1. 03 Aug, 2013 3 commits
  2. 01 Aug, 2013 2 commits
    • Steven Rostedt (Red Hat)'s avatar
      tracing/uprobes: Fail to unregister if probe event files are in use · c6c2401d
      Steven Rostedt (Red Hat) authored
      Uprobes suffer the same problem that kprobes have. There's a race between
      writing to the "enable" file and removing the probe. The probe checks for
      it being in use and if it is not, goes about deleting the probe and the
      event that represents it. But the problem with that is, after it checks
      if it is in use it can be enabled, and the deletion of the event (access
      to the probe) will fail, as it is in use. But the uprobe will still be
      deleted. This is a problem as the event can reference the uprobe that
      was deleted.
      
      The fix is to remove the event first, and check to make sure the event
      removal succeeds. Then it is safe to remove the probe.
      
      When the event exists, either ftrace or perf can enable the probe and
      prevent the event from being removed.
      
      Link: http://lkml.kernel.org/r/20130704034038.991525256@goodmis.org
      
      Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      c6c2401d
    • Steven Rostedt (Red Hat)'s avatar
      tracing/kprobes: Fail to unregister if probe event files are in use · 40c32592
      Steven Rostedt (Red Hat) authored
      When a probe is being removed, it cleans up the event files that correspond
      to the probe. But there is a race between writing to one of these files
      and deleting the probe. This is especially true for the "enable" file.
      
      	CPU 0				CPU 1
      	-----				-----
      
      				  fd = open("enable",O_WRONLY);
      
        probes_open()
        release_all_trace_probes()
        unregister_trace_probe()
        if (trace_probe_is_enabled(tp))
      	return -EBUSY
      
      				   write(fd, "1", 1)
      				   __ftrace_set_clr_event()
      				   call->class->reg()
      				    (kprobe_register)
      				     enable_trace_probe(tp)
      
        __unregister_trace_probe(tp);
        list_del(&tp->list)
        unregister_probe_event(tp) <-- fails!
        free_trace_probe(tp)
      
      				   write(fd, "0", 1)
      				   __ftrace_set_clr_event()
      				   call->class->unreg
      				    (kprobe_register)
      				    disable_trace_probe(tp) <-- BOOM!
      
      A test program was written that used two threads to simulate the
      above scenario adding a nanosleep() interval to change the timings
      and after several thousand runs, it was able to trigger this bug
      and crash:
      
      BUG: unable to handle kernel paging request at 00000005000000f9
      IP: [<ffffffff810dee70>] probes_open+0x3b/0xa7
      PGD 7808a067 PUD 0
      Oops: 0000 [#1] PREEMPT SMP
      Dumping ftrace buffer:
      ---------------------------------
      Modules linked in: ipt_MASQUERADE sunrpc ip6t_REJECT nf_conntrack_ipv6
      CPU: 1 PID: 2070 Comm: test-kprobe-rem Not tainted 3.11.0-rc3-test+ #47
      Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
      task: ffff880077756440 ti: ffff880076e52000 task.ti: ffff880076e52000
      RIP: 0010:[<ffffffff810dee70>]  [<ffffffff810dee70>] probes_open+0x3b/0xa7
      RSP: 0018:ffff880076e53c38  EFLAGS: 00010203
      RAX: 0000000500000001 RBX: ffff88007844f440 RCX: 0000000000000003
      RDX: 0000000000000003 RSI: 0000000000000003 RDI: ffff880076e52000
      RBP: ffff880076e53c58 R08: ffff880076e53bd8 R09: 0000000000000000
      R10: ffff880077756440 R11: 0000000000000006 R12: ffffffff810dee35
      R13: ffff880079250418 R14: 0000000000000000 R15: ffff88007844f450
      FS:  00007f87a276f700(0000) GS:ffff88007d480000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      CR2: 00000005000000f9 CR3: 0000000077262000 CR4: 00000000000007e0
      Stack:
       ffff880076e53c58 ffffffff81219ea0 ffff88007844f440 ffffffff810dee35
       ffff880076e53ca8 ffffffff81130f78 ffff8800772986c0 ffff8800796f93a0
       ffffffff81d1b5d8 ffff880076e53e04 0000000000000000 ffff88007844f440
      Call Trace:
       [<ffffffff81219ea0>] ? security_file_open+0x2c/0x30
       [<ffffffff810dee35>] ? unregister_trace_probe+0x4b/0x4b
       [<ffffffff81130f78>] do_dentry_open+0x162/0x226
       [<ffffffff81131186>] finish_open+0x46/0x54
       [<ffffffff8113f30b>] do_last+0x7f6/0x996
       [<ffffffff8113cc6f>] ? inode_permission+0x42/0x44
       [<ffffffff8113f6dd>] path_openat+0x232/0x496
       [<ffffffff8113fc30>] do_filp_open+0x3a/0x8a
       [<ffffffff8114ab32>] ? __alloc_fd+0x168/0x17a
       [<ffffffff81131f4e>] do_sys_open+0x70/0x102
       [<ffffffff8108f06e>] ? trace_hardirqs_on_caller+0x160/0x197
       [<ffffffff81131ffe>] SyS_open+0x1e/0x20
       [<ffffffff81522742>] system_call_fastpath+0x16/0x1b
      Code: e5 41 54 53 48 89 f3 48 83 ec 10 48 23 56 78 48 39 c2 75 6c 31 f6 48 c7
      RIP  [<ffffffff810dee70>] probes_open+0x3b/0xa7
       RSP <ffff880076e53c38>
      CR2: 00000005000000f9
      ---[ end trace 35f17d68fc569897 ]---
      
      The unregister_trace_probe() must be done first, and if it fails it must
      fail the removal of the kprobe.
      
      Several changes have already been made by Oleg Nesterov and Masami Hiramatsu
      to allow moving the unregister_probe_event() before the removal of
      the probe and exit the function if it fails. This prevents the tp
      structure from being used after it is freed.
      
      Link: http://lkml.kernel.org/r/20130704034038.819592356@goodmis.org
      
      Acked-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      40c32592
  3. 31 Jul, 2013 4 commits
    • Steven Rostedt (Red Hat)'s avatar
      tracing: Add comment to describe special break case in probe_remove_event_call() · 2ba64035
      Steven Rostedt (Red Hat) authored
      
      
      The "break" used in the do_for_each_event_file() is used as an optimization
      as the loop is really a double loop. The loop searches all event files
      for each trace_array. There's only one matching event file per trace_array
      and after we find the event file for the trace_array, the break is used
      to jump to the next trace_array and start the search there.
      
      As this is not a standard way of using "break" in C code, it requires
      a comment right before the break to let people know what is going on.
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      2ba64035
    • Oleg Nesterov's avatar
      tracing: trace_remove_event_call() should fail if call/file is in use · 2816c551
      Oleg Nesterov authored
      Change trace_remove_event_call(call) to return the error if this
      call is active. This is what the callers assume but can't verify
      outside of the tracing locks. Both trace_kprobe.c/trace_uprobe.c
      need the additional changes, unregister_trace_probe() should abort
      if trace_remove_event_call() fails.
      
      The caller is going to free this call/file so we must ensure that
      nobody can use them after trace_remove_event_call() succeeds.
      debugfs should be fine after the previous changes and event_remove()
      does TRACE_REG_UNREGISTER, but still there are 2 reasons why we need
      the additional checks:
      
      - There could be a perf_event(s) attached to this tp_event, so the
        patch checks ->perf_refcount.
      
      - TRACE_REG_UNREGISTER can be suppressed by FTRACE_EVENT_FL_SOFT_MODE,
        so we simply check FTRACE_EVENT_FL_ENABLED protected by event_mutex.
      
      Link: http://lkml.kernel.org/r/20130729175033.GB26284@redhat.com
      
      Reviewed-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      2816c551
    • Oleg Nesterov's avatar
      debugfs: debugfs_remove_recursive() must not rely on list_empty(d_subdirs) · 776164c1
      Oleg Nesterov authored
      debugfs_remove_recursive() is wrong,
      
      1. it wrongly assumes that !list_empty(d_subdirs) means that this
         dir should be removed.
      
         This is not that bad by itself, but:
      
      2. if d_subdirs does not becomes empty after __debugfs_remove()
         it gives up and silently fails, it doesn't even try to remove
         other entries.
      
         However ->d_subdirs can be non-empty because it still has the
         already deleted !debugfs_positive() entries.
      
      3. simple_release_fs() is called even if __debugfs_remove() fails.
      
      Suppose we have
      
      	dir1/
      		dir2/
      			file2
      		file1
      
      and someone opens dir1/dir2/file2.
      
      Now, debugfs_remove_recursive(dir1/dir2) succeeds, and dir1/dir2 goes
      away.
      
      But debugfs_remove_recursive(dir1) silently fails and doesn't remove
      this directory. Because it tries to delete (the already deleted)
      dir1/dir2/file2 again and then fails due to "Avoid infinite loop"
      logic.
      
      Test-case:
      
      	#!/bin/sh
      
      	cd /sys/kernel/debug/tracing
      	echo 'p:probe/sigprocmask sigprocmask' >> kprobe_events
      	sleep 1000 < events/probe/sigprocmask/id &
      	echo -n >| kprobe_events
      
      	[ -d events/probe ] && echo "ERR!! failed to rm probe"
      
      And after that it is not possible to create another probe entry.
      
      With this patch debugfs_remove_recursive() skips !debugfs_positive()
      files although this is not strictly needed. The most important change
      is that it does not try to make ->d_subdirs empty, it simply scans
      the whole list(s) recursively and removes as much as possible.
      
      Link: http://lkml.kernel.org/r/20130726151256.GC19472@redhat.com
      
      Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      776164c1
    • Steven Rostedt (Red Hat)'s avatar
      ftrace: Check module functions being traced on reload · 8c4f3c3f
      Steven Rostedt (Red Hat) authored
      There's been a nasty bug that would show up and not give much info.
      The bug displayed the following warning:
      
       WARNING: at kernel/trace/ftrace.c:1529 __ftrace_hash_rec_update+0x1e3/0x230()
       Pid: 20903, comm: bash Tainted: G           O 3.6.11+ #38405.trunk
       Call Trace:
        [<ffffffff8103e5ff>] warn_slowpath_common+0x7f/0xc0
        [<ffffffff8103e65a>] warn_slowpath_null+0x1a/0x20
        [<ffffffff810c2ee3>] __ftrace_hash_rec_update+0x1e3/0x230
        [<ffffffff810c4f28>] ftrace_hash_move+0x28/0x1d0
        [<ffffffff811401cc>] ? kfree+0x2c/0x110
        [<ffffffff810c68ee>] ftrace_regex_release+0x8e/0x150
        [<ffffffff81149f1e>] __fput+0xae/0x220
        [<ffffffff8114a09e>] ____fput+0xe/0x10
        [<ffffffff8105fa22>] task_work_run+0x72/0x90
        [<ffffffff810028ec>] do_notify_resume+0x6c/0xc0
        [<ffffffff8126596e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
        [<ffffffff815c0f88>] int_signal+0x12/0x17
       ---[ end trace 793179526ee09b2c ]---
      
      It was finally narrowed down to unloading a module that was being traced.
      
      It was actually more than that. When functions are being traced, there's
      a table of all functions that have a ref count of the number of active
      tracers attached to that function. When a function trace callback is
      registered to a function, the function's record ref count is incremented.
      When it is unregistered, the function's record ref count is decremented.
      If an inconsistency is detected (ref count goes below zero) the above
      warning is shown and the function tracing is permanently disabled until
      reboot.
      
      The ftrace callback ops holds a hash of functions that it filters on
      (and/or filters off). If the hash is empty, the default means to filter
      all functions (for the filter_hash) or to disable no functions (for the
      notrace_hash).
      
      When a module is unloaded, it frees the function records that represent
      the module functions. These records exist on their own pages, that is
      function records for one module will not exist on the same page as
      function records for other modules or even the core kernel.
      
      Now when a module unloads, the records that represents its functions are
      freed. When the module is loaded again, the records are recreated with
      a default ref count of zero (unless there's a callback that traces all
      functions, then they will also be traced, and the ref count will be
      incremented).
      
      The problem is that if an ftrace callback hash includes functions of the
      module being unloaded, those hash entries will not be removed. If the
      module is reloaded in the same location, the hash entries still point
      to the functions of the module but the module's ref counts do not reflect
      that.
      
      With the help of Steve and Joern, we found a reproducer:
      
       Using uinput module and uinput_release function.
      
       cd /sys/kernel/debug/tracing
       modprobe uinput
       echo uinput_release > set_ftrace_filter
       echo function > current_tracer
       rmmod uinput
       modprobe uinput
       # check /proc/modules to see if loaded in same addr, otherwise try again
       echo nop > current_tracer
      
       [BOOM]
      
      The above loads the uinput module, which creates a table of functions that
      can be traced within the module.
      
      We add uinput_release to the filter_hash to trace just that function.
      
      Enable function tracincg, which increments the ref count of the record
      associated to uinput_release.
      
      Remove uinput, which frees the records including the one that represents
      uinput_release.
      
      Load the uinput module again (and make sure it's at the same address).
      This recreates the function records all with a ref count of zero,
      including uinput_release.
      
      Disable function tracing, which will decrement the ref count for uinput_release
      which is now zero because of the module removal and reload, and we have
      a mismatch (below zero ref count).
      
      The solution is to check all currently tracing ftrace callbacks to see if any
      are tracing any of the module's functions when a module is loaded (it already does
      that with callbacks that trace all functions). If a callback happens to have
      a module function being traced, it increments that records ref count and starts
      tracing that function.
      
      There may be a strange side effect with this, where tracing module functions
      on unload and then reloading a new module may have that new module's functions
      being traced. This may be something that confuses the user, but it's not
      a big deal. Another approach is to disable all callback hashes on module unload,
      but this leaves some ftrace callbacks that may not be registered, but can
      still have hashes tracing the module's function where ftrace doesn't know about
      it. That situation can cause the same bug. This solution solves that case too.
      Another benefit of this solution, is it is possible to trace a module's
      function on unload and load.
      
      Link: http://lkml.kernel.org/r/20130705142629.GA325@redhat.com
      
      Reported-by: default avatarJörn Engel <joern@logfs.org>
      Reported-by: default avatarDave Jones <davej@redhat.com>
      Reported-by: default avatarSteve Hodgson <steve@purestorage.com>
      Tested-by: default avatarSteve Hodgson <steve@purestorage.com>
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      8c4f3c3f
  4. 30 Jul, 2013 7 commits
  5. 29 Jul, 2013 4 commits
    • Linus Torvalds's avatar
      Linux 3.11-rc3 · 5ae90d8e
      Linus Torvalds authored
      5ae90d8e
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-for-v3.11-2' of... · 76d25a5f
      Linus Torvalds authored
      Merge tag 'pinctrl-for-v3.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
      
      Pull pin control fixes from Linus Walleij:
       - Driver fixes for AM33xx, SIRF and PFC pin controllers
       - Fix a compile warning from the pinctrl single-register driver
       - Fix a little nasty memory leak
      
      * tag 'pinctrl-for-v3.11-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: fix a memleak when freeing maps
        pinctrl: pinctrl-single: fix compile warning when no CONFIG_PM
        pinctrl: sh-pfc: fix SDHI0 VccQ regulator on sh73a0 with DT
        arm/dts: sirf: fix the pingroup name mismatch between drivers and dts
        pinctrl: sirf: add usp0_uart_nostreamctrl pin group for usp-uart without flowctrl
        pinctrl: sirf: fix the pin number and mux bit for usp0
        pinctrl: am33xx dt binding: correct include path
      76d25a5f
    • Linus Torvalds's avatar
      Merge tag 'trace-fixes-3.11-rc2' of... · 6803f37e
      Linus Torvalds authored
      Merge tag 'trace-fixes-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
      
      Pull tracing fixes from Steven Rostedt:
       "Oleg is working on fixing a very tight race between opening a event
        file and deleting that event at the same time (both must be done as
        root).
      
        I also found a bug while testing Oleg's patches which has to do with a
        race with kprobes using the function tracer.
      
        There's also a deadlock fix that was introduced with the previous
        fixes"
      
      * tag 'trace-fixes-3.11-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Remove locking trace_types_lock from tracing_reset_all_online_cpus()
        ftrace: Add check for NULL regs if ops has SAVE_REGS set
        tracing: Kill trace_cpu struct/members
        tracing: Change tracing_fops/snapshot_fops to rely on tracing_get_cpu()
        tracing: Change tracing_entries_fops to rely on tracing_get_cpu()
        tracing: Change tracing_stats_fops to rely on tracing_get_cpu()
        tracing: Change tracing_buffers_fops to rely on tracing_get_cpu()
        tracing: Change tracing_pipe_fops() to rely on tracing_get_cpu()
        tracing: Introduce trace_create_cpu_file() and tracing_get_cpu()
      6803f37e
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 561d9e81
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "This is five bug fixes, two of which fix long standing problems
        causing crashes (sd and mvsas).  The remaining three are hung (isci
        race) or lost (qla2xxx, isci) devices"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        [SCSI] isci: fix breakage caused by >16byte CDB patch
        [SCSI] mvsas: Fix kernel panic on tile due to unaligned data access
        [SCSI] sd: fix crash when UA received on DIF enabled device
        [SCSI] qla2xxx: Properly set the tagging for commands.
        [SCSI] isci: Fix a race condition in the SSP task management path
      561d9e81
  6. 26 Jul, 2013 20 commits
    • Linus Torvalds's avatar
      Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux · 6c504ecf
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "This is just a regular fixes pull apart from the qxl one, it has
        radeon and intel bits in it,
      
        The intel fixes are for a regression with the RC6 fix and a 3.10 hdmi
        regression, whereas radeon is more DPM fixes, a few lockup fixes and
        some rn50/r100 DAC fixes"
      
      * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
        drm/radeon/dpm: fix r600_enable_sclk_control()
        drm/radeon/dpm: implement force performance levels for rv6xx
        drm/radeon/dpm: fix displaygap programming on rv6xx
        drm/radeon/dpm: fix a typo in the rv6xx mclk setup
        drm/i915: initialize gt_lock early with other spin locks
        drm/i915: fix hdmi portclock limits
        drm/radeon: fix combios tables on older cards
        drm/radeon: improve dac adjust heuristics for legacy pdac
        drm/radeon: Another card with wrong primary dac adj
        drm/radeon: fix endian issues with DP handling (v3)
        drm/radeon/vm: only align the pt base to 32k
        drm/radeon: wait for 3D idle before using CP DMA
      6c504ecf
    • Linus Torvalds's avatar
      Merge branch 'qxl-fixes' of git://people.freedesktop.org/~airlied/linux · 2408c2e5
      Linus Torvalds authored
      Pull qxl drm fixes from Dave Airlie:
       "Okay as I warned, the qxl driver was running a bit free and loose with
        its ttm object reservations and the new lockdep enabled reservation
        tracking shone a bright light into it, it also with the new
        reservations mutexes hits a possible deadlock during boot.
      
        The first patch is a real fix to render the console correctly as the
        driver used to just drop irq renderering as too hard, this also fixes
        a sleeping while atomic warning.
      
        The other two patches are the big ugly ones that redo how the driver
        allocates objects and reserves them and makes things all work
        properly, I've tested this in a VM, and compared to the current code
        which hits a lockdep warning and the sleep while atomic warning before
        failing.
      
        So sorry this is coming in late, I should have tested qxl before
        merging the mutex code, but I'd rather just fix qxl with this than
        revert the reservations code at this point"
      
      * 'qxl-fixes' of git://people.freedesktop.org/~airlied/linux:
        qxl: convert qxl driver to proper use for reservations
        qxl: allow creation of pre-pinned objects and use for releases.
        drm/qxl: add delayed fb operations
      2408c2e5
    • Linus Torvalds's avatar
      Merge tag 'pm+acpi-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 0f746650
      Linus Torvalds authored
      Pull ACPI and power management fixes from Rafael Wysocki:
       "These are just two fixes, a revert of the would-be backlight fix that
        didn't work and an intel_pstate fix for two problems related to
        maximum P-state selection.
      
        Specifics:
      
         - Revert of the ACPI video commit that I hoped would help fix
           backlight problems related to Windows 8 compatibility on some
           systems.  Unfortunately, it turned out to cause problems to happen
           too.
      
         - Fix for two problems in intel_pstate, a possible failure to respond
           to a load change on a quiet system and a possible failure to select
           the highest available P-state on some systems.  From Dirk
           Brandewie"
      
      * tag 'pm+acpi-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        Revert "ACPI / video / i915: No ACPI backlight if firmware expects Windows 8"
        cpufreq / intel_pstate: Change to scale off of max P-state
      0f746650
    • Linus Torvalds's avatar
      Merge tag 'arm64-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64 · a9b5f023
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
       - Stack size increased to 16K (similar to other 64-bit architectures)
       - Additional cache flushing for secondary CPUs boot mode
      
      * tag 'arm64-stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
        arm64: Change kernel stack size to 16K
        arm64: Fix definition of arm_pm_restart to match the declaration
        arm64: virt: ensure visibility of __boot_cpu_mode
      a9b5f023
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · fef36a7a
      Linus Torvalds authored
      Pull ARM SoC fixes from Olof Johansson:
       "This is a largeish batch of fixes, mostly because I missed -rc2 due to
        travel/vacation.  So in number these are a bit more than ideal unless
        you amortize them over two -rcs.
      
        Quick breakdown:
         - Defconfig updates
           - Making multi_v7_defconfig useful on more hardware to encourage
             single-image usage
           - Davinci and nomadik updates due to new code merged this merge
             window
         - Fixes for UART on Samsung platforms, both PM and clock-related
         - A handful of warning fixes from defconfig builds, including for
           max8925 backlight and pxamci (both with appropriate acks)
         - Exynos5440 fixes for LPAE configuration, PM
         - ...plus a bunch of other smaller changes all over the place
      
        I expect to switch to regressions-or-severe-bugs-only fixes from here
        on out"
      
      * tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (37 commits)
        mfd: max8925: fix dt code for backlight
        ARM: omap5: Only select errata 798181 if SMP
        ARM: EXYNOS: Update CONFIG_ARCH_NR_GPIO for Exynos
        ARM: EXYNOS: Fix low level debug support
        ARM: SAMSUNG: Save/restore only selected uart's registers
        ARM: SAMSUNG: Add SAMSUNG_PM config option to select pm
        ARM: S3C24XX: Add missing clkdev entries for s3c2440 UART
        ARM: multi_v7_defconfig: Select USB chipidea driver
        ARM: pxa: propagate errors from regulator_enable() to pxamci
        ARM: zynq: fix compilation warning
        ARM: keystone: fix compilation warning
        ARM: highbank: Only touch common coherency control register fields
        ARM: footbridge: fix overlapping PCI mappings
        dmaengine: shdma: fix a build failure on platforms with no DMA support
        ARM: STi: Set correct ARM ERRATAs.
        ARM: dts: STi: Fix pinconf setup for STiH416 serial2
        ARM: nomadik: configure for NO_HZ and HRTIMERS
        ARM: nomadik: update defconfig base
        ARM: nomadik: Update MMC defconfigs
        ARM: davinci: defconfig: enable EDMA driver
        ...
      fef36a7a
    • Linus Torvalds's avatar
      Merge tag 'usb-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · db8cbfad
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a number of USB fixes for 3.11-rc3.
      
        Lots of little things, nothing major.  A number of new device ids,
        build fixes for DMA, and a bunch of other minor things.  All of these
        have been in the linux-next tree"
      
      * tag 'usb-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits)
        usb: Clear both buffers when clearing a control transfer TT buffer.
        usb/gadget: free opts struct on error recovery
        USB: mos7840: fix memory leak in open
        usb: serial: option.c: remove ONDA MT825UP product ID fromdriver
        usb: serial: option: add Olivetti Olicard 200
        usb: serial: option: blacklist ONDA MT689DC QMI interface
        xhci: fix null pointer dereference on ring_doorbell_for_active_rings
        usb: host: xhci: Enable XHCI_SPURIOUS_SUCCESS for all controllers with xhci 1.0
        usb: fix build warning in pci-quirks.h when CONFIG_PCI is not enabled
        usb: xhci: Mark two functions __maybe_unused
        xhci: Avoid NULL pointer deref when host dies.
        usb: serial: option: Add ONYX 3G device support
        USB: ti_usb_3410_5052: fix dynamic-id matching
        usb: option: add TP-LINK MA260
        USB: option: add D-Link DWM-152/C1 and DWM-156/C1
        USB: EHCI: Fix resume signalling on remote wakeup
        USB: cp210x: add MMB and PI ZigBee USB Device Support
        usb: cp210x support SEL C662 Vendor/Device
        USB: option: append Petatel NP10T device to GSM modems list
        USB: misc: Add Manhattan Hi-Speed USB DVI Converter to sisusbvga
        ...
      db8cbfad
    • Linus Torvalds's avatar
      Merge tag 'tty-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · ab20fb81
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are 3 fixes for TTY and serial issues that have been reported.
        Nothing huge, but nice to get fixed"
      
      * tag 'tty-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: tegra: correct help message in Kconfig from 'ttyHS' to 'ttyTHS'
        tty/8250_early: Don't truncate last character of options
        TTY: snyclinkmp: calculating wrong addresses
      ab20fb81
    • Linus Torvalds's avatar
      Merge tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · f19e6c69
      Linus Torvalds authored
      Pull staging fixes from Greg KH:
       "Here are some tiny drivers/staging/ fixes for 3.11-rc3
      
        A number of bugfixes, all pretty tiny, but resolve issues that have
        been reported (the kstrtos32 change fixes a data corruption problem
        that Dan found).  And a MAINTAINERS file update for the comedi
        drivers"
      
      * tag 'staging-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        MAINTAINERS: Update the list of maintainers for staging/comedi driver.
        staging: tidspbridge: replace strict_strtol() with kstrtos32()
        staging: android: logger: Correct write offset reset on error
        staging: zram: protect zram_reset_device() call
        staging: gdm72xx: potential use after free in send_qos_list()
        staging: drm/imx: drop "select OF_VIDEOMODE"
        staging: frontier: use after free in disconnect()
        staging: comedi: fix a race between do_cmd_ioctl() and read/write
        staging: comedi: COMEDI_CANCEL ioctl should wake up read/write
      f19e6c69
    • Linus Torvalds's avatar
      Merge tag 'char-misc-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 05e4cb7c
      Linus Torvalds authored
      Pull char/misc patches from Greg KH:
       "Here are some char/misc patches for 3.11-rc3.  It's pretty much just:
         - mei fixes
         - hyperv fixes
         - new ja_JP translation update
        all tiny stuff, but fixes for issues people have reported."
      
      * tag 'char-misc-3.11-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        HOWTO ja_JP sync
        mei: me: fix waiting for hw ready
        mei: don't have to clean the state on power up
        mei: me: fix reset state machine
        mei: hbm: fix typo in error message
        Tools: hv: KVP: Fix a bug in IPV6 subnet enumeration
        Drivers: hv: balloon: Do not post pressure status if interrupted
        Drivers: hv: balloon: Fix a bug in the hot-add code
        Drivers: hv: vmbus: incorrect device name is printed when child device is unregistered
      05e4cb7c
    • Linus Torvalds's avatar
      Merge tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 8f074a55
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "Just a handful of regression and small fixes in ASoC, HD-audio and
        USB-audio drivers.
      
         - Sigmetal HD-audio codec regression fixes
         - A copule of XRUN indication fixes for usb-audio devices
         - ASoC: ep93xx build fix, sgtl5000 fix for probe order changes,
           max98088 register access fix, etc"
      
      * tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hiface: return correct XRUN indication
        ASoC: tegra: correct playback_dma_data setup
        ASoC: core: double free in snd_soc_add_platform()
        ALSA: usb-audio: 6fire: return correct XRUN indication
        ASoC: ep93xx: fix build of ep93xx-ac97.c
        ALSA: hda - Remove NO_PRESENCE bit override for Dell 1420n Laptop
        ALSA: hda - Fix EAPD GPIO control for Sigmatel codecs
        ASoC: atmel-ssc: remove clk_disable_unprepare call from critical section
        ASoC: sgtl5000: defer the probe if clock is not found
        ASoC: max98088 - fix element type of the register cache.
      8f074a55
    • Linus Torvalds's avatar
      Merge tag 'for-linus-v3.11-rc3' of git://oss.sgi.com/xfs/xfs · 6c4155a9
      Linus Torvalds authored
      Pull xfs fix from Ben Myers:
       "Fix for regression in commit cca9f93a ("xfs: don't do IO when
        creating an new inode"), recovery causing filesystem corruption after
        a crash"
      
      * tag 'for-linus-v3.11-rc3' of git://oss.sgi.com/xfs/xfs:
        xfs: di_flushiter considered harmful
      6c4155a9
    • Linus Torvalds's avatar
      Merge branch 'for-3.11' of git://linux-nfs.org/~bfields/linux · f315cf5e
      Linus Torvalds authored
      Pull nfsd fix from Bruce Fields:
       "One more nfsd bugfix for 3.11"
      
      * 'for-3.11' of git://linux-nfs.org/~bfields/linux:
        nfsd: nfsd_open: when dentry_open returns an error do not propagate as struct file
      f315cf5e
    • Linus Torvalds's avatar
      Merge tag 'md/3.11-fixes' of git://neil.brown.name/md · c271f5bc
      Linus Torvalds authored
      Pull md fixes from Neil Brown:
       "Two more bugfixes for md in 3.11
      
        Both marked for -stable, both since 3.3.  I guess I should spend more
        time testing..."
      
      * tag 'md/3.11-fixes' of git://neil.brown.name/md:
        md/raid5: fix interaction of 'replace' and 'recovery'.
        md/raid10: remove use-after-free bug.
      c271f5bc
    • Linus Torvalds's avatar
      Merge branch 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata · c7dad234
      Linus Torvalds authored
      Pull libata fixes from Tejun Heo:
       "Assorted libata updates.
      
        The most critical one is a fix for ahci oops during boot.  Also, a new
        smallish platform ahci driver is added and sata_inic162x is marked
        clearly as experimental (it whines during boot too) as data corruption
        seems rather common on the device and it's unlikely to get any love in
        the foreseeable future.  If the whining doesn't draw any attention, I
        think we'd probably be better of making the driver depend on BROKEN in
        a couple releases"
      
      This is v2 of this pull request with fixed dependencies for ahci_imx.
      
      * 'for-3.11-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata:
        ahci_imx: depend on CONFIG_MFD_SYSCON
        ahci_imx: add ahci sata support on imx platforms
        ARM: imx6q: update the sata bits definitions of gpr13
        ahci: fix Null pointer dereference in achi_host_active()
        libata: make it clear that sata_inic162x is experimental
        libata: replace strict_strtol() with kstrtol()
        ata: Fix DVD not dectected at some platform with Wellsburg PCH
      c7dad234
    • Rafael J. Wysocki's avatar
      Revert "ACPI / video / i915: No ACPI backlight if firmware expects Windows 8" · 8e5c2b77
      Rafael J. Wysocki authored
      We attempted to address a regression introduced by commit a57f7f91
      (ACPICA: Add Windows8/Server2012 string for _OSI method.) after which
      ACPI video backlight support doesn't work on a number of systems,
      because the relevant AML methods in the ACPI tables in their BIOSes
      become useless after the BIOS has been told that the OS is compatible
      with Windows 8.  That problem is tracked by the bug entry at:
      
      https://bugzilla.kernel.org/show_bug.cgi?id=51231
      
      Commit 8c5bd7ad (ACPI / video / i915: No ACPI backlight if firmware
      expects Windows 8) introduced for this purpose essentially prevented
      the ACPI backlight support from being used if the BIOS had been told
      that the OS was compatible with Windows 8 and the i915 driver was
      loaded, in which case the backlight would always be handled by i915.
      Unfortunately, however, that turned out to cause problems with
      backlight to appear on multiple systems with symptoms indicating that
      i915 was unable to control the backlight on those systems as
      expected.
      
      For this reason, revert commit 8c5bd7ad, but leave the function
      acpi_video_backlight_quirks() introduced by it, because another
      commit on top of it uses that function.
      
      References: https://lkml.org/lkml/2013/7/21/119
      References: https://lkml.org/lkml/2013/7/22/261
      References: https://lkml.org/lkml/2013/7/23/429
      References: https://lkml.org/lkml/2013/7/23/459
      References: https://lkml.org/lkml/2013/7/23/81
      References: https://lkml.org/lkml/2013/7/24/27
      
      Reported-and-tested-by: default avatarJames Hogan <james@albanarts.com>
      Reported-and-tested-by: default avatarKamal Mostafa <kamal@canonical.com>
      Reported-and-tested-by: default avatarJörg Otte <jrg.otte@gmail.com>
      Reported-and-tested-by: default avatarSteven Newbury <steve@snewbury.org.uk>
      Reported-by: default avatarMartin Steigerwald <Martin@lichtvoll.de>
      Reported-by: default avatarKalle Valo <kvalo@adurom.com>
      Tested-by: default avatarJoerg Platte <jplatte@naasa.net>
      Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
      8e5c2b77
    • Tejun Heo's avatar
      ahci_imx: depend on CONFIG_MFD_SYSCON · 867974fc
      Tejun Heo authored
      
      
      ahci_imx makes use of regmap but the dependency wasn't specified in
      Kconfig leading build failures if CONFIG_AHCI_IMX is enabled but
      CONFIG_MFD_SYSCON is not.  Add the Kconfig dependency.
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
      867974fc
    • Steven Rostedt (Red Hat)'s avatar
      tracing: Remove locking trace_types_lock from tracing_reset_all_online_cpus() · 09d8091c
      Steven Rostedt (Red Hat) authored
      Commit a8227415 "tracing: Protect ftrace_trace_arrays list in trace_events.c"
      added taking the trace_types_lock mutex in trace_events.c as there were
      several locations that needed it for protection. Unfortunately, it also
      encapsulated a call to tracing_reset_all_online_cpus() which also takes
      the trace_types_lock, causing a deadlock.
      
      This happens when a module has tracepoints and has been traced. When the
      module is removed, the trace events module notifier will grab the
      trace_types_lock, do a bunch of clean ups, and also clears the buffer
      by calling tracing_reset_all_online_cpus. This doesn't happen often
      which explains why it wasn't caught right away.
      
      Commit a8227415 was marked for stable, which means this must be
      sent to stable too.
      
      Link: http://lkml.kernel.org/r/51EEC646.7070306@broadcom.com
      
      Reported-by: default avatarArend van Spril <arend@broadcom.com>
      Tested-by: default avatarArend van Spriel <arend@broadcom.com>
      Cc: Alexander Z Lam <azl@google.com>
      Cc: Vaibhav Nagarnaik <vnagarnaik@google.com>
      Cc: David Sharp <dhsharp@google.com>
      Cc: stable@vger.kernel.org # 3.10
      Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
      09d8091c
    • Feng Kan's avatar
      arm64: Change kernel stack size to 16K · 845ad05e
      Feng Kan authored
      
      
      Written by Catalin Marinas, tested by APM on storm platform. This is needed
      because of the failures encountered when running SpecWeb benchmark test.
      Signed-off-by: default avatarFeng Kan <fkan@apm.com>
      Acked-by: default avatarKumar Sankaran <ksankaran@apm.com>
      Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      845ad05e
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2013-07-25' of... · bf903e41
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2013-07-25' of git://people.freedesktop.org/~danvet/drm-intel into drm-fixes
      
      Brown-paper-bag pull request here. The snb rc6 fix from the last pull
      broke forcewake BIOS dirt cleanup, which with fixed. But that fix broke
      the spinlock init sequence, which results in an ugly BUG when spinlock
      debugging is enabled :( So I get to throw another patch at cc: stable to
      fix up the mess ...
      
      * tag 'drm-intel-fixes-2013-07-25' of git://people.freedesktop.org/~danvet/drm-intel:
        drm/i915: initialize gt_lock early with other spin locks
        drm/i915: fix hdmi portclock limits
      bf903e41
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 4795b95a
      Dave Airlie authored
      r600 dpm fixes, old school card dac fixes, lockup fixes
      endian fixes
      * 'drm-fixes-3.11' of git://people.freedesktop.org/~agd5f/linux:
        drm/radeon/dpm: fix r600_enable_sclk_control()
        drm/radeon/dpm: implement force performance levels for rv6xx
        drm/radeon/dpm: fix displaygap programming on rv6xx
        drm/radeon/dpm: fix a typo in the rv6xx mclk setup
        drm/radeon: fix combios tables on older cards
        drm/radeon: improve dac adjust heuristics for legacy pdac
        drm/radeon: Another card with wrong primary dac adj
        drm/radeon: fix endian issues with DP handling (v3)
        drm/radeon/vm: only align the pt base to 32k
        drm/radeon: wait for 3D idle before using CP DMA
      4795b95a