change causes an RT task to search for a new CPU if an equal\npriority RT task is already running on wakeup.  Lower priority tasks\nwill still have to wait on higher priority tasks, but the system should\nstill balance out because there is always the possibility that if there\nare both a high and low priority RT tasks on a given CPU that the high\npriority task could wakeup while the low priority task is running and\nforce it to search for a better runqueue.\n\nSigned-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>\nAcked-by: Steven Rostedt <rostedt@goodmis.org>\nTested-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/1315837684-18733-1-git-send-email-sbohrer@rgmadvisors.com\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"4e41ce698822a9a2cfd324a11ea44f60fc95c871","author":{"name":"Simon Kirby","email":"813221ca5f14cb8312a6a48ff433c41b2cbb2877@hostway.ca"},"url":"https://api.github.com/repos/gdamjan/linux/commits/4e41ce698822a9a2cfd324a11ea44f60fc95c871","message":"sched: Fix up wchan borkage\n\ncommit 6ebbe7a07b3bc40b168d2afc569a6543c020d2e3 upstream.\n\nCommit c259e01a1ec (\"sched: Separate the scheduler entry for\npreemption\") contained a boo-boo wrecking wchan output. It forgot to\nput the new schedule() function in the __sched section and thereby\ndoesn't get properly ignored for things like wchan.\n\nTested-by: Simon Kirby <sim@hostway.ca>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/20110923000346.GA25425@hostway.ca\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"3217df8e225c8579293fd2e193ba5cee709b6eba","author":{"name":"Borislav Petkov","email":"0691a664b24b6f15b20cd5aee64b72271db08be1@alien8.de"},"url":"https://api.github.com/repos/gdamjan/linux/commits/3217df8e225c8579293fd2e193ba5cee709b6eba","message":"ide-disk: Fix request requeuing\n\ncommit 2c8fc867602e385fd2abe76da0b6bda8ed907547 upstream.\n\nSimon Kirby reported that on his RAID setup with idedisk underneath\nthe box OOMs after a couple of days of runtime. Running with\nCONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally\nallocates an ide_cmd struct. However, ide_requeue_and_plug() can be\ncalled more than once per request, either from the request issue or the\nIRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn()\nrepeatedly, allocating a struct ide_cmd everytime and \"forgetting\" the\nprevious pointer.\n\nMake sure the code reuses the old allocated chunk.\n\nReported-and-tested-by: Simon Kirby <sim@hostway.ca>\nLink: http://marc.info/?l=linux-kernel&m=131667641517919\nLink: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca\nSigned-off-by: Borislav Petkov <bp@alien8.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"249cf808ba1a0d403fe7c476a74b66e2bc0a8e53","author":{"name":"Peter Zijlstra","email":"645ca7d3a8d3d4f60557176cd361ea8351edc32b@chello.nl"},"url":"https://api.github.com/repos/gdamjan/linux/commits/249cf808ba1a0d403fe7c476a74b66e2bc0a8e53","message":"posix-cpu-timers: Cure SMP wobbles\n\ncommit d670ec13178d0fd8680e6742a2bc6e04f28f87d8 upstream.\n\nDavid reported:\n\n  Attached below is a watered-down version of rt/tst-cpuclock2.c from\n  GLIBC.  Just build it with \"gcc -o test test.c -lpthread -lrt\" or\n  similar.\n\n  Run it several times, and you will see cases where the main thread\n  will measure a process clock difference before and after the nanosleep\n  which is smaller than the cpu-burner thread's individual thread clock\n  difference.  This doesn't make any sense since the cpu-burner thread\n  is part of the top-level process's thread group.\n\n  I've reproduced this on both x86-64 and sparc64 (using both 32-bit and\n  64-bit binaries).\n\n  For example:\n\n  [davem@boricha build-x86_64-linux]$ ./test\n  process: before(0.001221967) after(0.498624371) diff(497402404)\n  thread:  before(0.000081692) after(0.498316431) diff(498234739)\n  self:    before(0.001223521) after(0.001240219) diff(16698)\n  [davem@boricha build-x86_64-linux]$\n\n  The diff of 'process' should always be >= the diff of 'thread'.\n\n  I make sure to wrap the 'thread' clock measurements the most tightly\n  around the nanosleep() call, and that the 'process' clock measurements\n  are the outer-most ones.\n\n  ---\n  #include <unistd.h>\n  #include <stdio.h>\n  #include <stdlib.h>\n  #include <time.h>\n  #include <fcntl.h>\n  #include <string.h>\n  #include <errno.h>\n  #include <pthread.h>\n\n  static pthread_barrier_t barrier;\n\n  static void *chew_cpu(void *arg)\n  {\n\t  pthread_barrier_wait(&barrier);\n\t  while (1)\n\t\t  __asm__ __volatile__(\"\" : : : \"memory\");\n\t  return NULL;\n  }\n\n  int main(void)\n  {\n\t  clockid_t process_clock, my_thread_clock, th_clock;\n\t  struct timespec process_before, process_after;\n\t  struct timespec me_before, me_after;\n\t  struct timespec th_before, th_after;\n\t  struct timespec sleeptime;\n\t  unsigned long diff;\n\t  pthread_t th;\n\t  int err;\n\n\t  err = clock_getcpuclockid(0, &process_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = pthread_getcpuclockid(pthread_self(), &my_thread_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  pthread_barrier_init(&barrier, NULL, 2);\n\t  err = pthread_create(&th, NULL, chew_cpu, NULL);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = pthread_getcpuclockid(th, &th_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  pthread_barrier_wait(&barrier);\n\n\t  err = clock_gettime(process_clock, &process_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(my_thread_clock, &me_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(th_clock, &th_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  sleeptime.tv_sec = 0;\n\t  sleeptime.tv_nsec = 500000000;\n\t  nanosleep(&sleeptime, NULL);\n\n\t  err = clock_gettime(th_clock, &th_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(my_thread_clock, &me_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(process_clock, &process_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  diff = process_after.tv_nsec - process_before.tv_nsec;\n\t  printf(\"process: before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t process_before.tv_sec, process_before.tv_nsec,\n\t\t process_after.tv_sec, process_after.tv_nsec, diff);\n\t  diff = th_after.tv_nsec - th_before.tv_nsec;\n\t  printf(\"thread:  before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t th_before.tv_sec, th_before.tv_nsec,\n\t\t th_after.tv_sec, th_after.tv_nsec, diff);\n\t  diff = me_after.tv_nsec - me_before.tv_nsec;\n\t  printf(\"self:    before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t me_before.tv_sec, me_before.tv_nsec,\n\t\t me_after.tv_sec, me_after.tv_nsec, diff);\n\n\t  return 0;\n  }\n\nThis is due to us using p->se.sum_exec_runtime in\nthread_group_cputime() where we iterate the thread group and sum all\ndata. This does not take time since the last schedule operation (tick\nor otherwise) into account. We can cure this by using\ntask_sched_runtime() at the cost of having to take locks.\n\nThis also means we can (and must) do away with\nthread_group_sched_runtime() since the modified thread_group_cputime()\nis now more accurate and would deadlock when called from\nthread_group_sched_runtime().\n\nAside of that it makes the function safe on 32 bit systems. The old\ncode added t->se.sum_exec_runtime unprotected. sum_exec_runtime is a\n64bit value and could be changed on another cpu at the same time.\n\nReported-by: David Miller <davem@davemloft.net>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/1314874459.7945.22.camel@twins\nTested-by: David Miller <davem@davemloft.net>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"d694ac34a8565cc3639bcb766055e92c043c4291","author":{"name":"Takashi Iwai","email":"4596b3305151c7ee743192a95d394341e3d3b644@suse.de"},"url":"https://api.github.com/repos/gdamjan/linux/commits/d694ac34a8565cc3639bcb766055e92c043c4291","message":"lis3: fix regression of HP DriveGuard with 8bit chip\n\ncommit 05faadcf59507e8eea57ffbeea9cbb14c9a2ab3d upstream.\n\nCommit 2a7fade7e03 (\"hwmon: lis3: Power on corrections\") caused a\nregression on HP laptops with 8bit chip.  Writing CTRL2_BOOT_8B bit seems\nclearing the BIOS setup, and no proper interrupt for DriveGuard will be\ntriggered any more.\n\nSince the init code there is basically only for embedded devices, put a\npdata check so that the problematic initialization will be skipped for\nhp_accel stuff.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nCc: Eric Piel <eric.piel@tremplin-utc.net>\nCc: Samu Onkalo <samu.p.onkalo@nokia.com>\nSigned-off-by: Andrew Morton <akpm@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"4f2b7b9165df53ef768f324aef7bbad4b558005f","author":{"name":"Arnd Bergmann","email":"f2c659f01951776204a6c5b902787d9019fbeebd@arndb.de"},"url":"https://api.github.com/repos/gdamjan/linux/commits/4f2b7b9165df53ef768f324aef7bbad4b558005f","message":"ASoC: use a valid device for dev_err() in Zylonite\n\ncommit eff919ac0fc7565e71ffa35657c333dd8cdc0520 upstream.\n\nA recent conversion has introduced references to &pdev->dev, which does\nnot actually exist in all the contexts it's used in.\n\nReplace this with card->dev where necessary, in order to let\nthe driver build again.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"a671258da2cdb15fbb60dd0f22d13418ae4e76b2","author":{"name":"Axel Lin","email":"b6ffd6973e972cb999e8e535ab74da7fee0c035f@gmail.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/a671258da2cdb15fbb60dd0f22d13418ae4e76b2","message":"ASoC: Fix setting update bits for WM8753_LADC and WM8753_RADC\n\ncommit 21d17dd2a377ba894f26989915eb3c6e427a3656 upstream.\n\nCurrent code set update bits for WM8753_LDAC and WM8753_RDAC twice,\nbut missed setting update bits for WM8753_LADC and WM8753_RADC.\n\nI think it is a copy-paste bug in commit 776065\n\"ASoC: codecs: wm8753: Fix register cache incoherency\".\n\nSigned-off-by: Axel Lin <axel.lin@gmail.com>\nSigned-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"1a795f752c6c41c2bdb15290b9f42328289a27ce","author":{"name":"Michel Dänzer","email":"242b79f0804cf52679d58f27ed754158c1323c75@amd.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/1a795f752c6c41c2bdb15290b9f42328289a27ce","message":"drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation.\n\ncommit b8aee294d89502469f2d80ae6afb93398d8227e0 upstream.\n\nFixes cursor disappearing prematurely when moving off a top/left edge which\nis not located at the desktop top/left edge.\n\nSigned-off-by: Michel Dänzer <michel.daenzer@amd.com>\nReviewed-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"23882c85d97acaf626ace83e2feabd46393a1b6a","author":{"name":"Alex Deucher","email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/23882c85d97acaf626ace83e2feabd46393a1b6a","message":"drm/radeon/kms: Fix logic error in DP HPD handler\n\ncommit 5ba7ddf81634bfdf32d09261d2959e3f5b7c4263 upstream.\n\nOnly disable the pipe if the monitor is physically\ndisconnected.  The previous logic also disabled the\npipe if the link was trained.\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=41248\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"290771305e6699f3807950f30562781d9bc593df","author":{"name":"Alex Deucher","email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/290771305e6699f3807950f30562781d9bc593df","message":"drm/radeon/kms: fix regression in DP aux defer handling\n\ncommit 109bc10d30f33e84f1d7289f0039e0c858ade82f upstream.\n\nAn incorrect ordering in the error checking code lead\nto DP aux defer being skipped in the aux native write\npath.  Move the bytes transferred check (ret == 0)\nbelow the defer check.\n\nTracked down by: Brad Campbell <brad@fnarfbargle.com>\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=41121\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: Brad Campbell <brad@fnarfbargle.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"c6e2e6abefaceb135487e805b7af78afdbff563e","author":{"name":"Alex Deucher","email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/c6e2e6abefaceb135487e805b7af78afdbff563e","message":"drm/radeon/kms: add retry limits for native DP aux defer\n\ncommit 6375bda073724ead7df08746866b724b1799a295 upstream.\n\nThe previous code could potentially loop forever.  Limit\nthe number of DP aux defer retries to 4 for native aux\ntransactions, same as i2c over aux transactions.\n\nNoticed by: Brad Campbell <lists2009@fnarfbargle.com>\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: Brad Campbell <lists2009@fnarfbargle.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"416a1b0477b56ac8e7dc3b91d5c18c8da242555c","author":{"name":"Alex Deucher","email":"08dc22c6156113f2deff178e35e3ed9b24d6af9e@amd.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/416a1b0477b56ac8e7dc3b91d5c18c8da242555c","message":"drm/radeon/kms: fix channel_remap setup (v2)\n\ncommit 12d5180bd7e683a4ae80830b82ba67e7b7fac7b2 upstream.\n\nMost asics just use the hw default value which requires\nno explicit programming.  For those that need a different\nvalue, the vbios will program it properly.  As such,\nthere's no need to program these registers explicitly\nin the driver.  Changing MC_SHARED_CHREMAP requires a reload\nof all data in vram otherwise its contents will be scambled.\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=40103\n\nv2: drop now unused channel_remap functions.\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nReviewed-by: Michel Dänzer <michel.daenzer@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"a94a36c352abcf3c7126b238cfbf9a79314a609b","author":{"name":"Richard Cochran","email":"e27030aebe9cad8817d34b8c31dbaf301fb798b9@gmail.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/a94a36c352abcf3c7126b238cfbf9a79314a609b","message":"ptp: fix L2 event message recognition\n\ncommit f75159e9936143177b442afc78150b7a7ad8aa07 upstream.\n\nThe IEEE 1588 standard defines two kinds of messages, event and general\nmessages. Event messages require time stamping, and general do not. When\nusing UDP transport, two separate ports are used for the two message\ntypes.\n\nThe BPF designed to recognize event messages incorrectly classifies L2\ngeneral messages as event messages. This commit fixes the issue by\nextending the filter to check the message type field for L2 PTP packets.\nEvent messages are be distinguished from general messages by testing\nthe \"general\" bit.\n\nSigned-off-by: Richard Cochran <richard.cochran@omicron.at>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"8a60d75bbc5feca1291edd728d6696be9e8dd465","author":{"name":"Gertjan van Wingerde","email":"1a7d4b7fcc67848a7146b426400f699af933a40d@gmail.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/8a60d75bbc5feca1291edd728d6696be9e8dd465","message":"rt2x00: Serialize TX operations on a queue.\n\ncommit 77a861c405da75d81e9e6e32c50eb7f9777777e8 upstream.\n\nThe rt2x00 driver gets frequent occurrences of the following error message\nwhen operating under load:\nphy0 -> rt2x00queue_write_tx_frame: Error - Arrived at non-free entry in the\nnon-full queue 2.\n\nThis is caused by simultaneous attempts from mac80211 to send a frame via\nrt2x00, which are not properly serialized inside rt2x00queue_write_tx_frame,\ncausing the second frame to fail sending with the above mentioned error\nmessage.\n\nFix this by introducing a per-queue spinlock to serialize the TX operations\non that queue.\n\nReported-by: Andreas Hartmann <andihartmann@01019freenet.de>\nSigned-off-by: Gertjan van Wingerde <gwingerde@gmail.com>\nAcked-by: Helmut Schaa <helmut.schaa@googlemail.com>\nSigned-off-by: Ivo van Doorn <IvDoorn@gmail.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nCc: Tim Gardner <tim.gardner@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"36f1ce1fa2ee9e2d2608ca2629b8b1232b14a1dc","author":{"name":"Paul Menzel","email":"acd6d3b156327487a919475da61b8867f1e8b249@users.sourceforge.net"},"url":"https://api.github.com/repos/gdamjan/linux/commits/36f1ce1fa2ee9e2d2608ca2629b8b1232b14a1dc","message":"x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE\n\ncommit 29cf7a30f8a0ce4af2406d93d5a332099be26923 upstream.\n\nIn summary, this DMI quirk uses the _CRS info by default for the ASUS\nM2V-MX SE by turning on `pci=use_crs` and is similar to the quirk\nadded by commit 2491762cfb47 (\"x86/PCI: use host bridge _CRS info on\nASRock ALiveSATA2-GLAN\") whose commit message should be read for further\ninformation.\n\nSince commit 3e3da00c01d0 (\"x86/pci: AMD one chain system to use pci\nread out res\") Linux gives the following oops:\n\n    parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]\n    HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17\n    HDA Intel 0000:20:01.0: setting latency timer to 64\n    BUG: unable to handle kernel paging request at ffffc90011c08000\n    IP: [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n    PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173\n    Oops: 0009 [#1] SMP\n    last sysfs file: /sys/module/snd_pcm/initstate\n    CPU 0\n    Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan]\n    Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name\n    RIP: 0010:[<ffffffffa0578402>]  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n    RSP: 0018:ffff88013153fe50  EFLAGS: 00010286\n    RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006\n    RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\n    RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040\n    R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400\n    R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090\n    FS:  0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0\n    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n    CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n    Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0)\n    Stack:\n     0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400\n     ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8\n     ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232\n    Call Trace:\n     [<ffffffff8123ad65>] ? __pm_runtime_set_status+0x162/0x186\n     [<ffffffff811ad232>] ? local_pci_probe+0x49/0x92\n     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b\n     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b\n     [<ffffffff8105afd0>] ? do_work_for_cpu+0xb/0x1b\n     [<ffffffff8105fd3f>] ? kthread+0x7a/0x82\n     [<ffffffff8100a824>] ? kernel_thread_helper+0x4/0x10\n     [<ffffffff8105fcc5>] ? kthread+0x0/0x82\n     [<ffffffff8100a820>] ? kernel_thread_helper+0x0/0x10\n    Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be\n    RIP  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n     RSP <ffff88013153fe50>\n    CR2: ffffc90011c08000\n    ---[ end trace 8d1f3ebc136437fd ]---\n\nTrusting the ACPI _CRS information (`pci=use_crs`) fixes this problem.\n\n    $ dmesg | grep -i crs # with the quirk\n    PCI: Using host bridge windows from ACPI; if necessary, use \"pci=nocrs\" and report a bug\n\nThe match has to be against the DMI board entries though since the vendor entries are not populated.\n\n    DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304    10/30/2007\n\nThis quirk should be removed when `pci=use_crs` is enabled for machines\nfrom 2006 or earlier or some other solution is implemented.\n\nUsing coreboot [1] with this board the problem does not exist but this\nquirk also does not affect it either. To be safe though the check is\ntightened to only take effect when the BIOS from American Megatrends is\nused.\n\n        15:13 < ruik> but coreboot does not need that\n        15:13 < ruik> because i have there only one root bus\n        15:13 < ruik> the audio is behind a bridge\n\n        $ sudo dmidecode\n        BIOS Information\n                Vendor: American Megatrends Inc.\n                Version: 0304\n                Release Date: 10/30/2007\n\n[1] http://www.coreboot.org/\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552\n\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: x86@kernel.org\nSigned-off-by: Paul Menzel <paulepanter@users.sourceforge.net>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nAcked-by: Jesse Barnes <jbarnes@virtuousgeek.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"afcb5001fe569ced2da2048fcbdef9db3cb785f4","author":{"name":"Roland Dreier","email":"0d270388f2f92757a5de0f4bd891d3b392c44c4f@purestorage.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/afcb5001fe569ced2da2048fcbdef9db3cb785f4","message":"qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload\n\ncommit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 upstream.\n\nI hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is\nunloaded right after it is loaded.  I debugged this down to the abort\nhandling improperly treating a command of type SRB_ADISC_CMD as if it\nhad a bsg_job to complete when that command actually uses the iocb_cmd\npart of the union.  (I guess to hit this one has to unload the module\nwhile the async FC initialization is still in progress)\n\nIt seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT,\nSRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit.\n\nSigned-off-by: Roland Dreier <roland@purestorage.com>\nAcked-by: Chad Dupuis <chad.dupuis@qlogic.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"57fb87f0a640cd7b2e7cde21fd7c13138f8ef75b","author":{"name":"Mark Salyzyn","email":"f102f7c45a3b9883a55ddd80ccff5c31a6148896@us.xyratex.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/57fb87f0a640cd7b2e7cde21fd7c13138f8ef75b","message":"libsas: fix panic when single phy is disabled on a wide port\n\ncommit a73914c35b05d80f8ce78288e10056c91090b666 upstream.\n\nWhen a wide port is being utilized to a target, if one disables only one\nof the\nphys, we get an OS crash:\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000238\nIP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50\nPGD 4103f5067 PUD 41dba9067 PMD 0\nOops: 0002 [#1] SMP\nlast sysfs file: /sys/bus/pci/slots/5/address\nCPU 0\nModules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4\nipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl\nauth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt\nllc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom\ndm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt\niTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3\njbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix\nlibsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]\n\nModules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4\nipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl\nauth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt\nllc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom\ndm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt\niTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3\njbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix\nlibsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]\nPid: 5146, comm: scsi_wq_5 Not tainted\n2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server\nRIP: 0010:[<ffffffff814ca9b1>]  [<ffffffff814ca9b1>]\nmutex_lock+0x21/0x50\nRSP: 0018:ffff8803e4e33d30  EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238\nRBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000\nR13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0\nFS:  0000000000000000(0000) GS:ffff880028200000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b\nCR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task\nffff8803e4e294a0)\nStack:\n ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e\n<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00\n<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200\nCall Trace:\n [<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas]\n [<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas]\n [<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas]\n [<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas]\n [<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas]\n [<ffffffff8108c7d0>] worker_thread+0x170/0x2a0\n [<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40\n [<ffffffff8108c660>] ? worker_thread+0x0/0x2a0\n [<ffffffff81091b36>] kthread+0x96/0xa0\n [<ffffffff810141ca>] child_rip+0xa/0x20\n [<ffffffff81091aa0>] ? kthread+0x0/0xa0\n [<ffffffff810141c0>] ? child_rip+0x0/0x20\nCode: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24\n4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff\n0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d\nRIP  [<ffffffff814ca9b1>] mutex_lock+0x21/0x50\n RSP <ffff8803e4e33d30>\nCR2: 0000000000000238\n\nThe following patch is admittedly a band-aid, and does not solve the\nroot cause, but it still is a good candidate for hardening as a pointer\ncheck before reference.\n\nSigned-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>\nTested-by: Jack Wang <jack_wang@usish.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"7f3b5ef8184a929f56293d6c7a88f426c7b74558","author":{"name":"NeilBrown","email":"1c00aa603bb92d594c03cff60ecf8e63b2a5bcb1@suse.de"},"url":"https://api.github.com/repos/gdamjan/linux/commits/7f3b5ef8184a929f56293d6c7a88f426c7b74558","message":"md: Avoid waking up a thread after it has been freed.\n\ncommit 01f96c0a9922cd9919baf9d16febdf7016177a12 upstream.\n\nTwo related problems:\n\n1/ some error paths call \"md_unregister_thread(mddev->thread)\"\n   without subsequently clearing ->thread.  A subsequent call\n   to mddev_unlock will try to wake the thread, and crash.\n\n2/ Most calls to md_wakeup_thread are protected against the thread\n   disappeared either by:\n      - holding the ->mutex\n      - having an active request, so something else must be keeping\n        the array active.\n   However mddev_unlock calls md_wakeup_thread after dropping the\n   mutex and without any certainty of an active request, so the\n   ->thread could theoretically disappear.\n   So we need a spinlock to provide some protections.\n\nSo change md_unregister_thread to take a pointer to the thread\npointer, and ensure that it always does the required locking, and\nclears the pointer properly.\n\nReported-by: \"Moshe Melnikov\" <moshe@zadarastorage.com>\nSigned-off-by: NeilBrown <neilb@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"},{"sha":"25dd1546f84a5d5bf85686e36b6d5fb8a4cbcca3","author":{"name":"Mike Snitzer","email":"85e533f2e78486213c4d69f71462342ec0c62734@redhat.com"},"url":"https://api.github.com/repos/gdamjan/linux/commits/25dd1546f84a5d5bf85686e36b6d5fb8a4cbcca3","message":"dm table: avoid crash if integrity profile changes\n\ncommit 876fbba1db4a377f050a2bb49b474c7527b2995d upstream.\n\nCommit a63a5cf (dm: improve block integrity support) introduced a\ntwo-phase initialization of a DM device's integrity profile.  This\npatch avoids dereferencing a NULL 'template_disk' pointer in\nblk_integrity_register() if there is an integrity profile mismatch in\ndm_table_set_integrity().\n\nThis can occur if the integrity profiles for stacked devices in a DM\ntable are changed between the call to dm_table_prealloc_integrity() and\ndm_table_set_integrity().\n\nReported-by: Zdenek Kabelac <zkabelac@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>"}],"legacy":{"head":"1908b6b85eebd973fc29e4caeb34b5d6fef979d4","size":34,"push_id":46612466,"shas":[["ca64baea4dd045516046a84a8860c3f9809b8984","davem@davemloft.net","sparc64: Force the execute bit in OpenFirmware's translation entries.\n\nIn the OF 'translations' property, the template TTEs in the mappings\nnever specify the executable bit.  This is the case even though some\nof these mappings are for OF's code segment.\n\nTherefore, we need to force the execute bit on in every mapping.\n\nThis problem can only really trigger on Niagara/sun4v machines and the\nhistory behind this is a little complicated.\n\nPrevious to sun4v, the sun4u TTE entries lacked a hardware execute\npermission bit.  So OF didn't have to ever worry about setting\nanything to handle executable pages.  Any valid TTE loaded into the\nI-TLB would be respected by the chip.\n\nBut sun4v Niagara chips have a real hardware enforced executable bit\nin their TTEs.  So it has to be set or else the I-TLB throws an\ninstruction access exception with type code 6 (protection violation).\n\nWe've been extremely fortunate to not get bitten by this in the past.\n\nThe best I can tell is that the OF's mappings for it's executable code\nwere mapped using permanent locked mappings on sun4v in the past.\nTherefore, the fact that we didn't have the exec bit set in the OF\ntranslations we would use did not matter in practice.\n\nThanks to Greg Onufer for helping me track this down.\n\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","David S. Miller"],["113f8b8f997cd3a70e6e4c95ced9232d50b7a308","sbohrer@rgmadvisors.com","sched/rt: Migrate equal priority tasks to available CPUs\n\ncommit 3be209a8e22cedafc1b6945608b7bb8d9887ab61 upstream.\n\nCommit 43fa5460fe60dea5c610490a1d263415419c60f6 (\"sched: Try not to\nmigrate higher priority RT tasks\") also introduced a change in behavior\nwhich keeps RT tasks on the same CPU if there is an equal priority RT\ntask currently running even if there are empty CPUs available.\n\nThis can cause unnecessary wakeup latencies, and can prevent the\nscheduler from balancing all RT tasks across available CPUs.\n\nThis change causes an RT task to search for a new CPU if an equal\npriority RT task is already running on wakeup.  Lower priority tasks\nwill still have to wait on higher priority tasks, but the system should\nstill balance out because there is always the possibility that if there\nare both a high and low priority RT tasks on a given CPU that the high\npriority task could wakeup while the low priority task is running and\nforce it to search for a better runqueue.\n\nSigned-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>\nAcked-by: Steven Rostedt <rostedt@goodmis.org>\nTested-by: Steven Rostedt <rostedt@goodmis.org>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/1315837684-18733-1-git-send-email-sbohrer@rgmadvisors.com\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Shawn Bohrer"],["4e41ce698822a9a2cfd324a11ea44f60fc95c871","sim@hostway.ca","sched: Fix up wchan borkage\n\ncommit 6ebbe7a07b3bc40b168d2afc569a6543c020d2e3 upstream.\n\nCommit c259e01a1ec (\"sched: Separate the scheduler entry for\npreemption\") contained a boo-boo wrecking wchan output. It forgot to\nput the new schedule() function in the __sched section and thereby\ndoesn't get properly ignored for things like wchan.\n\nTested-by: Simon Kirby <sim@hostway.ca>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/20110923000346.GA25425@hostway.ca\nSigned-off-by: Ingo Molnar <mingo@elte.hu>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Simon Kirby"],["3217df8e225c8579293fd2e193ba5cee709b6eba","bp@alien8.de","ide-disk: Fix request requeuing\n\ncommit 2c8fc867602e385fd2abe76da0b6bda8ed907547 upstream.\n\nSimon Kirby reported that on his RAID setup with idedisk underneath\nthe box OOMs after a couple of days of runtime. Running with\nCONFIG_DEBUG_KMEMLEAK pointed to idedisk_prep_fn() which unconditionally\nallocates an ide_cmd struct. However, ide_requeue_and_plug() can be\ncalled more than once per request, either from the request issue or the\nIRQ handler path and do blk_peek_request() ends up in idedisk_prep_fn()\nrepeatedly, allocating a struct ide_cmd everytime and \"forgetting\" the\nprevious pointer.\n\nMake sure the code reuses the old allocated chunk.\n\nReported-and-tested-by: Simon Kirby <sim@hostway.ca>\nLink: http://marc.info/?l=linux-kernel&m=131667641517919\nLink: http://lkml.kernel.org/r/20110922072643.GA27232@hostway.ca\nSigned-off-by: Borislav Petkov <bp@alien8.de>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Borislav Petkov"],["249cf808ba1a0d403fe7c476a74b66e2bc0a8e53","a.p.zijlstra@chello.nl","posix-cpu-timers: Cure SMP wobbles\n\ncommit d670ec13178d0fd8680e6742a2bc6e04f28f87d8 upstream.\n\nDavid reported:\n\n  Attached below is a watered-down version of rt/tst-cpuclock2.c from\n  GLIBC.  Just build it with \"gcc -o test test.c -lpthread -lrt\" or\n  similar.\n\n  Run it several times, and you will see cases where the main thread\n  will measure a process clock difference before and after the nanosleep\n  which is smaller than the cpu-burner thread's individual thread clock\n  difference.  This doesn't make any sense since the cpu-burner thread\n  is part of the top-level process's thread group.\n\n  I've reproduced this on both x86-64 and sparc64 (using both 32-bit and\n  64-bit binaries).\n\n  For example:\n\n  [davem@boricha build-x86_64-linux]$ ./test\n  process: before(0.001221967) after(0.498624371) diff(497402404)\n  thread:  before(0.000081692) after(0.498316431) diff(498234739)\n  self:    before(0.001223521) after(0.001240219) diff(16698)\n  [davem@boricha build-x86_64-linux]$\n\n  The diff of 'process' should always be >= the diff of 'thread'.\n\n  I make sure to wrap the 'thread' clock measurements the most tightly\n  around the nanosleep() call, and that the 'process' clock measurements\n  are the outer-most ones.\n\n  ---\n  #include <unistd.h>\n  #include <stdio.h>\n  #include <stdlib.h>\n  #include <time.h>\n  #include <fcntl.h>\n  #include <string.h>\n  #include <errno.h>\n  #include <pthread.h>\n\n  static pthread_barrier_t barrier;\n\n  static void *chew_cpu(void *arg)\n  {\n\t  pthread_barrier_wait(&barrier);\n\t  while (1)\n\t\t  __asm__ __volatile__(\"\" : : : \"memory\");\n\t  return NULL;\n  }\n\n  int main(void)\n  {\n\t  clockid_t process_clock, my_thread_clock, th_clock;\n\t  struct timespec process_before, process_after;\n\t  struct timespec me_before, me_after;\n\t  struct timespec th_before, th_after;\n\t  struct timespec sleeptime;\n\t  unsigned long diff;\n\t  pthread_t th;\n\t  int err;\n\n\t  err = clock_getcpuclockid(0, &process_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = pthread_getcpuclockid(pthread_self(), &my_thread_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  pthread_barrier_init(&barrier, NULL, 2);\n\t  err = pthread_create(&th, NULL, chew_cpu, NULL);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = pthread_getcpuclockid(th, &th_clock);\n\t  if (err)\n\t\t  return 1;\n\n\t  pthread_barrier_wait(&barrier);\n\n\t  err = clock_gettime(process_clock, &process_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(my_thread_clock, &me_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(th_clock, &th_before);\n\t  if (err)\n\t\t  return 1;\n\n\t  sleeptime.tv_sec = 0;\n\t  sleeptime.tv_nsec = 500000000;\n\t  nanosleep(&sleeptime, NULL);\n\n\t  err = clock_gettime(th_clock, &th_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(my_thread_clock, &me_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  err = clock_gettime(process_clock, &process_after);\n\t  if (err)\n\t\t  return 1;\n\n\t  diff = process_after.tv_nsec - process_before.tv_nsec;\n\t  printf(\"process: before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t process_before.tv_sec, process_before.tv_nsec,\n\t\t process_after.tv_sec, process_after.tv_nsec, diff);\n\t  diff = th_after.tv_nsec - th_before.tv_nsec;\n\t  printf(\"thread:  before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t th_before.tv_sec, th_before.tv_nsec,\n\t\t th_after.tv_sec, th_after.tv_nsec, diff);\n\t  diff = me_after.tv_nsec - me_before.tv_nsec;\n\t  printf(\"self:    before(%lu.%.9lu) after(%lu.%.9lu) diff(%lu)\\n\",\n\t\t me_before.tv_sec, me_before.tv_nsec,\n\t\t me_after.tv_sec, me_after.tv_nsec, diff);\n\n\t  return 0;\n  }\n\nThis is due to us using p->se.sum_exec_runtime in\nthread_group_cputime() where we iterate the thread group and sum all\ndata. This does not take time since the last schedule operation (tick\nor otherwise) into account. We can cure this by using\ntask_sched_runtime() at the cost of having to take locks.\n\nThis also means we can (and must) do away with\nthread_group_sched_runtime() since the modified thread_group_cputime()\nis now more accurate and would deadlock when called from\nthread_group_sched_runtime().\n\nAside of that it makes the function safe on 32 bit systems. The old\ncode added t->se.sum_exec_runtime unprotected. sum_exec_runtime is a\n64bit value and could be changed on another cpu at the same time.\n\nReported-by: David Miller <davem@davemloft.net>\nSigned-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>\nLink: http://lkml.kernel.org/r/1314874459.7945.22.camel@twins\nTested-by: David Miller <davem@davemloft.net>\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Peter Zijlstra"],["d694ac34a8565cc3639bcb766055e92c043c4291","tiwai@suse.de","lis3: fix regression of HP DriveGuard with 8bit chip\n\ncommit 05faadcf59507e8eea57ffbeea9cbb14c9a2ab3d upstream.\n\nCommit 2a7fade7e03 (\"hwmon: lis3: Power on corrections\") caused a\nregression on HP laptops with 8bit chip.  Writing CTRL2_BOOT_8B bit seems\nclearing the BIOS setup, and no proper interrupt for DriveGuard will be\ntriggered any more.\n\nSince the init code there is basically only for embedded devices, put a\npdata check so that the problematic initialization will be skipped for\nhp_accel stuff.\n\nSigned-off-by: Takashi Iwai <tiwai@suse.de>\nCc: Eric Piel <eric.piel@tremplin-utc.net>\nCc: Samu Onkalo <samu.p.onkalo@nokia.com>\nSigned-off-by: Andrew Morton <akpm@google.com>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Takashi Iwai"],["4f2b7b9165df53ef768f324aef7bbad4b558005f","arnd@arndb.de","ASoC: use a valid device for dev_err() in Zylonite\n\ncommit eff919ac0fc7565e71ffa35657c333dd8cdc0520 upstream.\n\nA recent conversion has introduced references to &pdev->dev, which does\nnot actually exist in all the contexts it's used in.\n\nReplace this with card->dev where necessary, in order to let\nthe driver build again.\n\nSigned-off-by: Arnd Bergmann <arnd@arndb.de>\nSigned-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Arnd Bergmann"],["a671258da2cdb15fbb60dd0f22d13418ae4e76b2","axel.lin@gmail.com","ASoC: Fix setting update bits for WM8753_LADC and WM8753_RADC\n\ncommit 21d17dd2a377ba894f26989915eb3c6e427a3656 upstream.\n\nCurrent code set update bits for WM8753_LDAC and WM8753_RDAC twice,\nbut missed setting update bits for WM8753_LADC and WM8753_RADC.\n\nI think it is a copy-paste bug in commit 776065\n\"ASoC: codecs: wm8753: Fix register cache incoherency\".\n\nSigned-off-by: Axel Lin <axel.lin@gmail.com>\nSigned-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Axel Lin"],["1a795f752c6c41c2bdb15290b9f42328289a27ce","michel.daenzer@amd.com","drm/radeon: Update AVIVO cursor coordinate origin before x/yorigin calculation.\n\ncommit b8aee294d89502469f2d80ae6afb93398d8227e0 upstream.\n\nFixes cursor disappearing prematurely when moving off a top/left edge which\nis not located at the desktop top/left edge.\n\nSigned-off-by: Michel Dänzer <michel.daenzer@amd.com>\nReviewed-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Michel Dänzer"],["23882c85d97acaf626ace83e2feabd46393a1b6a","alexander.deucher@amd.com","drm/radeon/kms: Fix logic error in DP HPD handler\n\ncommit 5ba7ddf81634bfdf32d09261d2959e3f5b7c4263 upstream.\n\nOnly disable the pipe if the monitor is physically\ndisconnected.  The previous logic also disabled the\npipe if the link was trained.\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=41248\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Alex Deucher"],["290771305e6699f3807950f30562781d9bc593df","alexander.deucher@amd.com","drm/radeon/kms: fix regression in DP aux defer handling\n\ncommit 109bc10d30f33e84f1d7289f0039e0c858ade82f upstream.\n\nAn incorrect ordering in the error checking code lead\nto DP aux defer being skipped in the aux native write\npath.  Move the bytes transferred check (ret == 0)\nbelow the defer check.\n\nTracked down by: Brad Campbell <brad@fnarfbargle.com>\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=41121\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: Brad Campbell <brad@fnarfbargle.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Alex Deucher"],["c6e2e6abefaceb135487e805b7af78afdbff563e","alexander.deucher@amd.com","drm/radeon/kms: add retry limits for native DP aux defer\n\ncommit 6375bda073724ead7df08746866b724b1799a295 upstream.\n\nThe previous code could potentially loop forever.  Limit\nthe number of DP aux defer retries to 4 for native aux\ntransactions, same as i2c over aux transactions.\n\nNoticed by: Brad Campbell <lists2009@fnarfbargle.com>\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nCc: Brad Campbell <lists2009@fnarfbargle.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Alex Deucher"],["416a1b0477b56ac8e7dc3b91d5c18c8da242555c","alexander.deucher@amd.com","drm/radeon/kms: fix channel_remap setup (v2)\n\ncommit 12d5180bd7e683a4ae80830b82ba67e7b7fac7b2 upstream.\n\nMost asics just use the hw default value which requires\nno explicit programming.  For those that need a different\nvalue, the vbios will program it properly.  As such,\nthere's no need to program these registers explicitly\nin the driver.  Changing MC_SHARED_CHREMAP requires a reload\nof all data in vram otherwise its contents will be scambled.\n\nFixes:\nhttps://bugs.freedesktop.org/show_bug.cgi?id=40103\n\nv2: drop now unused channel_remap functions.\n\nSigned-off-by: Alex Deucher <alexander.deucher@amd.com>\nReviewed-by: Michel Dänzer <michel.daenzer@amd.com>\nSigned-off-by: Dave Airlie <airlied@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Alex Deucher"],["a94a36c352abcf3c7126b238cfbf9a79314a609b","richardcochran@gmail.com","ptp: fix L2 event message recognition\n\ncommit f75159e9936143177b442afc78150b7a7ad8aa07 upstream.\n\nThe IEEE 1588 standard defines two kinds of messages, event and general\nmessages. Event messages require time stamping, and general do not. When\nusing UDP transport, two separate ports are used for the two message\ntypes.\n\nThe BPF designed to recognize event messages incorrectly classifies L2\ngeneral messages as event messages. This commit fixes the issue by\nextending the filter to check the message type field for L2 PTP packets.\nEvent messages are be distinguished from general messages by testing\nthe \"general\" bit.\n\nSigned-off-by: Richard Cochran <richard.cochran@omicron.at>\nSigned-off-by: David S. Miller <davem@davemloft.net>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Richard Cochran"],["8a60d75bbc5feca1291edd728d6696be9e8dd465","gwingerde@gmail.com","rt2x00: Serialize TX operations on a queue.\n\ncommit 77a861c405da75d81e9e6e32c50eb7f9777777e8 upstream.\n\nThe rt2x00 driver gets frequent occurrences of the following error message\nwhen operating under load:\nphy0 -> rt2x00queue_write_tx_frame: Error - Arrived at non-free entry in the\nnon-full queue 2.\n\nThis is caused by simultaneous attempts from mac80211 to send a frame via\nrt2x00, which are not properly serialized inside rt2x00queue_write_tx_frame,\ncausing the second frame to fail sending with the above mentioned error\nmessage.\n\nFix this by introducing a per-queue spinlock to serialize the TX operations\non that queue.\n\nReported-by: Andreas Hartmann <andihartmann@01019freenet.de>\nSigned-off-by: Gertjan van Wingerde <gwingerde@gmail.com>\nAcked-by: Helmut Schaa <helmut.schaa@googlemail.com>\nSigned-off-by: Ivo van Doorn <IvDoorn@gmail.com>\nSigned-off-by: John W. Linville <linville@tuxdriver.com>\nCc: Tim Gardner <tim.gardner@canonical.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Gertjan van Wingerde"],["36f1ce1fa2ee9e2d2608ca2629b8b1232b14a1dc","paulepanter@users.sourceforge.net","x86/PCI: use host bridge _CRS info on ASUS M2V-MX SE\n\ncommit 29cf7a30f8a0ce4af2406d93d5a332099be26923 upstream.\n\nIn summary, this DMI quirk uses the _CRS info by default for the ASUS\nM2V-MX SE by turning on `pci=use_crs` and is similar to the quirk\nadded by commit 2491762cfb47 (\"x86/PCI: use host bridge _CRS info on\nASRock ALiveSATA2-GLAN\") whose commit message should be read for further\ninformation.\n\nSince commit 3e3da00c01d0 (\"x86/pci: AMD one chain system to use pci\nread out res\") Linux gives the following oops:\n\n    parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]\n    HDA Intel 0000:20:01.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17\n    HDA Intel 0000:20:01.0: setting latency timer to 64\n    BUG: unable to handle kernel paging request at ffffc90011c08000\n    IP: [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n    PGD 13781a067 PUD 13781b067 PMD 1300ba067 PTE 800000fd00000173\n    Oops: 0009 [#1] SMP\n    last sysfs file: /sys/module/snd_pcm/initstate\n    CPU 0\n    Modules linked in: snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event tpm_tis tpm snd_seq tpm_bios psmouse parport_pc snd_timer snd_seq_device parport processor evdev snd i2c_viapro thermal_sys amd64_edac_mod k8temp i2c_core soundcore shpchp pcspkr serio_raw asus_atk0110 pci_hotplug edac_core button snd_page_alloc edac_mce_amd ext3 jbd mbcache sha256_generic cryptd aes_x86_64 aes_generic cbc dm_crypt dm_mod raid1 md_mod usbhid hid sg sd_mod crc_t10dif sr_mod cdrom ata_generic uhci_hcd sata_via pata_via libata ehci_hcd usbcore scsi_mod via_rhine mii nls_base [last unloaded: scsi_wait_scan]\n    Pid: 1153, comm: work_for_cpu Not tainted 2.6.37-1-amd64 #1 M2V-MX SE/System Product Name\n    RIP: 0010:[<ffffffffa0578402>]  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n    RSP: 0018:ffff88013153fe50  EFLAGS: 00010286\n    RAX: ffffc90011c08000 RBX: ffff88013029ec00 RCX: 0000000000000006\n    RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246\n    RBP: ffff88013341d000 R08: 0000000000000000 R09: 0000000000000040\n    R10: 0000000000000286 R11: 0000000000003731 R12: ffff88013029c400\n    R13: 0000000000000000 R14: 0000000000000000 R15: ffff88013341d090\n    FS:  0000000000000000(0000) GS:ffff8800bfc00000(0000) knlGS:00000000f7610ab0\n    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b\n    CR2: ffffc90011c08000 CR3: 0000000132f57000 CR4: 00000000000006f0\n    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\n    Process work_for_cpu (pid: 1153, threadinfo ffff88013153e000, task ffff8801303c86c0)\n    Stack:\n     0000000000000005 ffffffff8123ad65 00000000000136c0 ffff88013029c400\n     ffff8801303c8998 ffff88013341d000 ffff88013341d090 ffff8801322d9dc8\n     ffff88013341d208 0000000000000000 0000000000000000 ffffffff811ad232\n    Call Trace:\n     [<ffffffff8123ad65>] ? __pm_runtime_set_status+0x162/0x186\n     [<ffffffff811ad232>] ? local_pci_probe+0x49/0x92\n     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b\n     [<ffffffff8105afc5>] ? do_work_for_cpu+0x0/0x1b\n     [<ffffffff8105afd0>] ? do_work_for_cpu+0xb/0x1b\n     [<ffffffff8105fd3f>] ? kthread+0x7a/0x82\n     [<ffffffff8100a824>] ? kernel_thread_helper+0x4/0x10\n     [<ffffffff8105fcc5>] ? kthread+0x0/0x82\n     [<ffffffff8100a820>] ? kernel_thread_helper+0x0/0x10\n    Code: f4 01 00 00 ef 31 f6 48 89 df e8 29 dd ff ff 85 c0 0f 88 2b 03 00 00 48 89 ef e8 b4 39 c3 e0 8b 7b 40 e8 fc 9d b1 e0 48 8b 43 38 <66> 8b 10 66 89 14 24 8b 43 14 83 e8 03 83 f8 01 77 32 31 d2 be\n    RIP  [<ffffffffa0578402>] azx_probe+0x3ad/0x86b [snd_hda_intel]\n     RSP <ffff88013153fe50>\n    CR2: ffffc90011c08000\n    ---[ end trace 8d1f3ebc136437fd ]---\n\nTrusting the ACPI _CRS information (`pci=use_crs`) fixes this problem.\n\n    $ dmesg | grep -i crs # with the quirk\n    PCI: Using host bridge windows from ACPI; if necessary, use \"pci=nocrs\" and report a bug\n\nThe match has to be against the DMI board entries though since the vendor entries are not populated.\n\n    DMI: System manufacturer System Product Name/M2V-MX SE, BIOS 0304    10/30/2007\n\nThis quirk should be removed when `pci=use_crs` is enabled for machines\nfrom 2006 or earlier or some other solution is implemented.\n\nUsing coreboot [1] with this board the problem does not exist but this\nquirk also does not affect it either. To be safe though the check is\ntightened to only take effect when the BIOS from American Megatrends is\nused.\n\n        15:13 < ruik> but coreboot does not need that\n        15:13 < ruik> because i have there only one root bus\n        15:13 < ruik> the audio is behind a bridge\n\n        $ sudo dmidecode\n        BIOS Information\n                Vendor: American Megatrends Inc.\n                Version: 0304\n                Release Date: 10/30/2007\n\n[1] http://www.coreboot.org/\n\nBugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=30552\n\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Ingo Molnar <mingo@redhat.com>\nCc: H. Peter Anvin <hpa@zytor.com>\nCc: x86@kernel.org\nSigned-off-by: Paul Menzel <paulepanter@users.sourceforge.net>\nSigned-off-by: Bjorn Helgaas <bhelgaas@google.com>\nAcked-by: Jesse Barnes <jbarnes@virtuousgeek.org>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Paul Menzel"],["afcb5001fe569ced2da2048fcbdef9db3cb785f4","roland@purestorage.com","qla2xxx: Fix crash in qla2x00_abort_all_cmds() on unload\n\ncommit 9bfacd01dc9b7519e1e6da12b01963550b9d09a2 upstream.\n\nI hit a crash in qla2x00_abort_all_cmds() if the qla2xxx module is\nunloaded right after it is loaded.  I debugged this down to the abort\nhandling improperly treating a command of type SRB_ADISC_CMD as if it\nhad a bsg_job to complete when that command actually uses the iocb_cmd\npart of the union.  (I guess to hit this one has to unload the module\nwhile the async FC initialization is still in progress)\n\nIt seems we should only look for a bsg_job if type is SRB_ELS_CMD_RPT,\nSRB_ELS_CMD_HST or SRB_CT_CMD, so switch the test to make that explicit.\n\nSigned-off-by: Roland Dreier <roland@purestorage.com>\nAcked-by: Chad Dupuis <chad.dupuis@qlogic.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Roland Dreier"],["57fb87f0a640cd7b2e7cde21fd7c13138f8ef75b","mark_salyzyn@us.xyratex.com","libsas: fix panic when single phy is disabled on a wide port\n\ncommit a73914c35b05d80f8ce78288e10056c91090b666 upstream.\n\nWhen a wide port is being utilized to a target, if one disables only one\nof the\nphys, we get an OS crash:\n\nBUG: unable to handle kernel NULL pointer dereference at\n0000000000000238\nIP: [<ffffffff814ca9b1>] mutex_lock+0x21/0x50\nPGD 4103f5067 PUD 41dba9067 PMD 0\nOops: 0002 [#1] SMP\nlast sysfs file: /sys/bus/pci/slots/5/address\nCPU 0\nModules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4\nipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl\nauth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt\nllc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom\ndm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt\niTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3\njbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix\nlibsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]\n\nModules linked in: pm8001(U) ses enclosure fuse nfsd exportfs autofs4\nipmi_devintf ipmi_si ipmi_msghandler nfs lockd fscache nfs_acl\nauth_rpcgss 8021q fcoe libfcoe garp libfc scsi_transport_fc stp scsi_tgt\nllc sunrpc cpufreq_ondemand acpi_cpufreq freq_table ipv6 sr_mod cdrom\ndm_mirror dm_region_hash dm_log uinput sg i2c_i801 i2c_core iTCO_wdt\niTCO_vendor_support e1000e mlx4_ib ib_mad ib_core mlx4_en mlx4_core ext3\njbd mbcache sd_mod crc_t10dif usb_storage ata_generic pata_acpi ata_piix\nlibsas(U) scsi_transport_sas dm_mod [last unloaded: pm8001]\nPid: 5146, comm: scsi_wq_5 Not tainted\n2.6.32-71.29.1.el6.lustre.7.x86_64 #1 Storage Server\nRIP: 0010:[<ffffffff814ca9b1>]  [<ffffffff814ca9b1>]\nmutex_lock+0x21/0x50\nRSP: 0018:ffff8803e4e33d30  EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000238 RCX: 0000000000000000\nRDX: 0000000000000000 RSI: ffff8803e664c800 RDI: 0000000000000238\nRBP: ffff8803e4e33d40 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000\nR13: 0000000000000238 R14: ffff88041acb7200 R15: ffff88041c51ada0\nFS:  0000000000000000(0000) GS:ffff880028200000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b\nCR2: 0000000000000238 CR3: 0000000410143000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nProcess scsi_wq_5 (pid: 5146, threadinfo ffff8803e4e32000, task\nffff8803e4e294a0)\nStack:\n ffff8803e664c800 0000000000000000 ffff8803e4e33d70 ffffffffa001f06e\n<0> ffff8803e4e33d60 ffff88041c51ada0 ffff88041acb7200 ffff88041bc0aa00\n<0> ffff8803e4e33d90 ffffffffa0032b6c 0000000000000014 ffff88041acb7200\nCall Trace:\n [<ffffffffa001f06e>] sas_port_delete_phy+0x2e/0xa0 [scsi_transport_sas]\n [<ffffffffa0032b6c>] sas_unregister_devs_sas_addr+0xac/0xe0 [libsas]\n [<ffffffffa0034914>] sas_ex_revalidate_domain+0x204/0x330 [libsas]\n [<ffffffffa00307f0>] ? sas_revalidate_domain+0x0/0x90 [libsas]\n [<ffffffffa0030855>] sas_revalidate_domain+0x65/0x90 [libsas]\n [<ffffffff8108c7d0>] worker_thread+0x170/0x2a0\n [<ffffffff81091ea0>] ? autoremove_wake_function+0x0/0x40\n [<ffffffff8108c660>] ? worker_thread+0x0/0x2a0\n [<ffffffff81091b36>] kthread+0x96/0xa0\n [<ffffffff810141ca>] child_rip+0xa/0x20\n [<ffffffff81091aa0>] ? kthread+0x0/0xa0\n [<ffffffff810141c0>] ? child_rip+0x0/0x20\nCode: ff ff 85 c0 75 ed eb d6 66 90 55 48 89 e5 48 83 ec 10 48 89 1c 24\n4c 89 64 24 08 0f 1f 44 00 00 48 89 fb e8 92 f4 ff ff 48 89 df <f0> ff\n0f 79 05 e8 25 00 00 00 65 48 8b 04 25 08 cc 00 00 48 2d\nRIP  [<ffffffff814ca9b1>] mutex_lock+0x21/0x50\n RSP <ffff8803e4e33d30>\nCR2: 0000000000000238\n\nThe following patch is admittedly a band-aid, and does not solve the\nroot cause, but it still is a good candidate for hardening as a pointer\ncheck before reference.\n\nSigned-off-by: Mark Salyzyn <mark_salyzyn@us.xyratex.com>\nTested-by: Jack Wang <jack_wang@usish.com>\nSigned-off-by: James Bottomley <JBottomley@Parallels.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Mark Salyzyn"],["7f3b5ef8184a929f56293d6c7a88f426c7b74558","neilb@suse.de","md: Avoid waking up a thread after it has been freed.\n\ncommit 01f96c0a9922cd9919baf9d16febdf7016177a12 upstream.\n\nTwo related problems:\n\n1/ some error paths call \"md_unregister_thread(mddev->thread)\"\n   without subsequently clearing ->thread.  A subsequent call\n   to mddev_unlock will try to wake the thread, and crash.\n\n2/ Most calls to md_wakeup_thread are protected against the thread\n   disappeared either by:\n      - holding the ->mutex\n      - having an active request, so something else must be keeping\n        the array active.\n   However mddev_unlock calls md_wakeup_thread after dropping the\n   mutex and without any certainty of an active request, so the\n   ->thread could theoretically disappear.\n   So we need a spinlock to provide some protections.\n\nSo change md_unregister_thread to take a pointer to the thread\npointer, and ensure that it always does the required locking, and\nclears the pointer properly.\n\nReported-by: \"Moshe Melnikov\" <moshe@zadarastorage.com>\nSigned-off-by: NeilBrown <neilb@suse.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","NeilBrown"],["25dd1546f84a5d5bf85686e36b6d5fb8a4cbcca3","snitzer@redhat.com","dm table: avoid crash if integrity profile changes\n\ncommit 876fbba1db4a377f050a2bb49b474c7527b2995d upstream.\n\nCommit a63a5cf (dm: improve block integrity support) introduced a\ntwo-phase initialization of a DM device's integrity profile.  This\npatch avoids dereferencing a NULL 'template_disk' pointer in\nblk_integrity_register() if there is an integrity profile mismatch in\ndm_table_set_integrity().\n\nThis can occur if the integrity profiles for stacked devices in a DM\ntable are changed between the call to dm_table_prealloc_integrity() and\ndm_table_set_integrity().\n\nReported-by: Zdenek Kabelac <zkabelac@redhat.com>\nSigned-off-by: Mike Snitzer <snitzer@redhat.com>\nSigned-off-by: Alasdair G Kergon <agk@redhat.com>\nSigned-off-by: Greg Kroah-Hartman <gregkh@suse.de>","Mike Snitzer"]],"ref":"refs/heads/linux-3.0.y-thinkpad"}}