commit 6b0cd00bc396daf5c2dcf17a8d82055335341f46 Merge: c8d86d8 47f43e7 Author: Linus Torvalds Date: Thu Oct 7 13:59:32 2010 -0700 Merge branch 'hwpoison-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6 * 'hwpoison-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6: HWPOISON: Stop shrinking at right page count HWPOISON: Report correct address granuality for AO huge page errors HWPOISON: Copy si_addr_lsb to user page-types.c: fix name of unpoison interface commit c8d86d8ac439ef6c9364bf0ba3a05a3f9a8e0dea Merge: 74de82e 430c62f Author: Linus Torvalds Date: Thu Oct 7 13:54:56 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: elevator: fix oops on early call to elevator_change() commit 74de82ed1e49d9c7af84c3beb3759316854f54ed Merge: dda9cd9 5c04f55 Author: Linus Torvalds Date: Thu Oct 7 13:50:48 2010 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: check return code of read_sb_page md/raid1: minor bio initialisation improvements. md/raid1: avoid overflow in raid1 resync when bitmap is in use. commit dda9cd9fb30dfe6f2a51a394c18aef7c401b497d Merge: afe1474 dab8dcf Author: Linus Torvalds Date: Thu Oct 7 13:47:20 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: don't drop handle reference on unload drm/ttm: Fix two race conditions + fix busy codepaths commit afe147466c8f22a69eb470ab504608a9f4ae3345 Merge: 5710c2b f6cd378 Author: Linus Torvalds Date: Thu Oct 7 13:46:33 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - fix runtime PM related deadlock Input: joydev - fix JSIOCSAXMAP ioctl Input: uinput - setup MT usage during device creation commit 5710c2b275b3c0434f0de8f4ce6721aaf4c2a100 Merge: a4099ae 081003f Author: Linus Torvalds Date: Thu Oct 7 13:45:26 2010 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: properly account for reclaimed inodes commit a4099ae79d04ecf31bd0fc5aa4c1472b6fa7993a Merge: 5672bc8 cc6e853 Author: Linus Torvalds Date: Thu Oct 7 13:45:00 2010 -0700 Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (37 commits) V4L/DVB: v4l: radio: si470x: fix unneeded free_irq() call V4L/DVB: v4l: videobuf: prevent passing a NULL to dma_free_coherent() V4L/DVB: ir-core: Fix null dereferences in the protocols sysfs interface V4L/DVB: v4l: s5p-fimc: Fix 3-planar formats handling and pixel offset error on S5PV210 SoCs V4L/DVB: v4l: s5p-fimc: Fix return value on probe() failure V4L/DVB: uvcvideo: Restrict frame rates for Chicony CNF7129 webcam V4L/DVB: uvcvideo: Fix support for Medion Akoya All-in-one PC integrated webcam V4L/DVB: ivtvfb: prevent reading uninitialized stack memory V4L/DVB: cx25840: Fix typo in volume control initialization: 65335 vs. 65535 V4L/DVB: v4l: mem2mem_testdev: add missing release for video_device V4L/DVB: v4l: mem2mem_testdev: fix errorenous comparison V4L/DVB: mt9v022.c: Fixed compilation warning V4L/DVB: mt9m111: added current colorspace at g_fmt V4L/DVB: mt9m111: cropcap and s_crop check if type is VIDEO_CAPTURE V4L/DVB: mx2_camera: fix a race causing NULL dereference V4L/DVB: tm6000: bugfix data handling V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images V4L/DVB: videobuf-dma-sg: set correct size in last sg element V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0) V4L/DVB: dvb: fix smscore_getbuffer() logic ... commit 5672bc8181b189c05ccc29c692491500682a1b49 Merge: 27b3d80 925bb9c Author: Linus Torvalds Date: Thu Oct 7 13:44:30 2010 -0700 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: of/i2c: Fix module load order issue caused by of_i2c.c i2c: Fix checks which cause legacy suspend to never get called i2c-pca: Fix waitforcompletion() return value i2c: Fix for suspend/resume issue i2c: Remove obsolete cleanup for clientdata commit 27b3d80a7b6adcf069b5e869e4efcc3a79f88a91 Author: Eric Dumazet Date: Thu Oct 7 12:59:29 2010 -0700 sysctl: fix min/max handling in __do_proc_doulongvec_minmax() When proc_doulongvec_minmax() is used with an array of longs, and no min/max check requested (.extra1 or .extra2 being NULL), we dereference a NULL pointer for the second element of the array. Noticed while doing some changes in network stack for the "16TB problem" Fix is to not change min & max pointers in __do_proc_doulongvec_minmax(), so that all elements of the vector share an unique min/max limit, like proc_dointvec_minmax(). [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Eric Dumazet Cc: "Eric W. Biederman" Cc: Americo Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aaac7d9e0a0630e79069341a37978b39e4bca704 Author: Kyungmin Park Date: Thu Oct 7 12:59:28 2010 -0700 MAINTAINERS: add Samsung S5P series FIMC maintainers Add Samsung S5P series FIMC(Camera Interface) maintainers. Signed-off-by: Kyungmin Park Cc: Kyungmin Park Cc: Sylwester Nawrocki Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 880b0e2649b55ccd73b304dedb69aa1221a88f9c Author: Andrew Morton Date: Thu Oct 7 12:59:28 2010 -0700 MAINTAINERS: Haavard has moved Cc: Haavard Skinnemoen Cc: Hans-Christian Egtvedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ad4ca5f4b70236dab5e457ff6567d36f75d2e7c5 Author: Kirill A. Shutemov Date: Thu Oct 7 12:59:27 2010 -0700 memcg: fix thresholds with use_hierarchy == 1 We need to check parent's thresholds if parent has use_hierarchy == 1 to be sure that parent's threshold events will be triggered even if parent itself is not active (no MEM_CGROUP_EVENTS). Signed-off-by: Kirill A. Shutemov Reviewed-by: Daisuke Nishimura Acked-by: KAMEZAWA Hiroyuki Acked-by: Balbir Singh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f241e6607b5a5aefa23c652dbe947b7465633984 Author: Robin Holt Date: Thu Oct 7 12:59:26 2010 -0700 mm: alloc_large_system_hash() printk overflow on 16TB boot During boot of a 16TB system, the following is printed: Dentry cache hash table entries: -2147483648 (order: 22, 17179869184 bytes) Signed-off-by: Robin Holt Reviewed-by: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 47f43e7efadacc627f325aba64c6a547de0926db Author: Andi Kleen Date: Tue Sep 28 07:37:55 2010 +0200 HWPOISON: Stop shrinking at right page count When we call the slab shrinker to free a page we need to stop at page count one because the caller always holds a single reference, not zero. This avoids useless looping over slab shrinkers and freeing too much memory. Reviewed-by: Wu Fengguang Signed-off-by: Andi Kleen commit 0d9ee6a2d4a6e92c49e6fa9469e5731d21ee203e Author: Andi Kleen Date: Mon Sep 27 22:03:33 2010 +0200 HWPOISON: Report correct address granuality for AO huge page errors The SIGBUS user space signalling is supposed to report the address granuality of a corruption. Pass this information correctly for huge pages by querying the hpage order. Reviewed-by: Naoya Horiguchi Reviewed-by: Wu Fengguang Signed-off-by: Andi Kleen commit a337fdac7a5622d1e6547f4b476c14dfe5a2c892 Author: Andi Kleen Date: Mon Sep 27 20:32:19 2010 +0200 HWPOISON: Copy si_addr_lsb to user The original hwpoison code added a new siginfo field si_addr_lsb to pass the granuality of the fault address to user space. Unfortunately this field was never copied to user space. Fix this here. I added explicit checks for the MCEERR codes to avoid having to patch all potential callers to initialize the field. Signed-off-by: Andi Kleen commit 67159813127309c1a65d86e40fa0368241fa668c Author: Naoya Horiguchi Date: Wed Sep 8 10:19:41 2010 +0900 page-types.c: fix name of unpoison interface The page-types utility still uses an out of date name for the unpoison interface: debugfs:hwpoison/renew-pfn This patch renames and fixes it. Signed-off-by: Naoya Horiguchi Acked-by: Wu Fengguang Signed-off-by: Andi Kleen commit 430c62fb2948d964cf8dc7f3e2f69623c04ef62f Author: Jens Axboe Date: Thu Oct 7 09:35:16 2010 +0200 elevator: fix oops on early call to elevator_change() 2.6.36 introduces an API for drivers to switch the IO scheduler instead of manually calling the elevator exit and init functions. This API was added since q->elevator must be cleared in between those two calls. And since we already have this functionality directly from use by the sysfs interface to switch schedulers online, it was prudent to reuse it internally too. But this API needs the queue to be in a fully initialized state before it is called, or it will attempt to unregister elevator kobjects before they have been added. This results in an oops like this: BUG: unable to handle kernel NULL pointer dereference at 0000000000000051 IP: [] sysfs_create_dir+0x2e/0xc0 PGD 47ddfc067 PUD 47c6a1067 PMD 0 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/0000:04:00.1/irq CPU 2 Modules linked in: t(+) loop hid_apple usbhid ahci ehci_hcd uhci_hcd libahci usbcore nls_base igb Pid: 7319, comm: modprobe Not tainted 2.6.36-rc6+ #132 QSSC-S4R/QSSC-S4R RIP: 0010:[] [] sysfs_create_dir+0x2e/0xc0 RSP: 0018:ffff88027da25d08 EFLAGS: 00010246 RAX: ffff88047c68c528 RBX: 00000000fffffffe RCX: 0000000000000000 RDX: 000000000000002f RSI: 000000000000002f RDI: ffff88047e196c88 RBP: ffff88027da25d38 R08: 0000000000000000 R09: d84156c5635688c0 R10: d84156c5635688c0 R11: 0000000000000000 R12: ffff88047e196c88 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88047c68c528 FS: 00007fcb0b26f6e0(0000) GS:ffff880287400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000051 CR3: 000000047e76e000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 7319, threadinfo ffff88027da24000, task ffff88027d377090) Stack: ffff88027da25d58 ffff88047c68c528 00000000fffffffe ffff88047e196c88 <0> ffff88047c68c528 ffff88047e05bd90 ffff88027da25d78 ffffffff8123fb77 <0> ffff88047e05bd90 0000000000000000 ffff88047e196c88 ffff88047c68c528 Call Trace: [] kobject_add_internal+0xe7/0x1f0 [] kobject_add_varg+0x38/0x60 [] kobject_add+0x69/0x90 [] ? sysfs_remove_dir+0x20/0xa0 [] ? sub_preempt_count+0x9d/0xe0 [] ? _raw_spin_unlock+0x30/0x50 [] ? sysfs_remove_dir+0x20/0xa0 [] ? sysfs_remove_dir+0x34/0xa0 [] elv_register_queue+0x34/0xa0 [] elevator_change+0xfd/0x250 [] ? t_init+0x0/0x361 [t] [] ? t_init+0x0/0x361 [t] [] t_init+0xa8/0x361 [t] [] do_one_initcall+0x3e/0x170 [] sys_init_module+0xbd/0x220 [] system_call_fastpath+0x16/0x1b Code: e5 41 56 41 55 41 54 49 89 fc 53 48 83 ec 10 48 85 ff 74 52 48 8b 47 18 49 c7 c5 00 46 61 81 48 85 c0 74 04 4c 8b 68 30 45 31 f6 <41> 80 7d 51 00 74 0e 49 8b 44 24 28 4c 89 e7 ff 50 20 49 89 c6 RIP [] sysfs_create_dir+0x2e/0xc0 RSP CR2: 0000000000000051 ---[ end trace a6541d3bf07945df ]--- Fix this by adding a registered bit to the elevator queue, which is set when the sysfs kobjects have been registered. Signed-off-by: Jens Axboe commit dab8dcfa3c8e3b021a138bee7c17791b4991ba55 Author: Dave Airlie Date: Thu Oct 7 14:01:17 2010 +1000 drm: don't drop handle reference on unload since the handle references are all tied to a file_priv, and when it disappears all the handle refs go with it. The fbcon ones we'd only notice on unload, but the nouveau notifier one would would happen on reboot. nouveau: Reported-by: Marc Dionne nouveau: Tested-by: Marc Dionne i915 unload: Reported-by: Keith Packard Acked-by: Ben Skeggs Signed-off-by: Dave Airlie commit 081003fff467ea0e727f66d5d435b4f473a789b3 Author: Johannes Weiner Date: Fri Oct 1 07:43:54 2010 +0000 xfs: properly account for reclaimed inodes When marking an inode reclaimable, a per-AG counter is increased, the inode is tagged reclaimable in its per-AG tree, and, when this is the first reclaimable inode in the AG, the AG entry in the per-mount tree is also tagged. When an inode is finally reclaimed, however, it is only deleted from the per-AG tree. Neither the counter is decreased, nor is the parent tree's AG entry untagged properly. Since the tags in the per-mount tree are not cleared, the inode shrinker iterates over all AGs that have had reclaimable inodes at one point in time. The counters on the other hand signal an increasing amount of slab objects to reclaim. Since "70e60ce xfs: convert inode shrinker to per-filesystem context" this is not a real issue anymore because the shrinker bails out after one iteration. But the problem was observable on a machine running v2.6.34, where the reclaimable work increased and each process going into direct reclaim eventually got stuck on the xfs inode shrinking path, trying to scan several million objects. Fix this by properly unwinding the reclaimable-state tracking of an inode when it is reclaimed. Signed-off-by: Johannes Weiner Cc: stable@kernel.org Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit 5c04f5512f8134c75cd36e5b0354e10e330f4e6e Author: Vasiliy Kulikov Date: Fri Oct 1 14:18:12 2010 -0700 md: check return code of read_sb_page Function read_sb_page may return ERR_PTR(...). Check for it. Signed-off-by: Vasiliy Kulikov Cc: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: NeilBrown commit db8d9d3591f77cc6b66248b2cdfa1c43deee5ec9 Author: NeilBrown Date: Thu Oct 7 12:00:50 2010 +1100 md/raid1: minor bio initialisation improvements. When performing a resync we pre-allocate some bios and repeatedly use them. This requires us to re-initialise them each time. One field (bi_comp_cpu) and some flags weren't being initiaised reliably. Signed-off-by: NeilBrown commit 7571ae887d3b96d8e7ce63d43828866c6a91cdc6 Author: NeilBrown Date: Thu Oct 7 11:54:46 2010 +1100 md/raid1: avoid overflow in raid1 resync when bitmap is in use. bitmap_start_sync returns - via a pass-by-reference variable - the number of sectors before we need to check with the bitmap again. Since commit ef4256733506f245 this number can be substantially larger, 2^27 is a common value. Unfortunately it is an 'int' and so when raid1.c:sync_request shifts it 9 places to the left it becomes 0. This results in a zero-length read which the scsi layer justifiably complains about. This patch just removes the shift so the common case becomes safe with a trivially-correct patch. In the next merge window we will convert this 'int' to a 'sector_t' Reported-by: "George Spelvin" Signed-off-by: NeilBrown commit 1df6a2ebd75067aefbdf07482bf8e3d0584e04ee Author: Thomas Hellstrom Date: Thu Sep 30 12:36:45 2010 +0200 drm/ttm: Fix two race conditions + fix busy codepaths This fixes a race pointed out by Dave Airlie where we don't take a buffer object about to be destroyed off the LRU lists properly. It also fixes a rare case where a buffer object could be destroyed in the middle of an accelerated eviction. The patch also adds a utility function that can be used to prematurely release GPU memory space usage of an object waiting to be destroyed. For example during eviction or swapout. The above mentioned commit didn't queue the buffer on the delayed destroy list under some rare circumstances. It also didn't completely honor the remove_all parameter. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=615505 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=591061 Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit f6cd378372bff06093d72f978c0150eeed3ea201 Author: Dmitry Torokhov Date: Mon Oct 4 21:46:11 2010 -0700 Input: wacom - fix runtime PM related deadlock When runtime PM is enabled by default for input devices, X hangs in wacom open: [] mutex_lock+0x1a/0x40 [] wacom_resume+0x3b/0x90 [wacom] [] usb_resume_interface+0xd2/0x190 [] usb_resume_both+0x6d/0x110 [] usb_runtime_resume+0x24/0x40 [] __pm_runtime_resume+0x26f/0x450 [] __pm_runtime_resume+0x1da/0x450 [] pm_runtime_resume+0x2a/0x50 [] usb_autopm_get_interface+0x26/0x60 [] wacom_open+0x36/0x90 [wacom] wacom_open() takes wacom->lock and calls usb_autopm_get_interface(), which in turn calls wacom_resume() which tries to acquire the lock again. The fix is to call usb_autopm_get_interface() first, before we take the lock. Since we do not do usb_autopm_put_interface() until wacom_close() is called runtime PM is effectively disabled for the driver, however changing it now would risk regressions so the complete fix will have to wait till the next merge window. Reported-by: Jiri Slaby Acked-by: Oliver Neukum Signed-off-by: Dmitry Torokhov commit 925bb9c649cf8d7200549b395f2ae291833dd494 Author: Grant Likely Date: Thu Sep 30 14:14:23 2010 +0200 of/i2c: Fix module load order issue caused by of_i2c.c Commit 959e85f7, "i2c: add OF-style registration and binding" caused a module dependency loop where of_i2c.c calls functions in i2c-core, and i2c-core calls of_i2c_register_devices() in of_i2c. This means that when i2c support is built as a module when CONFIG_OF is set, then neither i2c_core nor of_i2c are able to be loaded. This patch fixes the problem by moving the of_i2c_register_devices() calls back into the device drivers. Device drivers already specifically request the core code to parse the device tree for devices anyway by setting the of_node pointer, so it isn't a big deal to also call the registration function. The drivers just become slightly more verbose. Signed-off-by: Grant Likely Signed-off-by: Jean Delvare commit 64b4782fc9e4bdc59ae90897e2258e4ec938690e Author: Rajendra Nayak Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Fix checks which cause legacy suspend to never get called For devices which are not adapted to runtime PM a call to pm_runtime_suspended always returns true. Hence the pm_runtime_suspended checks below prevent legacy suspend from getting called. So do a pm_runtime_suspended check only for devices with a dev_pm_ops populated (which hence do not rely on the legacy suspend.) Signed-off-by: Rajendra Nayak Acked-by: Rafael J. Wysocki Cc: Ben Dooks Cc: Mark Brown Cc: Kevin Hilman Signed-off-by: Jean Delvare commit 6abb930af064fb1cf4177d32e2c7bfb89eee0fe5 Author: Yegor Yefremov Date: Thu Sep 30 14:14:22 2010 +0200 i2c-pca: Fix waitforcompletion() return value ret is still -1, if during the polling read_byte() returns at once with I2C_PCA_CON_SI set. So ret > 0 would lead *_waitforcompletion() to return 0, in spite of the proper behavior. The routine was rewritten, so that ret has always a proper value, before returning. Signed-off-by: Yegor Yefremov Reviewed-by: Wolfram Sang Cc: stable@kernel.org Signed-off-by: Jean Delvare commit 753419f59e10d7181e43f0b9cc5beff43ef3f7a4 Author: Vishwanath BS Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Fix for suspend/resume issue In current i2c core driver, call to pm_runtime_set_active from i2c_device_pm_resume will unconditionally enable i2c module and increment child count of the parent. Because of this, in CPU Idle path, i2c does not idle, preventing Core to enter retention. Also i2c module will not be suspended upon system suspend as pm_runtime_set_suspended is not called from i2c_device_pm_suspend. This issue is fixed by removing pm_runtime_set_active call from resume path which is not necessary. This fix has been tested on OMAP4430. Signed-off-by: Partha Basak Signed-off-by: Vishwanath BS Acked-by: Rafael J. Wysocki Cc: Kevin Hilman Cc: Ben Dooks Signed-off-by: Jean Delvare commit 59bfee6e0682635c269fb271422e2595fa441c21 Author: Wolfram Sang Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Remove obsolete cleanup for clientdata A few new i2c-drivers came into the kernel which clear the clientdata-pointer on exit. This is obsolete meanwhile, so fix it and hope the word will spread. Signed-off-by: Wolfram Sang Acked-by: Mark Brown Signed-off-by: Jean Delvare commit cc6e853c5e49ea3698e87415672d818c6d7a5ee9 Author: Marek Szyprowski Date: Sun Sep 5 02:42:33 2010 -0300 V4L/DVB: v4l: radio: si470x: fix unneeded free_irq() call In case of error during probe() the driver calls free_irq() function on not yet allocated irq. This patches fixes the call sequence in case of the error. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit b2b476f53a9d24b00a313adf7f6ca92515a2af54 Author: Pawel Osciak Date: Tue Jul 20 13:49:16 2010 -0300 V4L/DVB: v4l: videobuf: prevent passing a NULL to dma_free_coherent() When a driver that uses videobuf-dma-contig is used with the USERPTR memory access method a kernel oops might happen: a NULL address may be passed to dma_free_coherent(). This happens when an application calls REQBUFS and then exits without queuing any buffers. This patch fixes that bug. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit a08c7c68f702e2a2797a4035b6c0a756c4886c26 Author: Brian Rogers Date: Wed Sep 22 08:06:43 2010 -0300 V4L/DVB: ir-core: Fix null dereferences in the protocols sysfs interface For some cards, ir_dev->props and ir_dev->raw are both NULL. These cards are using built-in IR decoding instead of raw, and can't easily be made to switch protocols. So upon reading /sys/class/rc/rc?/protocols on such a card, return 'builtin' as the supported and enabled protocol. Return -EINVAL on any attempts to change the protocol. And most important of all, don't crash. Signed-off-by: Brian Rogers Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit ddc79e0fdc16c05c3ff7f9b6ae9052bda0506108 Author: Sylwester Nawrocki Date: Mon Sep 6 03:53:44 2010 -0300 V4L/DVB: v4l: s5p-fimc: Fix 3-planar formats handling and pixel offset error on S5PV210 SoCs Fix DMA engine pixel offset calculation for 3-planar YUV formats. On S5PV210 SoCs horizontal offset is applied as number of pixels, not bytes per line. [mchehab@redhat.com: CodingStyle cleanup] Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab commit 81c69fc200bfa2f3a8b2fed614d1c6670c4a7e14 Author: Pawel Osciak Date: Mon Sep 6 03:53:43 2010 -0300 V4L/DVB: v4l: s5p-fimc: Fix return value on probe() failure On failed create_workqueue() fimc_probe() was returning 0. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab commit 86d8b6abbbc973a1dd7d3c8f9e3c3e06131703b2 Author: Laurent Pinchart Date: Thu Sep 16 12:37:26 2010 -0300 V4L/DVB: uvcvideo: Restrict frame rates for Chicony CNF7129 webcam At all frame rates except 30fps and 5fps the camera produces very dark pictures. Auto-exposure is probably disabled by the camera at all frame rates except 30fps, making them pretty unusable. Work around the problem by introducing a new RESTRICT_FRAME_RATE quirk that disables all the frame rates except the default one. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 9275b32bced808bd57bdf3884748ed1126ba90e0 Author: Laurent Pinchart Date: Sun Sep 12 08:31:29 2010 -0300 V4L/DVB: uvcvideo: Fix support for Medion Akoya All-in-one PC integrated webcam The camera requires the STREAM_NO_FID quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 405707985594169cfd0b1d97d29fcb4b4c6f2ac9 Author: Dan Rosenberg Date: Wed Sep 15 18:44:22 2010 -0300 V4L/DVB: ivtvfb: prevent reading uninitialized stack memory The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit fc00a1d90d7b64e44c2475833cc3021066f67ea7 Author: Andy Walls Date: Thu Sep 16 20:54:47 2010 -0300 V4L/DVB: cx25840: Fix typo in volume control initialization: 65335 vs. 65535 The wrong value for the volume control limit, 65335 vs. 65535, prevents proper cx25840 v4l2_subdevice initialization. Reported-by: Igor M. liplianin Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit 71088bad7426650e4ea5fb4182580ea8458442e7 Author: Pawel Osciak Date: Fri Sep 10 02:05:48 2010 -0300 V4L/DVB: v4l: mem2mem_testdev: add missing release for video_device Video device was not being released on driver remove. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit b17a200f923070104a5b97085ed09ba0f682f637 Author: Pawel Osciak Date: Fri Sep 10 02:02:32 2010 -0300 V4L/DVB: v4l: mem2mem_testdev: fix errorenous comparison Output buffer has to be at least the size of input buffer, not the other way around. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit 23f0cb62ba3a1a11ab02cb0675f28befc56c89b9 Author: Ionut Gabriel Popescu Date: Fri Sep 3 18:20:41 2010 -0300 V4L/DVB: mt9v022.c: Fixed compilation warning The drivers/media/video/mt9v022.c file, on line 405, tries a "case 0" o a v4l2_mbus_pixelcode enum which don't have an 0 value element, so I got a compile warning. That "case" is useless so it can be removed. Signed-off-by: Ionut Gabriel Popescu Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 01f5a394eac48b74c84434e95e74cd172b0682c3 Author: Michael Grzeschik Date: Tue Aug 3 07:57:45 2010 -0300 V4L/DVB: mt9m111: added current colorspace at g_fmt Signed-off-by: Michael Grzeschik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 6b6d33c746ace7bd0dbbdde674d3fb1100ab081d Author: Michael Grzeschik Date: Tue Aug 3 07:57:44 2010 -0300 V4L/DVB: mt9m111: cropcap and s_crop check if type is VIDEO_CAPTURE Signed-off-by: Philipp Wiesner Signed-off-by: Michael Grzeschik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 5384a12b23160e11ff949a94172051476d308b66 Author: Baruch Siach Date: Tue Jul 27 09:06:07 2010 -0300 V4L/DVB: mx2_camera: fix a race causing NULL dereference The mx25_camera_irq irq handler may get called after the camera has been deactivated (from mx2_camera_deactivate). Detect this situation, and bail out. Signed-off-by: Baruch Siach Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 1b376dac05058ac5c9616a507d95c19ea5ea2646 Author: Stefan Ringel Date: Thu Sep 9 14:45:22 2010 -0300 V4L/DVB: tm6000: bugfix data handling Signed-off-by: Stefan Ringel Signed-off-by: Mauro Carvalho Chehab commit 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d Author: Jean-François Moine Date: Mon Sep 13 05:22:37 2010 -0300 V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images As the end of frame marker does not contain any pixel, it must not be transferred. Reported-by: Ivo Jager Signed-off-by: Jean-François Moine Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 2fc11536cf5c0b8eb4eb7e01a2a672a189e9280f Author: Hans Verkuil Date: Tue Sep 7 06:10:45 2010 -0300 V4L/DVB: videobuf-dma-sg: set correct size in last sg element This fixes a nasty memory corruption bug when using userptr I/O. The function videobuf_pages_to_sg() sets up the scatter-gather list for the DMA transfer to the userspace pages. The first transfer is setup correctly (the size is set to PAGE_SIZE - offset), but all other transfers have size PAGE_SIZE. This is wrong for the last transfer which may be less than PAGE_SIZE. Most, if not all, drivers will program the boards DMA engine correctly, i.e. even though the size in the last sg element is wrong, they will do their own size calculations and make sure the right amount is DMA-ed, and so seemingly prevent memory corruption. However, behind the scenes the dynamic DMA mapping support (in lib/swiotlb.c) may create bounce buffers if the memory pages are not in DMA-able memory. This happens for example on a 64-bit linux with a board that only supports 32-bit DMA. These bounce buffers DO use the information in the sg list to determine the size. So while the DMA engine transfers the correct amount of data, when the data is 'bounced' back too much is copied, causing buffer overwrites. The fix is simple: calculate and set the correct size for the last sg list element. Signed-off-by: Hans Verkuil Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit c10469c637602c2385e2993d8c730cc44fd47d23 Author: Mauro Carvalho Chehab Date: Sat Sep 11 11:37:51 2010 -0300 V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0) As reported by: Carlos Americo Domiciano : [ 220.033500] cx231xx v4l2 driver loaded. [ 220.033571] cx231xx #0: New device Conexant Corporation Polaris AV Capturb @ 480 Mbps (1554:5010) with 6 interfaces [ 220.033577] cx231xx #0: registering interface 0 [ 220.033591] cx231xx #0: registering interface 1 [ 220.033654] cx231xx #0: registering interface 6 [ 220.033910] cx231xx #0: Identified as Unknown CX231xx video grabber (card=0) [ 220.033946] BUG: unable to handle kernel NULL pointer dereference at (null) [ 220.033955] IP: [] cx231xx_pre_card_setup+0x5d/0xb0 [cx231xx] Thanks-to: Carlos Americo Domiciano Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 3cdadc50bbe8f04c1231c8af614cafd7ddd622bf Author: Richard Zidlicky Date: Tue Aug 24 09:52:36 2010 -0300 V4L/DVB: dvb: fix smscore_getbuffer() logic Drivers shouldn't sleep while holding a spinlock. A previous workaround were to release the spinlock before callinc schedule(). This patch uses a different approach: it just waits for the siano hardware to answer. Signed-off-by: Richard Zidlicky Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 970d14c6cca8c71307a4d23fe373c5895175b2d7 Author: Olivier Grenie Date: Tue Sep 7 12:50:46 2010 -0300 V4L/DVB: dib7000p: add disable sample and hold, and diversity delay parameter This patch improves the overall driver performance in diversity-reception scenarios. Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 90e12cec707204930934acdb5efce5f94a163a5f Author: Olivier Grenie Date: Tue Sep 7 12:50:45 2010 -0300 V4L/DVB: dib7770: enable the current mirror To improve performance on DiB7770-devices enabling the current mirror is needed. This patch adds an option to the dib7000p-driver to do that and it creates a separate device-entry in dib0700-device to use those changes on hardware which is using the DiB7770. Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit 00a220aa98133dc43c6f7016c218aaf3afd66e11 Author: Maxim Levitsky Date: Mon Sep 6 18:26:10 2010 -0300 V4L/DVB: IR: extend MCE keymap These keys are found on remote bundled with Toshiba Qosmio F50-10q. Found and tested by, Sami R Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit e0172fd373ab77a83ea952fd6a75c612e1b0bf9e Author: Maxim Levitsky Date: Mon Sep 6 18:26:09 2010 -0300 V4L/DVB: IR: fix keys beeing stuck down forever The logic in ir_timer_keyup was inverted. In case that values aren't equal, the meaning of the time_is_after_eq_jiffies(ir->keyup_jiffies) is that ir->keyup_jiffies is after the the jiffies or equally that that jiffies are before the the ir->keyup_jiffies which is exactly the situation we want to avoid (that the timeout is in the future) Confusing Eh? Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 67332ba83242f814490884161fee8676a9fd8a09 Author: Maxim Levitsky Date: Mon Sep 6 18:26:08 2010 -0300 V4L/DVB: IR: fix duty cycle capability Due to typo lirc bridge enabled wrong capability. Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 04cab131ce2a267b6777a98d68fbc0cae44d4ba8 Author: Mauro Carvalho Chehab Date: Wed Sep 8 12:58:12 2010 -0300 V4L/DVB: rc-core: increase repeat time As reported by Anton Blanchard , double IR events on 2.6.36-rc2 and a DViCO FusionHDTV DVB-T Dual Express are happening: [ 1351.032084] ir_keydown: i2c IR (FusionHDTV): key down event, key 0x0067, scancode 0x0051 [ 1351.281284] ir_keyup: keyup key 0x0067 ie one key down event and one key up event 250ms later. So, we need to increase the repeat timeout, to avoid this bug to hit. As we're doing it at core, this fix is not needed anymore at dib0700 driver. Thanks-to: Anton Blanchard Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 3bfb317f97cfddbbec67bbe8e35ad38af3507397 Author: Mauro Carvalho Chehab Date: Fri Sep 3 10:50:24 2010 -0300 V4L/DVB: Don't identify PV SBTVD Hybrid as a DibCom device As reported by Carlos, Prolink Pixelview SBTVD Hybrid is based on Conexant cx231xx + Fujitsu 86A20S demodulator. However, both shares the same USB ID. So, we need to use USB bcdDevice, in order to properly discover what's the board. We know for sure that bcd 0x100 is used for a dib0700 device, while bcd 0x4001 is used for a cx23102 device. This patch reserves two ranges, the first one from 0x0000-0x3f00 for dib0700, and the second from 0x4000-0x4fff for cx231xx devices. This may need fixes in the future, as we get access to other devices. Thanks-to: Carlos Americo Domiciano Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit c13df9cf6b1cad7fd088c9acceb98b6bffd9ca31 Author: Jarod Wilson Date: Fri Aug 27 18:21:14 2010 -0300 V4L/DVB: mceusb: add two new ASUS device IDs Reported in lirc sf.net tracker and on lirc mailing list Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 882787ff8fdeb0be790547ee9b22b281095e95da Author: Jason Wang Date: Fri Sep 3 06:57:19 2010 -0300 V4L/DVB: gspca - main: Fix a crash of some webcams on ARM arch When plugging some webcams on ARM, the system crashes. This is because we alloc buffer for an urb through usb_buffer_alloc, the alloced buffer is already in DMA coherent region, so we should set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when we submit this urb, the hcd core will handle this address as an non-DMA address and call dma_map_single/sg to map it. On arm architecture, dma_map_single a DMA coherent address will be catched by a BUG_ON(). Signed-off-by: Jason Wang Signed-off-by: Jean-François Moine Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 29d834912bbcf0d095e6cd0e95b0d9790fdf7957 Author: Dmitri Belimov Date: Mon Aug 23 10:30:14 2010 -0300 V4L/DVB: Fix regression for BeholdTV Columbus Some time a go our customers wrote me about problem with our TV card BeholdTV Columbus. It's PCMCIA TV card for notebook. As I understand v4l has some regression with autodetect address of tuners. I can set incorrect I2C address and had report about detect tuner. No any TV of course. When I set correct tuner type and I2C address of the tuners all works well. Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov Signed-off-by: Mauro Carvalho Chehab commit 23e64d55859ea619c17832645e0e56faac84d750 Author: Dan Carpenter Date: Thu Aug 19 07:00:22 2010 -0300 V4L/DVB: saa7164: move dereference under NULL check The original code dereferenced "port" before checking it for NULL. I moved the test down below the check. Also I changed the comparisons a little so people wouldn't get confused and think "port" and "buf" were ints instead of pointers. (Probably that's what lead to this issue in the first place.) There is only one caller for this function and it passes non-NULL pointers, so this is essentially a cleanup rather than a bugfix. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab commit d5337966ce4639c775ff5edf92d78f5fad34ef0d Author: Dan Carpenter Date: Thu Aug 19 06:50:04 2010 -0300 V4L/DVB: pvrusb2: remove unneeded NULL checks We dereference "maskptr" unconditionally at the start of the function and also inside the call to parse_tlist() towards the end of the function. This function is called from store_val_any() and it always passes a non-NULL pointer. Signed-off-by: Dan Carpenter Acked-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab commit a8e07124500184f81541ddf3e9669000af9ac4bc Author: Dan Carpenter Date: Thu Aug 19 06:47:50 2010 -0300 V4L/DVB: opera1: remove unneeded NULL check "fw" is always a non-NULL pointer at this point, and anyway release_firmware() accepts NULL pointers. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab commit 028816bc85db5ac6a562c2aff2113c7480d67919 Author: Dan Carpenter Date: Thu Aug 12 04:47:07 2010 -0300 V4L/DVB: IR: ir-raw-event: null pointer dereference The original code dereferenced ir->raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 590a58d18027b18db78f538aca592c2cdb249079 Author: Dan Carpenter Date: Thu Aug 12 04:41:58 2010 -0300 V4L/DVB: unlock on error path If we return directly here then we miss out on some mutex_unlock()s Signed-off-by: Dan Carpenter Acked-by: Sylwester Nawrocki Signed-off-by: Mauro Carvalho Chehab commit 0f63a14d357b3a80abb5203a574cbb3f8988c2f7 Author: lawrence rust Date: Tue Aug 24 06:50:48 2010 -0300 V4L/DVB: cx88: Kconfig: Remove EXPERIMENTAL dependency from VIDEO_CX88_ALSA The cx88-alsa module has been around since January 2006 and has seen no significant changes since September 2007. It is stable in operation and so I believe that the 'experimental' tag is no longer warranted. Signed-off-by: Mauro Carvalho Chehab commit fb0c484f72df9e336605b5659f39eb1ab5e8d946 Author: Randy Dunlap Date: Thu Aug 19 14:42:14 2010 -0300 V4L/DVB: tm6000: depends on IR_CORE tm6000 uses IR interfaces, so it should depend on IR_CORE. ERROR: "get_rc_map" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "ir_input_unregister" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "__ir_input_register" [drivers/staging/tm6000/tm6000.ko] undefined! Signed-off-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab commit d2520a426dc3033c00077e923a553fc6c98c7564 Author: Kenneth Waters Date: Tue Sep 21 00:58:23 2010 -0700 Input: joydev - fix JSIOCSAXMAP ioctl Fixed JSIOCSAXMAP ioctl to update absmap, the map from hardware axis to event axis in addition to abspam. This fixes a regression introduced by 999b874f. Signed-off-by: Kenneth Waters Cc: stable@kernel.org Signed-off-by: Dmitry Torokhov commit 38e7afe96c7c0ad900824911c61fdb04078033dc Author: Henrik Rydberg Date: Sun Sep 19 16:25:36 2010 -0700 Input: uinput - setup MT usage during device creation The input devices created by uinput do not currently handle multitouch properly. All events will appear as if they came from slot zero, and the input event buffers are not adjusted. This patch creates the MT slots during setup, and sets the number of events per packet based on the MT usage. Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov