There is one nasty scenario when CI13xxx driver fails:
       a) two or more rx requests are queued (g_ether does that)
       b) rx request completed, interrupt fires and ci13xxx dequeues rq
       c) request complete() callback gets called and in turn it calls ep_queue()
               c1) in ep_queue() request gets added to the TAIL of the rx queue list
       d) ep gets primed with rq from (b)
       e) interrupt fires
       f) request gets popped from queue head for hw dequeue
       G) requets from queue head wasn't enqueued
               g1)  isr_tr_complete_low() doesn't
               enqueue more requests and it doesn't prime EP,
               rx traffic stalls

Solution:
       a) enque queued requests ASAP, i.e. before calling complete() callback.
       b) don't HW enqueue and prime endpoint with recently added request and
       use the oldest request in the queue.

Fixed issues:
       a) ep_queue() may return an error code despite request was successfully
       added to the queue (if _hardware_enqueue() fails)
       b) Added requests are always processed in LIFO order, even if they are
       added in complete() callback
       c) Finally more than two and more queued requests are processed consistently,
       even if they were added in complete() callback

The fix was successfully tested on MIPS based SoC with 4KEc CPU core and
CI13612 USB core. Board successfully boots with NFS root using g_ether
on ci13xxx udc.
Signed-off-by: Artem Leonenko <tikkeri@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Built-in gadget drivers have NULL-ifed unbind() function. Checking
whether unbind() is NULL will never let any compiled into kernel
driver attach.
Signed-off-by: Artem Leonenko <tikkeri@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

* usb-next: (132 commits)
  USB: uas: Use GFP_NOIO instead of GFP_KERNEL in I/O submission path
  USB: uas: Ensure we only bind to a UAS interface
  USB: uas: Rename sense pipe and sense urb to status pipe and status urb
  USB: uas: Use kzalloc instead of kmalloc
  USB: uas: Fix up the Sense IU
  usb: musb: core: kill unneeded #include's
  DA8xx: assign name to MUSB IRQ resource
  usb: gadget: g_ncm added
  usb: gadget: f_ncm.c added
  usb: gadget: u_ether: prepare for NCM
  usb: pch_udc: Fix setup transfers with data out
  usb: pch_udc: Fix compile error, warnings and checkpatch warnings
  usb: add ab8500 usb transceiver driver
  USB: gadget: Implement runtime PM for MSM bus glue driver
  USB: gadget: Implement runtime PM for ci13xxx gadget
  USB: gadget: Add USB controller driver for MSM SoC
  USB: gadget: Introduce ci13xxx_udc_driver struct
  USB: gadget: Initialize ci13xxx gadget device's coherent DMA mask
  USB: gadget: Fix "scheduling while atomic" bugs in ci13xxx_udc
  USB: gadget: Separate out PCI bus code from ci13xxx_udc
  ...

This reverts commit 32d5dc95.

Needed to properly merge the musb changes that are in the
usb-next branch into Linus's tree.
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This reverts commit 1e393c6e.

Needed to properly merge the musb changes that are in the
usb-next branch into Linus's tree.
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: ghash-intel - ghash-clmulni-intel_glue needs err.h

If swap is on a UAS device, we could recurse into the driver by using
GFP_KERNEL.  Using GFP_NOIO ensures we won't.
Reported-by: James Bottomley <James.Bottomley@suse.de>
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

While all existing UAS devices use alternate interface 1, this is not
guaranteed, and it has caused confusion with people trying to bind the
uas driver to non-uas devices.
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The spec calls this the status pipe.  While it is used to receive sense IUs,
it is also used to receive other IUs, so this can be confusing.
Reported-by: Luben Tuikov <ltuikov@yahoo.com>
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

The IUs are not being fully initialised by the driver (due to the reserved
space).  Since we should be zeroing reserved fields, use kzalloc to do
it for us.
Reported-by: Luben Tuikov <ltuikov@yahoo.com>
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Add a comment to the Sense IU data structure that it's also used for Read
Ready and Write Ready.  Remove the 'service response' element since it's
gone from the current draft (04).
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix typo which broke '..' detection in ext4_find_entry()
  ext4: Turn off multiple page-io submission by default

Without this, gcc 4.5 won't compile xen-netfront and xen-blkfront, where
this is being used to specify array sizes.
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: David Miller <davem@davemloft.net>
Cc: Stable Kernel <stable@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The MSM main git tree has changed over to this new address.
Signed-off-by: Daniel Walker <dwalker@codeaurora.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The install_special_mapping routine (used, for example, to setup the
vdso) skips the security check before insert_vm_struct, allowing a local
attacker to bypass the mmap_min_addr security restriction by limiting
the available pages for special mappings.

bprm_mm_init() also skips the check, and although I don't think this can
be used to bypass any restrictions, I don't see any reason not to have
the security check.

  $ uname -m
  x86_64
  $ cat /proc/sys/vm/mmap_min_addr
  65536
  $ cat install_special_mapping.s
  section .bss
      resb BSS_SIZE
  section .text
      global _start
      _start:
          mov     eax, __NR_pause
          int     0x80
  $ nasm -D__NR_pause=29 -DBSS_SIZE=0xfffed000 -f elf -o install_special_mapping.o install_special_mapping.s
  $ ld -m elf_i386 -Ttext=0x10000 -Tbss=0x11000 -o install_special_mapping install_special_mapping.o
  $ ./install_special_mapping &
  [1] 14303
  $ cat /proc/14303/maps
  0000f000-00010000 r-xp 00000000 00:00 0                                  [vdso]
  00010000-00011000 r-xp 00001000 00:19 2453665                            /home/taviso/install_special_mapping
  00011000-ffffe000 rwxp 00000000 00:00 0                                  [stack]

It's worth noting that Red Hat are shipping with mmap_min_addr set to
4096.
Signed-off-by: Tavis Ormandy <taviso@google.com>
Acked-by: Kees Cook <kees@ubuntu.com>
Acked-by: Robert Swiecki <swiecki@google.com>
[ Changed to not drop the error code - akpm ]
Reviewed-by: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'musb-hw' of git://gitorious.org/usb/usb: (43 commits)
  usb: musb: core: kill unneeded #include's
  DA8xx: assign name to MUSB IRQ resource
  arm: OMAP4430: musb: Configure musb to OTG mode
  usb: musb: Adding musb support for OMAP4430
  usb: otg: TWL6030: Add twl6030_usb file for compilation
  mfd: TWL6030: OMAP4: Registering the TWL6030-usb device
  usb: musb: TWL6030: Selecting TWL6030_USB transceiver
  usb: otg: Kconfig: Add Kconfig option for TWL6030 transceiver.
  usb: otg: Adding twl6030-usb transceiver driver for OMAP4430
  mfd: TWL6030: USBOTG VBUS event generation on
  usb: musb: add support for ux500 platform
  musb: am35x: fix compile error due to control apis
  arm: omap4: enable usb on 4430sdp
  usb: musb: drop board_set_vbus
  usb: musb: drop musb_platform_suspend/resume
  usb: musb: blackfin: usb dev_pm_ops structure
  usb: musb: am35x: usb dev_pm_ops structure
  usb: musb: omap2430: use dev_pm_ops structure
  usb: musb: omap2430: drop the nops
  usb: musb: mark musb_save/restore_context static
  ...

Add missing header file:

arch/x86/crypto/ghash-clmulni-intel_glue.c:256: error: implicit declaration of function 'IS_ERR'
arch/x86/crypto/ghash-clmulni-intel_glue.c:257: error: implicit declaration of function 'PTR_ERR'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: It is likely that WORKER_NOT_RUNNING is true
  MAINTAINERS: Add workqueue entry
  workqueue: check the allocation of system_unbound_wq

* 'for-linus' of git://neil.brown.name/md:
  md: protect against NULL reference when waiting to start a raid10.
  md: fix bug with re-adding of partially recovered device.
  md: fix possible deadlock in handling flush requests.
  md: move code in to submit_flushes.
  md: remove handling of flush_pending in md_submit_flush_data

There is a possibility that the last word of a transaction will be lost
if data is not ready.  Re-read in poll_transfer() to solve this issue
when poll_mode is enabled.

Verified on SPI touch screen device.
Signed-off-by: Major Lee <major_lee@wistron.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This gets caught by the new sanity check code. Instead of the slash use a
different symbol. This was originally found by Major Lee who proposed a
rather more complex patch which changed the name according to the chip
type.

On the basis that we are in a late -rc and making Linus grumpy isn't always
a good idea (however fun) this is a simple alternative.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There should be a check for the NUL character instead of '0'.

Fortunately the only thing that cares about this is NFS serving, which
is why we didn't notice this in the merge window testing.
Reported-by: Phil Carmody <ext-phil.2.carmody@nokia.com>
Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

* 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: wire up accept4 syscall (non-multiplexed path)
  sh: Enable deprecated IRQ chip APIs for MFD and GPIOLIB drivers.

Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
  OMAP2: PRCM: fix some SHIFT macros that were actually bitmasks
  OMAP2+: PM/serial: fix console semaphore acquire during suspend
  OMAP1: SRAM: fix size for OMAP1611 SoCs
  arm: omap2: io: fix clk_get() error check
  arm: plat-omap: counter_32k: use IS_ERR() instead of NULL check
  omap: nand: remove hardware ECC as default
  omap: zoom: wl1271 slot is MMC_CAP_POWER_OFF_CARD
  omap: PM debug: fix wake-on-timer debugfs dependency

* master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 6535/1: V6 MPCore v6_dma_inv_range and v6_dma_flush_range RWFO fix
  ARM: 6534/1: Make CONFIG_FPE_NWFPE depend on !CONFIG_THUMB2_KERNEL
  ARM: 6533/1: Thumb-2: Make CONFIG_THUMB2_KERNEL depend on !CPU_V6
  Change bcmring Maintainer list.
  ARM: Update mach-types
  ARM: 6528/1: Use CTR for the I-cache line size on ARMv7
  ARM: 6527/1: Use CTR instead of CCSIDR for the D-cache line size on ARMv7
  ARM: pxa/palm: fix ifdef around gen_nand driver registration
  ARM: pxa: fix pxa2xx-flash section mismatch
  ARM: mmp2: remove not used clk_rtc

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc: Write to prom console using indirect buffer.
  sparc: Delete prom_*getchar().
  sparc: Pass buffer pointer all the way down to prom_{get,put}char().
  sparc: Do not export prom_nb{get,put}char().
  sparc64: Delete prom_setcallback().
  sparc64: Unexport prom_service_exists().
  sparc: Kill prom devops_{32,64}.c
  sparc: Remove prom_pathtoinode()
  sparc64: Delete prom_puts() unused.
  SPARC/LEON: removed constant timer initialization as if HZ=100, now it reflects the value of HZ

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (75 commits)
  pppoe.c: Fix kernel panic caused by __pppoe_xmit
  WAN: Fix a TX IRQ causing BUG() in PC300 and PCI200SYN drivers.
  bnx2x: Advance a version number to 1.60.01-0
  bnx2x: Fixed a compilation warning
  bnx2x: LSO code was broken on BE platforms
  qlge: Fix deadlock when cancelling worker.
  net: fix skb_defer_rx_timestamp()
  cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes
  phy: add the IC+ IP1001 driver
  atm: correct sysfs 'device' link creation and parent relationships
  MAINTAINERS: remove me from tulip
  SCTP: Fix SCTP_SET_PEER_PRIMARY_ADDR to accpet v4mapped address
  enic: Bug Fix: Pass napi reference to the isr that services receive queue
  ipv6: fix nl group when advertising a new link
  connector: add module alias
  net: Document the kernel_recvmsg() function
  r8169: Fix runtime power management
  hso: IP checksuming doesn't work on GE0301 option cards
  xfrm: Fix xfrm_state_migrate leak
  net: Convert netpoll blocking api in bonding driver to be a counter
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
  [SCSI] hpsa: fix redefinition of PCI_DEVICE_ID_CISSF
  [SCSI] qla2xxx: Update version number to 8.03.05-k0.
  [SCSI] qla2xxx: Properly set the return value in qla2xxx_eh_abort function.
  [SCSI] qla2xxx: Correct issue where NPIV-config data was not being allocated for 82xx parts.
  [SCSI] qla2xxx: Change MSI initialization from using incorrect request_irq parameter.
  [SCSI] qla2xxx: Populate Command Type 6 LUN field properly.
  [SCSI] zfcp: Issue FCP command without holding SCSI host_lock
  [SCSI] zfcp: Prevent usage w/o holding a reference
  [SCSI] zfcp: No ERP escalation on gpn_ft eval
  [SCSI] zfcp: Correct false abort data assignment.
  [SCSI] zfcp: Fix common FCP request reception
  [SCSI] Eliminate error handler overload of the SCSI serial number
  [SCSI] pmcraid: disable msix and expand device config entry
  [SCSI] bsg: correct fault if queue object removed while dev_t open
  [SCSI] osd: checking NULL instead of ERR_PTR()

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jwessel/linux-2.6-kgdb:
  kgdboc,input: Fix regression with keyboard release key and early debugging

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
  ACPI / PM: Do not save/restore NVS on Sony Vaio VGN-NW130D
  ACPI/HEST: adjust section selection
  ACPI: eliminate unused variable warning for !ACPI_SLEEP
  ACPI/PNP: avoid section mismatch warning
  ACPI thermal: remove two unused functions
  ACPI: fix a section mismatch
  ACPI, APEI, use raw spinlock in ERST
  ACPI: video: fix build for CONFIG_ACPI=n
  ACPI: video: fix build for VIDEO_OUTPUT_CONTROL=n
  ACPI: fix allowing to add/remove multiple _OSI strings
  acpi: fix _OSI string setup regression
  ACPI: EC: Add another dmi match entry for MSI hardware
  ACPI battery: update status upon sysfs query
  ACPI ac: update AC status upon sysfs query
  ACPI / PM: Do not refcount power resources that can't be turned on
  ACPI / PM: Check device state before refcounting power resources

* 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6:
  intel_idle: recognize ARAT on WSM-EX

Cache ownership must be acquired by reading/writing data from the
cache line to make cache operation have the desired effect on the
SMP MPCore CPU. However, the ownership is never acquired in the
v6_dma_inv_range function when cleaning the first line and
flushing the last one, in case the address is not aligned
to D_CACHE_LINE_SIZE boundary.
Fix this by reading/writing data if needed, before performing
cache operations.
While at it, fix v6_dma_flush_range to prevent RWFO outside
the buffer.

Cc: stable@kernel.org
Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
Signed-off-by: George G. Davis <gdavis@mvista.com>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Because the nwfpe support is unlikely to be used on new platforms
and requires CONFIG_OABI_COMPAT, which is not generally used with
ARMv7+, we shouldn't expect to build nwfpe support into a Thumb-2
kernel.

At present, nwfpe contains assembly code which isn't Thumb-2
compatible, and for now it doesn't appear useful to port this
code.

All ARMv7-A/R platforms necessarily have VFPv3 hardware floating-
point natively, making emulation unnecessary.
Signed-off-by: Dave Martin <dave.martin@linaro.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This makes sense, because Thumb-2 code can't execute on plain
ARMv6 processors.

This will avoid accidentally configuring a broken kernel where the
config otherwise would allow multiple architecture versions to
coexist in the same kernel.

Not adding !CPU_V5 etc., because the chance of anyone trying to
put v5 and v7 in the same kernel is low, and I'm not aware of
any mach which can do this.  These could be added later if it
matters.

Note that the rules may need to be refined if support for the
ARM1156J(F)-S processor is later added to the kernel, since this
processor supports the rare ARMv6T2 extensions, which add support
for Thumb-2 and a few other ARMv7 features.
Signed-off-by: Dave Martin <dave.martin@linaro.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org>
Acked-by: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

I am Jiandong Zheng working on BCMRING in Broadcom Canada Ltd. I am
replacing Leo Chen (leochen@broadcom.com) as "ARM/BCMRING ARM
ARCHITECTURE" and "ARM/BCMRING MTD NAND DRIVER" maintainer from
Broadcom as he is no longer the maintainer of these components.
Signed-off-by: Jiandong Zheng <jdzheng@broadcom.com>
Acked-by: Scott Branden <sbranden@broadcom.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Merge branch 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6

* 'fbdev-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  fbdev: Fix fb_find_nearest_mode refresh comparison

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging:
  hwmon: (ltc4215) make sysfs file match the alarm cause

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx:
  dmaengine: at_hdmac: fix buffer transfer size specification
  fsldma: fix issue of slow dma
  dmaengine i.MX SDMA: initialize on module_init
  dma : EG20T PCH: Fix miss-setting DMA descriptor
  intel_mid_dma: fix section mismatch warnings
  dmaengine: imx-sdma: fix bug in buffer descriptor initialization
  drivers/dma/ppc4xx: Use printf extension %pR for struct resource
  drivers/dma/ioat: Use the ccflag-y instead of EXTRA_CFLAGS
  drivers/dma/: Use the ccflag-y instead of EXTRA_CFLAGS
  dma: intel_mid_dma: fix double free on mid_setup_dma error path
  dma: imx-dma: fix imxdma_probe error path

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/uverbs: Handle large number of entries in poll CQ