commit 9ddabb6700f82a033a76bcf7a547204fa12aaa17 Merge: bf0c346 3ce2f76 Author: Linus Torvalds Date: Fri Jan 15 14:53:24 2010 -0800 Merge branch 'for-linus/samsung' of git://git.fluff.org/bjdooks/linux * 'for-linus/samsung' of git://git.fluff.org/bjdooks/linux: ARM: MINI2440: Fixup __initdata usage ARM: MINI2440: Fix crash on boot due to improper __initdata qualifier ARM: SMDK6410: Specify no GPIO for B_PWR_5V regulator ARM: S3C: NAND: Check the existence of nr_map before copying commit bf0c346b3fbfb7315c5773767f3c7210fdeacce0 Merge: 3b3ef30 926311f Author: Linus Torvalds Date: Fri Jan 15 14:52:44 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: Ensure index stays within bounds in amd64_get_scrub_rate commit 3b3ef30833cc85982b0b7e950998d86f5e2d28cf Merge: 9fc8191 c332e9f Author: Linus Torvalds Date: Fri Jan 15 14:51:57 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: sentelic - fix left/right horizontal scroll mapping Input: pmouse - move Sentelic probe down the list Input: add compat support for sysfs and /proc capabilities output Input: i8042 - add Dritek quirk for Acer Aspire 5610. Input: xbox - do not use GFP_KERNEL under spinlock Input: psmouse - fix Synaptics detection when protocol is disabled Input: bcm5974 - report ABS_MT events Input: davinci_keyscan - add device_enable method to platform data Input: evdev - be less aggressive about sending SIGIO notifies Input: atkbd - fix canceling event_work in disconnect Input: serio - fix potential deadlock when unbinding drivers Input: gf2k - fix &&/|| confusion in gf2k_connect() commit 9fc819172aa565c7be51f758b7e85301c9df7c70 Merge: 933a42b 44c36ae Author: Linus Torvalds Date: Fri Jan 15 14:51:39 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6: alpha: cpumask_of_node() should handle -1 as a node alpha: add myself as a maintainer, and drop mention of 2.4 commit 933a42b1842d0b7bc7e4e16f2f5f1099e72870d4 Merge: 976ae32 75136d4 Author: Linus Torvalds Date: Fri Jan 15 14:50:20 2010 -0800 Merge branch 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: serial: sh-sci: using correct fifo size for SCIF and SCIFA ports. sh: mach-ecovec24: Add motion sensor driver support. commit 976ae32be45a736acd49215a7e4771ff91f161c3 Author: Eric Paris Date: Fri Jan 15 12:12:25 2010 -0500 inotify: only warn once for inotify problems inotify will WARN() if it finds that the idr and the fsnotify internals somehow got out of sync. It was only supposed to do this once but due to this stupid bug it would warn every single time a problem was detected. Signed-off-by: Eric Paris Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 9e572cc9877ee6c43af60778f6b8d5ba0692d935 Author: Eric Paris Date: Fri Jan 15 12:12:24 2010 -0500 inotify: do not reuse watch descriptors Since commit 7e790dd5fc937bc8d2400c30a05e32a9e9eef276 ("inotify: fix error paths in inotify_update_watch") inotify changed the manor in which it gave watch descriptors back to userspace. Previous to this commit inotify acted like the following: inotify_add_watch(X, Y, Z) = 1 inotify_rm_watch(X, 1); inotify_add_watch(X, Y, Z) = 2 but after this patch inotify would return watch descriptors like so: inotify_add_watch(X, Y, Z) = 1 inotify_rm_watch(X, 1); inotify_add_watch(X, Y, Z) = 1 which I saw as equivalent to opening an fd where open(file) = 1; close(1); open(file) = 1; seemed perfectly reasonable. The issue is that quite a bit of userspace apparently relies on the behavior in which watch descriptors will not be quickly reused. KDE relies on it, I know some selinux packages rely on it, and I have heard complaints from other random sources such as debian bug 558981. Although the man page implies what we do is ok, we broke userspace so this patch almost reverts us to the old behavior. It is still slightly racey and I have patches that would fix that, but they are rather large and this will fix it for all real world cases. The race is as follows: - task1 creates a watch and blocks in idr_new_watch() before it updates the hint. - task2 creates a watch and updates the hint. - task1 updates the hint with it's older wd - task removes the watch created by task2 - task adds a new watch and will reuse the wd originally given to task2 it requires moving some locking around the hint (last_wd) but this should solve it for the real world and be -stable safe. As a side effect this patch papers over a bug in the lib/idr code which is causing a large number WARN's to pop on people's system and many reports in kerneloops.org. I'm working on the root cause of that idr bug seperately but this should make inotify immune to that issue. Signed-off-by: Eric Paris Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 926311fd7dabcd284a1e8a87a3e2bb5f929c0c60 Author: Roel Kluin Date: Mon Jan 11 20:58:21 2010 +0100 amd64_edac: Ensure index stays within bounds in amd64_get_scrub_rate Add a missing iterator variable thus fixing the conditional of the for-loop in amd64_get_scrub_rate(). Signed-off-by: Roel Kluin Signed-off-by: Borislav Petkov commit 3ce2f76f5dfeeacd128db9e5cd6945bac0ea0b2a Author: Ben Dooks Date: Fri Jan 15 17:04:42 2010 +0900 ARM: MINI2440: Fixup __initdata usage Remove some of the __initdata tags which are currently inappropriate for platform_device and some of the platform data. These can be returned once support for copying platform devices and data is added. Signed-off-by: Ben Dooks commit 0a3727ffb99f09481da6110ac0067550129a768d Author: Uri Yosef Date: Fri Jan 15 16:56:05 2010 +0900 ARM: MINI2440: Fix crash on boot due to improper __initdata qualifier This patch fix mini2440 crash on boot due to improper __initdata qualifier on mini2440_led1_pdata. Signed-off-by: Uri Yosef Signed-off-by: Ben Dooks commit d3cf4489d5a50ca9dc82473cd105f97fc7f720e0 Author: Mark Brown Date: Wed Jan 13 13:57:04 2010 +0000 ARM: SMDK6410: Specify no GPIO for B_PWR_5V regulator Since the fixed voltage regulator grew support for GPIO based enables and GPIO 0 is valid on some systems we need to specify that there is no valid GPIO enable control. Signed-off-by: Mark Brown Signed-off-by: Ben Dooks commit 75136d48e85915fd78a072f22897622b5d4c1814 Author: Markus Pietrek Date: Fri Jan 15 08:33:20 2010 +0900 serial: sh-sci: using correct fifo size for SCIF and SCIFA ports. The sh-sci driver used the wrong fifosize for PORT_SCIFA and PORT_SCIF ports. If an incorrect size is used, the serial core will enforce an early shutdown on the port, especially with baudrates < 9600. Signed-off-by: Markus Pietrek Signed-off-by: Paul Mundt commit ea4407834118405ef419e9b07794ceacadc01bae Author: NISHIMOTO Hiroki Date: Fri Jan 15 08:25:00 2010 +0900 sh: mach-ecovec24: Add motion sensor driver support. This patch adds support for the lis3lv02d motion sensor connected via i2c on the Ecovec board. Tested with evtest. Signed-off-by: NISHIMOTO Hiroki Signed-off-by: Paul Mundt commit 44c36aed43b57ea12140957bebe76d711fbed653 Author: Anton Blanchard Date: Thu Jan 14 13:21:35 2010 -0500 alpha: cpumask_of_node() should handle -1 as a node CC: Richard Henderson CC: Ivan Kokshaysky Signed-off-by: Matt Turner CC: linux-alpha@vger.kernel.org CC: Rusty Russell CC: Andrew Morton Signed-off-by: Anton Blanchard commit abd4d609057dd4faa22837376fdef2433e4c33b1 Author: Matt Turner Date: Thu Jan 14 13:15:20 2010 -0500 alpha: add myself as a maintainer, and drop mention of 2.4 CC: Richard Henderson CC: Ivan Kokshaysky CC: linux-alpha@vger.kernel.org Signed-off-by: Matt Turner commit 61c39bb354a1f791ba6f562b766a72e508a036ee Merge: 4a24eef c540607 Author: Linus Torvalds Date: Thu Jan 14 08:37:53 2010 -0800 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] tape_char: add missing compat_ptr conversion [S390] zcrypt: add sanity check before copy_from_user() [S390] unwire sys_recvmmsg again [S390] con3215: remove empty ioctl function [S390] dasd: add proper compat pointer conversion for symmetrix ioctl [S390] mmap: add missing compat_ptr conversion to both mmap compat syscalls [S390] bug: implement arch specific __WARN macro [S390] Move __cpu_logical_map to smp.c [S390] tape_block: remove ioctl function [S390] smp: remove volatile type quilifier from __cpu_logical_map [S390] smp: setup smp_processor_id early [S390] use helpers for rlimits [S390] fs3270: add missing compat ptr conversion [S390] vmcp: add missing compat ptr conversion [S390] cio: add missing compat ptr conversion [S390] dasd: add missing compat ptr conversion [S390] remove superfluous TIF_USEDFPU bit [S390] duplicate SIGTRAP on signal delivery. [S390] clear TIF_SINGLE_STEP for new process. [S390] fix loading of PER control registers for utrace. commit 4a24eef671614aea479eac6c9ce5fa2cf590ee76 Merge: 4f37442 cd65c3c Author: Linus Torvalds Date: Thu Jan 14 08:36:15 2010 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits) net: fix build erros with CONFIG_BUG=n, CONFIG_GENERIC_BUG=n ipv6: skb_dst() can be NULL in ipv6_hop_jumbo(). tg3: Update copyright and driver version tg3: Disable 5717 serdes and B0 support tg3: Add reliable serdes detection for 5717 A0 tg3: Fix std rx prod ring handling tg3: Fix std prod ring nicaddr for 5787 and 57765 sfc: Fix conditions for MDIO self-test sfc: Fix polling for slow MCDI operations e1000e: workaround link issues on busy hub in half duplex on 82577/82578 e1000e: MDIO slow mode should always be done for 82577 ixgbe: update copyright dates ixgbe: Do not attempt to perform interrupts in netpoll when down cfg80211: fix refcount imbalance when wext is disabled mac80211: fix queue selection for data frames on monitor interfaces iwlwifi: silence buffer overflow warning iwlwifi: disable tx on beacon update notification iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr mac80211: fix endian error mac80211: add missing sanity checks for action frames ... commit 9b96918a974fcd6c9e752cc8b28157f776c601d3 Author: Ramax Lo Date: Thu Jan 14 10:15:05 2010 +0800 ARM: S3C: NAND: Check the existence of nr_map before copying Since the structure field nr_map is optional, we need to check whether the chip number map is provided to avoid unexpected NULL pointer exception. Signed-off-by: Ramax Lo Signed-off-by: Ben Dooks commit cd65c3c7d1081290b7365897c2290a84aa967d4d Author: Octavian Purdila Date: Wed Jan 13 18:10:36 2010 -0800 net: fix build erros with CONFIG_BUG=n, CONFIG_GENERIC_BUG=n Fixed build errors introduced by commit 7ad6848c (ip: fix mc_loop checks for tunnels with multicast outer addresses) Signed-off-by: Octavian Purdila Signed-off-by: David S. Miller commit 2570a4f5428bcdb1077622342181755741e7fa60 Author: David S. Miller Date: Wed Jan 13 17:27:37 2010 -0800 ipv6: skb_dst() can be NULL in ipv6_hop_jumbo(). This fixes CERT-FI FICORA #341748 Discovered by Olli Jarva and Tuomo Untinen from the CROSS project at Codenomicon Ltd. Just like in CVE-2007-4567, we can't rely upon skb_dst() being non-NULL at this point. We fixed that in commit e76b2b2567b83448c2ee85a896433b96150c92e6 ("[IPV6]: Do no rely on skb->dst before it is assigned.") However commit 483a47d2fe794328d29950fe00ce26dd405d9437 ("ipv6: added net argument to IP6_INC_STATS_BH") put a new version of the same bug into this function. Complicating analysis further, this bug can only trigger when network namespaces are enabled in the build. When namespaces are turned off, the dev_net() does not evaluate it's argument, so the dereference would not occur. So, for a long time, namespaces couldn't be turned on unless SYSFS was disabled. Therefore, this code has largely been disabled except by people turning it on explicitly for namespace development. With help from Eugene Teo Signed-off-by: David S. Miller commit ba5b0bfa06b6fbee03c6889046e9adcefa5d2c20 Author: Matt Carlson Date: Tue Jan 12 10:11:40 2010 +0000 tg3: Update copyright and driver version This patch updates the copyright notice for 2010 and updates the version number to 3.106. Signed-off-by: Matt Carlson Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit 55dffe79b34e2af98bd1315f1e00c2fc6a7a7078 Author: Matt Carlson Date: Tue Jan 12 10:11:39 2010 +0000 tg3: Disable 5717 serdes and B0 support The B0 revision of the 5717 will not get enough testing by the time 2.6.33 ships. Since the kernel is already at RC3, serdes support will require too many patches to fix. For these reasons, this patch disables 5717 serdes support and will refuse to attach to all 5717 devices that are later than an A0 revision. Signed-off-by: Matt Carlson Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit d1ec96af77df611d1728f3bb70289f83a02df1ea Author: Matt Carlson Date: Tue Jan 12 10:11:38 2010 +0000 tg3: Add reliable serdes detection for 5717 A0 The serdes status bit does not work as intended for the 5717 A0. This patch implements an alternative detection scheme that will only be valid for A0 revisions. Signed-off-by: Matt Carlson Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit 86cfe4ff02a51294cb2c974a8bedc7f648491df9 Author: Matt Carlson Date: Tue Jan 12 10:11:37 2010 +0000 tg3: Fix std rx prod ring handling There are some tg3 devices that require the driver to post new rx buffers in smaller increments. Commit 4361935afe3abc3e5a93006b99197fac1fabbd50, "tg3: Consider rx_std_prod_idx a hw mailbox" changed how the driver tracks the rx producer ring updates, but it does not make any special considerations for the above-mentioned devices. For those devices, it is possible for the driver to hit the special case path, which updates the hardware mailbox register but skips updating the shadow software mailbox member. If the special case path represents the final mailbox update for this ISR iteration, the hardware and software mailbox values will be out of sync. Ultimately, this will cause the driver to use a stale mailbox value on the next iteration, which will appear to the hardware as a large rx buffer update. Bad things ensue. The fix is to update the software shadow mailbox member when the special case path is taken. Signed-off-by: Matt Carlson Reviewed-by: Michael Chan Reported-by: Dmitry Torokhov Signed-off-by: David S. Miller commit 13fa95b0398d65885a79c6e95a09976ee9f8c009 Author: Matt Carlson Date: Tue Jan 12 10:11:36 2010 +0000 tg3: Fix std prod ring nicaddr for 5787 and 57765 Commit 87668d352aa8d135bd695a050f18bbfc7b50b506, titled "tg3: Don't touch RCB nic addresses", tried to avoid assigning the nic address of the standard producer ring. Unfortunately, the default nic address is not correct for the 5787, the 5755M, or the 57765. This patch reenables the old behavior and opts out of the assignment only for the 5717. Signed-off-by: Matt Carlson Reviewed-by: Michael Chan Tested-by: Chow Loong Jin Tested-by: Dmitry Torokhov Signed-off-by: David S. Miller commit f3766c26a5d00189e5c0965c66f01956d15a92d6 Author: Ben Hutchings Date: Wed Jan 13 10:59:13 2010 +0000 sfc: Fix conditions for MDIO self-test The MDIO self-test should not be run on boards without an MDIO PHY, such as SFN5122F-R3 and later revisions. It should also not try to address a specific MMD in an MDIO clause 22 PHY. Check the mode_support field to decide which mode to use, if any. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 55029c1d65158aea9672c5dfadb43a57f23e3100 Author: Ben Hutchings Date: Wed Jan 13 04:34:25 2010 +0000 sfc: Fix polling for slow MCDI operations When the interface is down and we are using polled mode for MCDI operations, we busy-wait for completion for approximately 1 jiffy using udelay() and then back off to schedule(). But the completion will not wake the task, since we are using polled mode! We must use schedule_timeout_uninterruptible() instead. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit baf86c9d36826fab0160251bbc87dfab3af48a21 Author: Bruce Allan Date: Wed Jan 13 01:53:08 2010 +0000 e1000e: workaround link issues on busy hub in half duplex on 82577/82578 This patch removes a delay in hardware after every received packet allowing more time for transmitted packets to go out in between received packets in half duplex. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit fddaa1aff881c98f524221236af98ce70dcd04cf Author: Bruce Allan Date: Wed Jan 13 01:52:49 2010 +0000 e1000e: MDIO slow mode should always be done for 82577 A previous 82577 workaround that set the MDIO access speed to slow mode for every PHY register read/write when the cable is unplugged should instead set the access mode to always be slow before any PHY register access. Since the mode bit gets cleared when the PHY is reset, set the mode after every PHY reset. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 8c47eaa76600cebc4869a42abb4568925ade6c47 Author: Shannon Nelson Date: Wed Jan 13 01:49:34 2010 +0000 ixgbe: update copyright dates Signed-off-by: Shannon Nelson Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 1a647bd213d85c88507967104aea79b2649e6a6e Author: Alexander Duyck Date: Wed Jan 13 01:49:13 2010 +0000 ixgbe: Do not attempt to perform interrupts in netpoll when down This patch resolves issues seen when running netconsole and rebooting via reboot -f. The issue was due to the fact that we were attempting to perform interrupt actions when the q_vectors and rings had already been freed via the ixgbe_shutdown routines. Signed-off-by: Alexander Duyck Acked-by: Mallikarjuna R Chilakala Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 4f374425b625d48445e370f63c896283eb2a9bae Merge: 004b350 c5cae66 Author: Linus Torvalds Date: Wed Jan 13 16:15:09 2010 -0800 Merge branch 'for-linus/bugfixes' of git://xenbits.xensource.com/people/ianc/linux-2.6 * 'for-linus/bugfixes' of git://xenbits.xensource.com/people/ianc/linux-2.6: xen: fix hang on suspend. commit 004b35063296b6772fa72404a35b498f1e71e87e Merge: 6846ee5 194fda0 Author: Linus Torvalds Date: Wed Jan 13 16:13:57 2010 -0800 Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: change drm set mode messages as DRM_DEBUG drm: fix crtc no modes printf + typo drm/radeon/kms: only evict to GTT if CP is ready drm/radeon/kms: Fix crash getting TV info with no BIOS. drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2) drm/radeon/kms/r6xx+: make irq handler less verbose drm/radeon/kms: fix up LVDS handling on macs (v2) commit 6846ee5ca68d81e6baccf0d56221d7a00c1be18b Author: Benjamin Herrenschmidt Date: Wed Jan 13 16:19:34 2010 +1100 zlib: Fix build of powerpc boot wrapper Commit ac4c2a3bbe5db5fc570b1d0ee1e474db7cb22585 broke the build of all powerpc boot wrappers. It attempts to add an include of autoconf.h but used the wrong path for it. It also adds -D__KERNEL__ to our boot wrapper, both things that we pretty much didn't do on purpose so far. We want our boot wrapper to remain independent enough of the kernel for various reasons, one of them being that you can "wrap" an existing kernel at distro install time which allows to ship one kernel image and a set of boot wrappers for different platforms, the wrappers don't have to be built out of the same kernel build tree. It's also incorrect to do what the patch does in our boot environment since we may not have a proper alignment exception handler which means we may not be able to fixup the few cases where an unaligned access will need SW emulation (depends on the core variant, could be when crossing page or segment boundaries for example). This patch fixes it by putting the old code back in and using the new "fancy" variant only when CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS is set, which happens not to be set on powerpc since we don't include autoconf.h. It also reverts the changes to our boot wrapper Makefile. This means that x86 should, afaik, keep the optimisations since its boot wrapper does include autoconf.h and define __KERNEL__ (though I doubt they make that much different outside of slow embedded processors). Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit 8866f9df4a5b91a4e514ccc76472261a644a3848 Merge: 04e9e5c 0e253fd Author: Linus Torvalds Date: Wed Jan 13 16:10:13 2010 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: wacom: Add BTN_TOOL_FINGER for pad button reporting HID: add device IDs for new model of Apple Wireless Keyboard HID: fix pad button definition in hid-wacom HID: Support 171 byte variant of Samsung USB IR receiver HID: blacklist ET&T TC5UH touchscreen controller commit 04e9e5c7659ee07f0387ddb663913fadcca88d5f Merge: cedabed 0710520 Author: Linus Torvalds Date: Wed Jan 13 16:09:59 2010 -0800 Merge branch 'for-33' of git://repo.or.cz/linux-kbuild * 'for-33' of git://repo.or.cz/linux-kbuild: Makefile: do not override LC_CTYPE kbuild: really fix bzImage build with non-bash sh commit cedabed49b39b4319bccc059a63344b6232b619c Author: OGAWA Hirofumi Date: Wed Jan 13 21:14:09 2010 +0900 vfs: Fix vmtruncate() regression If __block_prepare_write() was failed in block_write_begin(), the allocated blocks can be outside of ->i_size. But new truncate_pagecache() in vmtuncate() does nothing if new < old. It means the above usage is not working anymore. So, this patch fixes it by removing "new < old" check. It would need more cleanup/change. But, now -rc and truncate working is in progress, so, this tried to fix it minimum change. Acked-by: Nick Piggin Signed-off-by: OGAWA Hirofumi Signed-off-by: Linus Torvalds commit e80c14e1ae3cb637d1959a6c9a199ba2e7af5910 Merge: 7284ce6 53281b6 Author: Linus Torvalds Date: Wed Jan 13 13:42:49 2010 -0800 Merge branch 'fasync-helper' * fasync-helper: fasync: split 'fasync_helper()' into separate add/remove functions commit c5406079780f0f687316732353f49c3357504428 Author: Heiko Carstens Date: Wed Jan 13 20:44:44 2010 +0100 [S390] tape_char: add missing compat_ptr conversion Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 0648f5659e2d51659bd8f42ff30f456775c3c12d Author: Heiko Carstens Date: Wed Jan 13 20:44:43 2010 +0100 [S390] zcrypt: add sanity check before copy_from_user() It's not obvious that copy_from_user() is called with a sane length parameter here. Even though it currently seems to be correct better add a check to prevent stack corruption / exploits. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 94e587f61ef5da3b4da40289cdb7e9a62d455313 Author: Heiko Carstens Date: Wed Jan 13 20:44:42 2010 +0100 [S390] unwire sys_recvmmsg again sys_recvmmsg is reachable via sys_socketcall. So unwire it again since there is no point in having two entry points for it. Also put it to the ignore list so we don't get reminded anymore in order to wire it up. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 7b475d59a07cb193310afae48367bd1ea2faa411 Author: Heiko Carstens Date: Wed Jan 13 20:44:41 2010 +0100 [S390] con3215: remove empty ioctl function ...instead of adding a compat ioctl function which would do nothing as well. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit f8b068593db4a4184c8963fcd5a7f34584fde8ad Author: Heiko Carstens Date: Wed Jan 13 20:44:40 2010 +0100 [S390] dasd: add proper compat pointer conversion for symmetrix ioctl Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit d381589834aa69f51f95b1e364fe79688692aab4 Author: Heiko Carstens Date: Wed Jan 13 20:44:39 2010 +0100 [S390] mmap: add missing compat_ptr conversion to both mmap compat syscalls Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit a9df8e325d0de527c2e97297704ebbec48c01cbf Author: Heiko Carstens Date: Wed Jan 13 20:44:38 2010 +0100 [S390] bug: implement arch specific __WARN macro This one will trap, generates shorter code and emits better debug data than the generic version. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit fb380aadfe34e8d3ce628cb3e386882351940874 Author: Heiko Carstens Date: Wed Jan 13 20:44:37 2010 +0100 [S390] Move __cpu_logical_map to smp.c Finally move it to the place where it belongs to and make get rid of it for !CONFIG_SMP. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 957a37ad587f3ef1022f1fe434d818cbed38eb95 Author: Heiko Carstens Date: Wed Jan 13 20:44:36 2010 +0100 [S390] tape_block: remove ioctl function This is just a complicated construct which always returns -EINVAL. Just remove it. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit c6a5f8cea2e5454fce3859ca5ed381c2535184cf Author: Heiko Carstens Date: Wed Jan 13 20:44:35 2010 +0100 [S390] smp: remove volatile type quilifier from __cpu_logical_map Remove pointless qualifier. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 02beaccc901b7a28ac1de79f3ed122f5fda220b1 Author: Heiko Carstens Date: Wed Jan 13 20:44:34 2010 +0100 [S390] smp: setup smp_processor_id early smp_processor_id() is supposed to work before setup_arch() gets called. Before that smp_processor_id() may return just an arbitrary value that is contained in the uninitialized boot lowcore. So provide the arch function which will override the weak function in init/main.c. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit a58c26bba9ebe97fea99aee125728b1f3886499e Author: Jiri Slaby Date: Wed Jan 13 20:44:33 2010 +0100 [S390] use helpers for rlimits Make sure compiler won't do weird things with limits. E.g. fetching them twice may return 2 different values after writable limits are implemented. I.e. either use rlimit helpers added in 3e10e716abf3c71bdb5d86b8f507f9e72236c9cd or ACCESS_ONCE if not applicable. Cc: Heiko Carstens Cc: linux390@de.ibm.com Cc: linux-s390@vger.kernel.org Signed-off-by: Jiri Slaby Signed-off-by: Martin Schwidefsky commit 16e1a577693a470367287281765b7daad0998fc1 Author: Heiko Carstens Date: Wed Jan 13 20:44:32 2010 +0100 [S390] fs3270: add missing compat ptr conversion Add missing compat ptr conversion including two additional whitespace changes that aren't worth a separate patch. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 8f3eabe3835449117058efaf5e90f28bf030e859 Author: Heiko Carstens Date: Wed Jan 13 20:44:31 2010 +0100 [S390] vmcp: add missing compat ptr conversion Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 44ee6a8564a89a77206b0b13cea91fc2f4ff997d Author: Heiko Carstens Date: Wed Jan 13 20:44:30 2010 +0100 [S390] cio: add missing compat ptr conversion Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 880348653ec2eda81550a8aa37c2eb625922f695 Author: Heiko Carstens Date: Wed Jan 13 20:44:29 2010 +0100 [S390] dasd: add missing compat ptr conversion Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit bebf023d415fd8984994a596aaa83cd0a3046d0b Author: Martin Schwidefsky Date: Wed Jan 13 20:44:28 2010 +0100 [S390] remove superfluous TIF_USEDFPU bit The TIF_USEDFPU bit is always 0 for s390 and it is not tested anywhere. Remove the bit. At the same time remove the calls to clear_used_math() as well. The PF_USED_MATH bit is never set for s390 either. Signed-off-by: Martin Schwidefsky commit 6f50248ef0efa7453397eb53e41e8aa5df534492 Author: Martin Schwidefsky Date: Wed Jan 13 20:44:27 2010 +0100 [S390] duplicate SIGTRAP on signal delivery. The code in do_signal sets the TIF_SINGLE_STEP bit and calls tracehook_signal_handler after the signal frame has been set up. This causes two SIGTRAP signals to be delivered to the tracer. Stop setting the TIF_SINGLE_STEP bit in do_signal to get the correct number of SIGTRAPs. Signed-off-by: Martin Schwidefsky commit f8d5faf718c9ff2c04eb8484585d4963c4111cd7 Author: Martin Schwidefsky Date: Wed Jan 13 20:44:26 2010 +0100 [S390] clear TIF_SINGLE_STEP for new process. Clear the TIF_SINGLE_STEP bit in copy_thread. The new process did not get a PER event of its own. It is wrong deliver a SIGTRAP that was meant for the parent process. Signed-off-by: Martin Schwidefsky commit c3311c13adc1021e986fef12609ceb395ffc5014 Author: Martin Schwidefsky Date: Wed Jan 13 20:44:25 2010 +0100 [S390] fix loading of PER control registers for utrace. If the current task enables / disables PER tracing for itself the PER control registers need to be loaded in FixPerRegisters. Signed-off-by: Martin Schwidefsky commit 07105202bdebf6e9a4c72c634cf90398abfad870 Author: Michal Marek Date: Fri Jan 8 12:25:37 2010 +0100 Makefile: do not override LC_CTYPE Setting LC_CTYPE=C breaks localized messages in some setups. With only LC_COLLATE=C and LC_NUMERIC=C, we get almost all we need, except for not so defined character classes and tolower()/toupper(). The former is not a big issue, because we can assume that e.g. [:alpha:] will always include a-zA-Z and we only ever process ASCII input. The latter seems only affect arch/sh/tools/gen-mach-types, which we can handle separately. So after this patch the meaning of ranges like [a-z], the behavior of sort and join, etc. should be the same everywhere and at the same time gcc should be able to print localized waring and error messages. LC_NUMERIC=C might not be necessary, but setting it doesn't hurt. Reported-by: Simon Horman Reported-by: Sergei Trofimovich Acked-by: H. Peter Anvin Tested-by: Simon Horman Tested-by: Masami Hiramatsu Signed-off-by: Michal Marek commit 1373411ae4cd0caf2e1a35fb801dd9a00b64dea2 Author: Jonathan Nieder Date: Mon Dec 28 19:38:27 2009 +0000 kbuild: really fix bzImage build with non-bash sh In an x86 build with CONFIG_KERNEL_LZMA enabled and dash as sh, arch/x86/boot/compressed/vmlinux.bin.lzma ends with '\xf0\x7d\x39\x00' (16 bytes) instead of the 4 bytes intended and the resulting vmlinuz fails to boot. This improves on the previous behavior, in which the file contained the characters '-ne ' as well, but not by much. Previous commits replaced "echo -ne" first with "/bin/echo -ne", then "printf" in the hope of improving portability, but none of these commands is guaranteed to support hexadecimal escapes on POSIX systems. So use the shell to convert from hexadecimal to octal. With this change, an LZMA-compressed kernel built with dash as sh boots correctly again. Reported-by: Sebastian Dalfuß Reported-by: Oliver Hartkopp Reported-by: Michael Guntsche Signed-off-by: Jonathan Nieder Cc: Michael Tokarev Cc: Alek Du Cc: Andrew Morton Signed-off-by: Michal Marek commit 0e253fdb3b5739fd8514f617ec582762bcfaea48 Author: Przemo Firszt Date: Sat Jan 9 15:20:03 2010 +0100 HID: wacom: Add BTN_TOOL_FINGER for pad button reporting Without this patch xf86-input-wacom driver wasn't able to properly recognise pad button events. It was also causing some problems with button mapping. Signed-off-by: Przemo Firszt Signed-off-by: Jiri Kosina commit 23aeb61e7e1f02fb0f3b8f9e798e75537ca1731d Author: Christian Schuerer-Waldheim Date: Wed Jan 6 14:49:57 2010 +0100 HID: add device IDs for new model of Apple Wireless Keyboard Added device IDs for the new model of the Apple Wireless Keyboard (November 2009). Signed-off-by: Christian Schuerer-Waldheim Signed-off-by: Jiri Kosina commit d01799b2f399603ae4cecc06f6ea146c57519cb1 Author: Przemo Firszt Date: Mon Jan 4 12:32:00 2010 +0100 HID: fix pad button definition in hid-wacom This fix is required for xorg driver to recognise 2 pad buttons Signed-off-by: Przemo Firszt Signed-off-by: Jiri Kosina commit c5cae661d6cf808b6984762f763261adf35f3eb7 Author: Ian Campbell Date: Thu Dec 17 13:57:09 2009 +0000 xen: fix hang on suspend. In 65f63384 "xen: improve error handling in do_suspend" I said: - xs_suspend()/xs_resume() and dpm_suspend_noirq()/dpm_resume_noirq() were not nested in the obvious way. and changed the ordering of the calls as so: BEFORE AFTER xs_suspend dpm_suspend_noirq dpm_suspend_noirq xs_suspend *SUSPEND* *SUSPEND* dpm_resume_noirq dpm_resume_noirq xs_resume xs_resume Clearly this is not an improvement and I was talking rubbish. In particular the new ordering is susceptible to a hang if a xenstore write is in progress at the point at which the suspend kicks in. When the suspend process calls xs_suspend it tries to take the request_mutex but if a write is in progress it could be looping in xenbus_xs.c:read_reply() waiting for something to arrive on &xs_state.reply_list while holding the request_mutex (taken in the caller of read_reply). However if we have done dpm_suspend_noirq before xs_suspend then we won't get any more xenstore interrupts and process_msg() will never be woken up to add anything to the reply_list. Fix this by calling xs_suspend before dpm_suspend_noirq. If dpm_suspend_noirq fails then make sure we go through the xs_suspend_cancel() code path. Signed-off-by: Ian Campbell Acked-by: Jeremy Fitzhardinge Cc: Stable Kernel commit c332e9fcc5289698350d39d4d22c3ed5257d7a80 Author: Tai-hwa Liang Date: Wed Jan 13 00:25:35 2010 -0800 Input: sentelic - fix left/right horizontal scroll mapping Signed-off-by: Tai-hwa Liang Signed-off-by: Dmitry Torokhov commit 4a18b3ab6ed537b055e3fcfca64ab870b4f9acf0 Author: Tai-hwa Liang Date: Wed Jan 13 00:16:27 2010 -0800 Input: pmouse - move Sentelic probe down the list Sentelic probes confuse IBM trackpoints so they stop responding to TP_READ_ID command. See: http://bugzilla.kernel.org/show_bug.cgi?id=14970 Let's move FSP detection lower so it is probed after trackpoint and others, just before we strat probing for Intellimouse Explorer. Signed-off-by: Tai-hwa Liang Signed-off-by: Dmitry Torokhov commit 194fda0dd83623f7927d505e39008c73fbc1c141 Merge: ef14587 9270eb1 Author: Dave Airlie Date: Wed Jan 13 16:17:38 2010 +1000 Merge remote branch 'korg/drm-radeon-next' into drm-linus * korg/drm-radeon-next drm/radeon/kms: only evict to GTT if CP is ready drm/radeon/kms: Fix crash getting TV info with no BIOS. drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2) drm/radeon/kms/r6xx+: make irq handler less verbose drm/radeon/kms: fix up LVDS handling on macs (v2) commit ef14587706521287f1c7ea3326e732f7d86dd096 Author: Dave Young Date: Wed Jan 13 13:38:59 2010 +0800 drm: change drm set mode messages as DRM_DEBUG Following drm info repeat 207 times during one hour, it's quite annoying [ 1266.286747] [drm] TV-19: set mode NTSC 480i 0 Change from DRM_INFO to DRM_DEBUG Signed-off-by: Dave Young Signed-off-by: Dave Airlie commit 70a94d6a35072b62f808155f117f00485a395f03 Author: Dave Airlie Date: Wed Jan 13 16:15:11 2010 +1000 drm: fix crtc no modes printf + typo Toralf Förster pointed out the typo, the fact I forget the if statement is purely personal fail. Signed-off-by: Dave Airlie commit ff30b3642c1f56a5ae6522b78e82be867086c637 Merge: 9db2f1b 8c5d980 Author: David S. Miller Date: Tue Jan 12 21:33:49 2010 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 9270eb1b496cb002d75f49ef82c9ef4cbd22a5a0 Author: Dave Airlie Date: Wed Jan 13 09:21:49 2010 +1000 drm/radeon/kms: only evict to GTT if CP is ready Testing GTT ready might be more correct but cp.ready works fine and has been tested on irc by 2-3 ppl. fixes bug k.org 15035 and fd.o 25733 Signed-off-by: Dave Airlie commit 11f3b59e3654c66c4e8ef2c48f8138b78bf440da Author: Michel Dänzer Date: Mon Jan 11 08:58:38 2010 +0100 drm/radeon/kms: Fix crash getting TV info with no BIOS. Signed-off-by: Michel Dänzer Signed-off-by: Dave Airlie commit 1b24203e51072b6e76aff8c74bdd67eb3b34a724 Author: Alex Deucher Date: Mon Jan 11 15:02:31 2010 -0500 drm/radeon/kms/rv100: reject modes > 135 Mhz on DVI (v2) Due to heat issues. Fixes fdo bug 25992 v2: fix typo noticed by Maarten Maathuis Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit b042589ca038e647fa1e2bb4e7ac3963688479b8 Author: Alex Deucher Date: Mon Jan 11 19:47:38 2010 -0500 drm/radeon/kms/r6xx+: make irq handler less verbose Unhandled vectors can be safely ignored, no need to spam the kernel log by default. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 3890ddf56dbc0f804953198e65a7e406ed654576 Author: Alex Deucher Date: Tue Jan 12 11:16:57 2010 -0500 drm/radeon/kms: fix up LVDS handling on macs (v2) Based on radeonfb code and recent ddx fix. v2: minor formatting fix from Michel Dänzer Signed-off-by: Alex Deucher Reviewed-by: Michel Dänzer Tested-by: Michel Dänzer Signed-off-by: Dave Airlie commit 15e184afa83a45cf8bafdb9dc906b97a8fbc974f Author: Dmitry Torokhov Date: Mon Jan 11 00:05:43 2010 -0800 Input: add compat support for sysfs and /proc capabilities output Input core displays capabilities bitmasks in form of one or more longs printed in hex form and separated by spaces. Unfortunately it does not work well for 32-bit applications running on 64-bit kernels since applications expect that number is "worth" only 32 bits when kernel advances by 64 bits. Fix that by ensuring that output produced for compat tasks uses 32-bit units. Reported-and-tested-by: Michael Tokarev Signed-off-by: Dmitry Torokhov commit 8c5d9808e95739c9001b852464fd58fd0f583280 Author: Johannes Berg Date: Mon Jan 11 16:14:57 2010 +0100 cfg80211: fix refcount imbalance when wext is disabled When CONFIG_CFG80211_WEXT is not set, there is a refcount imbalance with rdev->opencount, fix that by moving it out of the ifdef. Reported-by: Alan Stern Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 193e70ef65a6c33f2935ce1f4adeb08ecb9202cf Author: Felix Fietkau Date: Mon Jan 11 06:47:00 2010 +0100 mac80211: fix queue selection for data frames on monitor interfaces When ieee80211_monitor_select_queue encounters data frames, it selects the WMM AC based on skb->priority and assumes that skb->priority contains a valid 802.1d tag. However this assumption is incorrect, since ieee80211_select_queue has not been called at this point. If skb->priority > 7, an array overrun occurs, which could lead to invalid values, resulting in crashes in the tx path. Fix this by setting skb->priority based on the 802.11 header for QoS frames and using the default AC for all non-QoS frames. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville commit 39825f4dc9f4e409e8ea43ef4df04a924699ad1f Author: Dan Carpenter Date: Sat Jan 9 11:41:48 2010 +0300 iwlwifi: silence buffer overflow warning Smatch (and presumably other static checkers) complain that MAX_TID_COUNT is past the end of the array. In the resulting discussion, Zhu Yi pointed out that this value is not used in real life and the assignment was only there to silence a gcc warning. If there were a bug in the surrounding code and the value were used, the WARN_ON(!qc) would print a warning before the crash. Signed-off-by: Dan Carpenter Acked-by: Zhu Yi Signed-off-by: John W. Linville commit e6edbdc52bc0755cbfe0721ca91d4fd87649bc13 Author: Elliott Sales de Andrade Date: Sun Jan 10 23:59:05 2010 -0800 Input: i8042 - add Dritek quirk for Acer Aspire 5610. Signed-off-by: Elliott Sales de Andrade Signed-off-by: Dmitry Torokhov commit dd38d6889dc5dae2014d9eac72fae32f477f294e Author: Dmitry Torokhov Date: Sat Jan 9 00:13:36 2010 -0800 Input: xbox - do not use GFP_KERNEL under spinlock xbox_play_effect() is called while holding dev->event_lock with interrupts disabled and thus may not use GFP_KERNEL when submitting urbs. Signed-off-by: Dmitry Torokhov commit c91c3efca5297bd67324654524ced38162f2e579 Author: Abhijeet Kolekar Date: Fri Jan 8 10:04:31 2010 -0800 iwlwifi: disable tx on beacon update notification On beacon change update notification from mac we are not disabling the tx in adhoc mode. Mac sends BSS_CHANGED_BEACON_ENABLED when station leaves IBSS. Driver should indicate uCode to not to send anything on receiving this notification. Functionality to indicate uCode is duplicated across two notifications so created a common function called iwl_set_no_assoc. Fix the issue at http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2133. Signed-off-by: Abhijeet Kolekar Tested-by: Johannes Berg Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville commit c8106d7625a58ee4387cb2efe3e82320ad44b467 Author: Zhu Yi Date: Fri Jan 8 10:04:30 2010 -0800 iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr When txq read_ptr equals to write_ptr, iwl_queue_used should always return false. Because there is no used TFD in this case. This is a complementary fix to the fix already included in commit "iwl3945: fix panic in iwl3945 driver". Both fixes are needed to address the panic below. This problem was discussed on linux-wireless in http://thread.gmane.org/gmane.linux.kernel.wireless.general/43568 <1>[ 7290.414172] IP: [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] <4>[ 7290.414205] PGD 0 <1>[ 7290.414214] Thread overran stack, or stack corrupted <0>[ 7290.414229] Oops: 0002 [#1] PREEMPT SMP <0>[ 7290.414246] last sysfs file: /sys/devices/platform/coretemp.1/temp1_input <4>[ 7290.414265] CPU 0 <4>[ 7290.414274] Modules linked in: af_packet nfsd usb_storage usb_libusual cpufreq_powersave exportfs cpufreq_conservative iwl3945 nfs cpufreq_userspace snd_hda_codec_realtek acpi_cpufreq uvcvideo lockd iwlcore snd_hda_intel joydev coretemp nfs_acl videodev snd_hda_codec mac80211 v4l1_compat snd_hwdep sbp2 v4l2_compat_ioctl32 uhci_hcd psmouse auth_rpcgss ohci1394 cfg80211 ehci_hcd video ieee1394 snd_pcm serio_raw battery ac nvidia(P) usbcore output sunrpc evdev lirc_ene0100 snd_page_alloc rfkill tg3 libphy fuse lzo lzo_decompress lzo_compress <6>[ 7290.414486] Pid: 0, comm: swapper Tainted: P 2.6.32-rc8-wl #213 Aspire 5720 <6>[ 7290.414507] RIP: 0010:[] [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] <6>[ 7290.414541] RSP: 0018:ffff880002203d60 EFLAGS: 00010246 <6>[ 7290.414557] RAX: 000000000000004f RBX: ffff880064c11600 RCX: 0000000000000013 <6>[ 7290.414576] RDX: ffffffffa0ddcf20 RSI: ffff8800512b7008 RDI: 0000000000000038 <6>[ 7290.414596] RBP: ffff880002203dd0 R08: 0000000000000000 R09: 0000000000000100 <6>[ 7290.414616] R10: 0000000000000001 R11: 0000000000000000 R12: 00000000000000a0 <6>[ 7290.414635] R13: 0000000000000002 R14: 0000000000000013 R15: 0000000000020201 <6>[ 7290.414655] FS: 0000000000000000(0000) GS:ffff880002200000(0000) knlGS:0000000000000000 <6>[ 7290.414677] CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b <6>[ 7290.414693] CR2: 0000000000000041 CR3: 0000000001001000 CR4: 00000000000006f0 <6>[ 7290.414712] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 <6>[ 7290.414732] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 <4>[ 7290.414752] Process swapper (pid: 0, threadinfo ffffffff81524000, task ffffffff81528b60) <0>[ 7290.414772] Stack: <4>[ 7290.414780] ffff880002203da0 0000000000000046 0000000000000000 0000000000000046 <4>[ 7290.414804] <0> 0000000000000282 0000000000000282 0000000000000282 ffff880064c12010 <4>[ 7290.414830] <0> ffff880002203db0 ffff880064c11600 ffff880064c12e50 ffff8800512b7000 <0>[ 7290.414858] Call Trace: <0>[ 7290.414867] <4>[ 7290.414884] [] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945] <4>[ 7290.414910] [] ? _spin_unlock+0x30/0x60 <4>[ 7290.414931] [] tasklet_action+0x101/0x110 <4>[ 7290.414950] [] __do_softirq+0xc0/0x160 <4>[ 7290.414968] [] call_softirq+0x1c/0x30 <4>[ 7290.414986] [] do_softirq+0x75/0xb0 <4>[ 7290.415003] [] irq_exit+0x95/0xa0 <4>[ 7290.415020] [] do_IRQ+0x77/0xf0 <4>[ 7290.415038] [] ret_from_intr+0x0/0xf <0>[ 7290.415052] <4>[ 7290.415067] [] ? acpi_idle_enter_bm+0x270/0x2a5 <4>[ 7290.415087] [] ? acpi_idle_enter_bm+0x27a/0x2a5 <4>[ 7290.415107] [] ? acpi_idle_enter_bm+0x270/0x2a5 <4>[ 7290.415130] [] ? cpuidle_idle_call+0x93/0xf0 <4>[ 7290.415149] [] ? cpu_idle+0xa7/0x110 <4>[ 7290.415168] [] ? rest_init+0x75/0x80 <4>[ 7290.415187] [] ? start_kernel+0x3a7/0x3b3 <4>[ 7290.415206] [] ? x86_64_start_reservations+0x125/0x129 <4>[ 7290.415227] [] ? x86_64_start_kernel+0xe4/0xeb <0>[ 7290.415243] Code: 00 41 39 ce 0f 8d e8 01 00 00 48 8b 47 40 48 63 d2 48 69 d2 98 00 00 00 4c 8b 04 02 48 c7 c2 20 cf dd a0 49 8d 78 38 49 8d 40 4f 47 09 00 c6 47 0c 00 c6 47 0f 00 c6 47 12 00 c6 47 15 00 49 <1>[ 7290.415382] RIP [] iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] <4>[ 7290.415410] RSP <0>[ 7290.415421] CR2: 0000000000000041 <4>[ 7290.415436] ---[ end trace ec46807277caa515 ]--- <0>[ 7290.415450] Kernel panic - not syncing: Fatal exception in interrupt <4>[ 7290.415468] Pid: 0, comm: swapper Tainted: P D 2.6.32-rc8-wl #213 <4>[ 7290.415486] Call Trace: <4>[ 7290.415495] [] panic+0x7d/0x13a <4>[ 7290.415519] [] oops_end+0xda/0xe0 <4>[ 7290.415538] [] no_context+0xea/0x250 <4>[ 7290.415557] [] ? select_task_rq_fair+0x511/0x780 <4>[ 7290.415578] [] __bad_area_nosemaphore+0x125/0x1e0 <4>[ 7290.415597] [] ? __enqueue_entity+0x7c/0x80 <4>[ 7290.415616] [] ? enqueue_task_fair+0x111/0x150 <4>[ 7290.415636] [] bad_area_nosemaphore+0xe/0x10 <4>[ 7290.415656] [] do_page_fault+0x26a/0x320 <4>[ 7290.415674] [] page_fault+0x1f/0x30 <4>[ 7290.415697] [] ? iwl3945_rx_reply_tx+0xc1/0x450 [iwl3945] <4>[ 7290.415723] [] iwl3945_irq_tasklet+0x657/0x1740 [iwl3945] <4>[ 7290.415746] [] ? _spin_unlock+0x30/0x60 <4>[ 7290.415764] [] tasklet_action+0x101/0x110 <4>[ 7290.415783] [] __do_softirq+0xc0/0x160 <4>[ 7290.415801] [] call_softirq+0x1c/0x30 <4>[ 7290.415818] [] do_softirq+0x75/0xb0 <4>[ 7290.415835] [] irq_exit+0x95/0xa0 <4>[ 7290.415852] [] do_IRQ+0x77/0xf0 <4>[ 7290.415869] [] ret_from_intr+0x0/0xf <4>[ 7290.415883] [] ? acpi_idle_enter_bm+0x270/0x2a5 <4>[ 7290.415911] [] ? acpi_idle_enter_bm+0x27a/0x2a5 <4>[ 7290.415931] [] ? acpi_idle_enter_bm+0x270/0x2a5 <4>[ 7290.415952] [] ? cpuidle_idle_call+0x93/0xf0 <4>[ 7290.415971] [] ? cpu_idle+0xa7/0x110 <4>[ 7290.415989] [] ? rest_init+0x75/0x80 <4>[ 7290.416007] [] ? start_kernel+0x3a7/0x3b3 <4>[ 7290.416026] [] ? x86_64_start_reservations+0x125/0x129 <4>[ 7290.416047] [] ? x86_64_start_kernel+0xe4/0xeb Reported-by: Maxim Levitsky Tested-by: Maxim Levitsky Signed-off-by: Zhu Yi Signed-off-by: Reinette Chatre CC: stable@kernel.org Signed-off-by: John W. Linville commit b49bb574e44226b332c28439999d196ddec2f643 Author: Johannes Berg Date: Fri Jan 8 19:00:00 2010 +0100 mac80211: fix endian error I forgot to convert the radiotap length to CPU endian, which sparse found thankfully. Signed-off-by: Johannes Berg Cc: stable@kernel.org Signed-off-by: John W. Linville commit d79074488083ec0d7ecd15352192dc1631f25643 Author: Felix Fietkau Date: Thu Jan 7 20:23:53 2010 +0100 mac80211: add missing sanity checks for action frames Various missing sanity checks caused rejected action frames to be interpreted as channel switch announcements, which can cause a client mode interface to switch away from its operating channel, thereby losing connectivity. This patch ensures that only spectrum management action frames are processed by the CSA handling function and prevents rejected action frames from getting processed by the MLME code. Signed-off-by: Felix Fietkau Cc: stable@kernel.org Signed-off-by: John W. Linville commit 045cfb71a3901005bf6dcedae98cecb3360a0bfc Author: Lennert Buytenhek Date: Thu Jan 7 15:01:42 2010 +0100 mac80211: fix queue selection for packets injected via monitor interface Commit 'mac80211: fix skb buffering issue' added an ->ndo_select_queue() for monitor interfaces which can end up dereferencing ieee802_1d_to_ac[] beyond the end of the array for injected data packets (as skb->priority isn't guaranteed to be zero or within [0:7]), which then triggers the WARN_ON in net/core/dev.c:dev_cap_txqueue(). Fix this by always setting the priority to zero on injected data frames. Signed-off-by: Lennert Buytenhek Cc: stable@kernel.org Signed-off-by: John W. Linville commit e4e6efd2df4b5754bd519b516207eb723d1f17df Author: Daniel Drake Date: Thu Jan 7 01:52:39 2010 -0800 Input: psmouse - fix Synaptics detection when protocol is disabled For configurations where Synaptics hardware is present but the Synaptics extensions support is not compiled in, the mouse is reprobed and a new device is allocated on every suspend/resume. During probe, psmouse_switch_protocol() calls psmouse_extensions() with set_properties=1. This calls the dummy synaptics_init() which returns an error code, instructing us not to use the synaptics extensions. During resume, psmouse_reconnect() calls psmouse_extensions() with set_properties=0, in which case call to synaptics_init() is bypassed and PSMOUSE_SYNAPTICS is returned. Since the result is different from previous attempt psmouse_reconnect() fails and full re-probe happens. Fix this by tweaking the set_properties=0 codepath in psmouse_extensions() to be more careful about offering PSMOUSE_SYNAPTICS extensions. Signed-off-by: Daniel Drake Signed-off-by: Dmitry Torokhov commit 8a5b33f55452c226aa0e47d737e541985ff10e16 Author: John W. Linville Date: Wed Jan 6 15:39:39 2010 -0500 Revert "mac80211: replace netif_tx_{start,stop,wake}_all_queues" This reverts commit 53623f1a09c7a7d23b74f0f7d93dba0ebde1006b. This was inadvertantly missed in "mac80211: fix skb buffering issue", and is required with that patch to restore proper queue operation. Signed-off-by: John W. Linville commit debde9ea24d5512400456b1b64df361e422f078d Author: John W. Linville Date: Wed Jan 6 15:35:49 2010 -0500 mac80211: fix-up build breakage in 2.6.33 "mac80211: fix skb buffering issue" is based on what will become 2.6.34, so it includes an incompatible usage of sta_info_get. This patch will need to be effectively reverted when merging for 2.6.34. Signed-off-by: John W. Linville commit 6f2701b79f2ee0c5eb946e8a87993acbe8041da3 Author: Henrik Rydberg Date: Wed Jan 6 00:32:48 2010 -0800 Input: bcm5974 - report ABS_MT events Make bcm5974 report raw multi-touch (MT) data in the form of ABS_MT events. [dtor@mail.ru: get rid of module option, always report all events] Signed-off-by: Henrik Rydberg Signed-off-by: Andrew Morton Signed-off-by: Dmitry Torokhov commit 861a64428c0786a5cfa2ffb36b2f8058dea5dda0 Author: Miguel Aguilar Date: Wed Jan 6 00:06:50 2010 -0800 Input: davinci_keyscan - add device_enable method to platform data Add a function pointer in the platform data of the DaVinci Keyscan driver called device_enable, in order to perform board specific actions when the device is initialized, like setup the PINMUX configuration. Signed-off-by: Miguel Aguilar Signed-off-by: Kevin Hilman Signed-off-by: Dmitry Torokhov commit 30a589fde0162aa4dac7c69803aeee8fbe8d1b82 Author: Adam Jackson Date: Tue Jan 5 17:56:04 2010 -0800 Input: evdev - be less aggressive about sending SIGIO notifies When using realtime signals, we'll enqueue one signal for every event. This is unfortunate, because (for example) keyboard presses are three events: key, msc scancode, and syn. They'll be enqueued fast enough in kernel space that all three events will be ready to read by the time userspace runs, so the first invocation of the signal handler will read all three events, but then the second two invocations still have to run to do no work. Instead, only send the SIGIO notification on syn events. This is a slight abuse of SIGIO semantics, in principle it ought to fire as soon as any events are readable. But it matches evdev semantics, which is more important since SIGIO is rather vaguely defined to begin with. Signed-off-by: Adam Jackson Signed-off-by: Dmitry Torokhov commit 0ef7a26af1278f7ec0b718148e88f01ba1953835 Author: Dmitry Torokhov Date: Tue Jan 5 17:56:02 2010 -0800 Input: atkbd - fix canceling event_work in disconnect We need to first unregister input device and only then cancel event work since events can arrive (and cause event work to get scheduled again) until input_unregister_device() returns. Signed-off-by: Dmitry Torokhov commit 59b015133cd0034f5904a76969d73476380aac46 Author: Eric W. Biederman Date: Tue Jan 5 17:56:02 2010 -0800 Input: serio - fix potential deadlock when unbinding drivers sysfs_remove_group() waits for sysfs attributes to be removed, therefore we do not need to worry about driver-specific attributes being accessed after driver has been detached from the device. In fact, attempts to take serio->drv_mutex in attribute methods may lead to the following deadlock: sysfs_read_file() fill_read_buffer() sysfs_get_active_two() psmouse_attr_show_helper() serio_pin_driver() serio_disconnect_driver() mutex_lock(&serio->drv_mutex); <--------> mutex_lock(&serio_drv_mutex); psmouse_disconnect() sysfs_remove_group(... psmouse_attr_group); .... sysfs_deactivate(); wait_for_completion(); Fix this by removing calls to serio_[un]pin_driver() and functions themselves and using driver-private mutexes to serialize access to attribute's set() methods that may change device state. Signed-off-by: Eric W. Biederman Signed-off-by: Dmitry Torokhov commit 7a4a77b7771164d61ce702a588067d1e1d66db7c Author: Gertjan van Wingerde Date: Wed Dec 30 11:36:30 2009 +0100 rt2x00: Properly request tx headroom for alignment operations. Current rt2x00 drivers may result in a "ieee80211_tx_status: headroom too small" error message when a frame needs to be properly aligned before transmitting it. This is because the space needed to ensure proper alignment isn't requested from mac80211. Fix this by adding sufficient amount of alignment space to the amount of headroom requested for TX frames. Reported-by: David Ellingsworth Signed-off-by: Gertjan van Wingerde Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit cf0277e714a0db302a8f80e1b85fd61c32cf00b3 Author: Johannes Berg Date: Tue Jan 5 18:00:58 2010 +0100 mac80211: fix skb buffering issue Since I removed the master netdev, we've been keeping internal queues only, and even before that we never told the networking stack above the virtual interfaces about congestion. This means that packets are queued in mac80211 and the upper layers never know, possibly leading to memory exhaustion and other problems. This patch makes all interfaces multiqueue and uses ndo_select_queue to put the packets into queues per AC. Additionally, when the driver stops a queue, we now stop all corresponding queues for the virtual interfaces as well. The injection case will use VO by default for non-data frames, and BE for data frames, but downgrade any data frames according to ACM. It needs to be fleshed out in the future to allow chosing the queue/AC in radiotap. Reported-by: Lennert Buytenhek Signed-off-by: Johannes Berg Cc: stable@kernel.org [2.6.32] Signed-off-by: John W. Linville commit 301a8234ea81938f0f083ae4e274d9c9296f3c86 Author: Gertjan van Wingerde Date: Wed Dec 30 11:36:33 2009 +0100 rt2x00: Fix LED configuration setting for rt2800. rt2800_blink_set uses an illegal value to set the LED_CFG_G_LED_MODE field of the LED_CFG register. This field is only 2 bits large, so should be initialized with value that fits. Use default value from the vendor driver. Signed-off-by: Gertjan van Wingerde Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit b59a52f12e483b79e7d32da7ec30dcf3b2e0210b Author: Pavel Roskin Date: Wed Dec 30 11:36:29 2009 +0100 rt2x00: use correct headroom for transmission Use rt2x00dev->ops->extra_tx_headroom, not rt2x00dev->hw->extra_tx_headroom in the tx code, as the later may include other headroom not to be used in the chipset driver. Signed-off-by: Pavel Roskin Signed-off-by: Gertjan van Wingerde Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit e12822e1d3fface0d9e1095c5177e10141bd6bd6 Author: Luis R. Rodriguez Date: Mon Jan 4 11:37:39 2010 -0500 cfg80211: fix syntax error on user regulatory hints This fixes a syntax error when setting up the user regulatory hint. This change yields the same exact binary object though so it ends up just being a syntax typo fix, fortunately. Cc: stable@kernel.org Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit 359207c687cc8f4f9845c8dadd0d6dabad44e584 Author: Luis R. Rodriguez Date: Mon Jan 4 10:40:39 2010 -0500 ath5k: Fix eeprom checksum check for custom sized eeproms Commit 8bf3d79bc401ca417ccf9fc076d3295d1a71dbf5 enabled EEPROM checksum checks to avoid bogus bug reports but failed to address updating the code to consider devices with custom EEPROM sizes. Devices with custom sized EEPROMs have the upper limit size stuffed in the EEPROM. Use this as the upper limit instead of the static default size. In case of a checksum error also provide back the max size and whether or not this was the default size or a custom one. If the EEPROM is busted we add a failsafe check to ensure we don't loop forever or try to read bogus areas of hardware. This closes bug 14874 http://bugzilla.kernel.org/show_bug.cgi?id=14874 Cc: stable@kernel.org Cc: David Quan Cc: Stephen Beahm Reported-by: Joshua Covington Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit 7de3c5dc0ac89b847b00f25d16976c158dc38e4c Author: Benoit Papillault Date: Sun Jan 3 10:20:01 2010 +0100 zd1211rw: Fix multicast filtering. If multicast parameter (as returned by zd_op_prepare_multicast) has changed, no bit in changed_flags is set. To handle this situation, we do not return if changed_flags is 0. If we do so, we will have some issue with IPv6 which uses multicast for link layer address resolution. Signed-off-by: Benoit Papillault Signed-off-by: John W. Linville commit 8a9ac160e844c7ce8074f6aa531feefb4acdee7c Author: Dan Carpenter Date: Sun Jan 3 11:19:35 2010 +0200 iwl: off by one bug tid is used as an array offset. agg = &priv->stations[sta_id].tid[tid].agg; iwl4965_tx_status_reply_tx(priv, agg, tx_resp, txq_id, index); It should be limitted to MAX_TID_COUNT - 1; struct iwl_tid_data tid[MAX_TID_COUNT]; regards, dan carpenter Signed-off-by: Dan Carpenter CC: stable@kernel.org Signed-off-by: John W. Linville commit 90852f7aed0f90d443efd7e0f9b82d8ac8186848 Author: Lennert Buytenhek Date: Sat Jan 2 10:31:42 2010 +0100 mwl8k: fix configure_filter() memory leak on error If there was an error acquiring the firmware lock in mwl8k_configure_filter(), we would end up leaking the multicast command packet prepared by mwl8k_prepare_multicast(). Signed-off-by: Lennert Buytenhek Signed-off-by: John W. Linville commit 13bda1225072f26603d3aeefc1f14c18b2ab29cd Author: Ming Lei Date: Tue Dec 29 22:57:28 2009 +0800 ath9k: fix ito64 The unit of sizeof() is byte instead of bit, so fix it. The patch can fix debug output of some dma_addr_t variables. Signed-off-by: John W. Linville commit 4ef250114f6672dd36f9b961a71d229642517645 Author: Dominik Geyer Date: Tue Dec 29 08:27:57 2009 +0100 ath9k: Fix Kconfig depends for ATH9K_DEBUGFS Add missing DEBUG_FS dependency for ATH9K_DEBUGFS in ath9k's Kconfig. Signed-off-by: Dominik D. Geyer Signed-off-by: John W. Linville commit abf2a117c67a67fbb611913a31109d0ff66ab073 Author: Roel Kluin Date: Fri Jan 1 18:35:11 2010 -0800 Input: gf2k - fix &&/|| confusion in gf2k_connect() This always evaluates to true. Signed-off-by: Roel Kluin Signed-off-by: Dmitry Torokhov commit 53281b6d34d44308372d16acb7fb5327609f68b6 Author: Linus Torvalds Date: Wed Dec 16 08:23:37 2009 -0800 fasync: split 'fasync_helper()' into separate add/remove functions Yes, the add and remove cases do share the same basic loop and the locking, but the compiler can inline and then CSE some of the end result anyway. And splitting it up makes the code way easier to follow, and makes it clearer exactly what the semantics are. In particular, we must make sure that the FASYNC flag in file->f_flags exactly matches the state of "is this file on any fasync list", since not only is that flag visible to user space (F_GETFL), but we also use that flag to check whether we need to remove any fasync entries on file close. We got that wrong for the case of a mixed use of file locking (which tries to remove any fasync entries for file leases) and fasync. Splitting the function up also makes it possible to do some future optimizations without making the function even messier. In particular, since the FASYNC flag has to match the state of "is this on a list", we can do the following future optimizations: - on remove, we don't even need to get the locks and traverse the list if FASYNC isn't set, since we can know a priori that there is no point (this is effectively the same optimization that we already do in __fput() wrt removing fasync on file close) - on add, we can use the FASYNC flag to decide whether we are changing an existing entry or need to allocate a new one. but this is just the cleanup + fix for the FASYNC flag. Acked-by: Al Viro Tested-by: Tavis Ormandy Cc: Jeff Dike Cc: Matt Mackall Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 3975bc56305256af7689bcce62284fc62e09fc8f Author: Robert Schedel Date: Fri Dec 11 00:37:11 2009 +0100 HID: Support 171 byte variant of Samsung USB IR receiver Extends the existing Samsung USB IrDA (0419:0001) quirk with newly reported 171 byte variant. It needs the same quirk as the other devices already supported by hid-samsung (wrong logical range) Refactors duplicate trace call into local helper function. The original bug report for the new variant is available at the second half of this ticket page: https://bugs.launchpad.net/bugs/326986 Signed-off-by: Robert Schedel Signed-off-by: Jiri Kosina commit 70c66567d1e41d8b2186a2d198997a1c8d79c0c4 Author: Petr Štetiar Date: Wed Dec 9 22:09:53 2009 +0100 HID: blacklist ET&T TC5UH touchscreen controller This patch adds ET&T TC5UH touchscreen controller to HID blacklist, because this device is handled by input/usbtouchscreen driver. Signed-off-by: Petr Štetiar Signed-off-by: Jiri Kosina