commit c44ed965be7a84afaa07543c04eb97a5dfe93422 Author: Al Viro Date: Sun Mar 13 23:24:46 2011 +0000 compat breakage in preadv() and pwritev() Fix for a dumb preadv()/pwritev() compat bug - unlike the native variants, the compat_... ones forget to check FMODE_P{READ,WRITE}, so e.g. on pipe the native preadv() will fail with -ESPIPE and compat one will act as readv() and succeed. Not critical, but it's a clear bug with trivial fix, so IMO it's OK for -final. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit c9a816c0ecb8cef8e6573a8eab47fc48c765e0a1 Merge: 0e5b88c d9ebaa4 Author: Linus Torvalds Date: Sun Mar 13 16:01:11 2011 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon/f71882fg: Set platform drvdata to NULL later hwmon/f71882fg: Fix a typo in a comment commit 0e5b88cd9975dca6c191cc9bd11f233fac4ca882 Merge: eebea5d 36e39c4 Author: Linus Torvalds Date: Sun Mar 13 16:00:49 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: break out of shrink_delalloc earlier btrfs: fix not enough reserved space btrfs: fix dip leak Btrfs: make sure not to return overlapping extents to fiemap Btrfs: deal with short returns from copy_from_user Btrfs: fix regressions in copy_from_user handling commit eebea5d13d391981061d6ef069a841002eba4a7a Merge: 7840fea 52208ae Author: Linus Torvalds Date: Sun Mar 13 16:00:28 2011 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] target: Fix t_transport_aborted handling in LUN_RESET + active I/O shutdown commit 7840fea200cd1ad93ed19853a83752a21f691326 Author: Michal Marek Date: Fri Mar 11 22:34:47 2011 +0100 kbuild: Fix computing srcversion for modules Recent change to fixdep: commit b7bd182176960fdd139486cadb9962b39f8a2b50 Author: Michal Marek Date: Thu Feb 17 15:13:54 2011 +0100 fixdep: Do not record dependency on the source file itself changed the format of the *.cmd files without realizing that it is also used by modpost. Put the path to the source file to the file back, in a special variable, so that modpost sees all source files when calculating srcversion for modules. Reported-and-tested-by: Henrik Rydberg Signed-off-by: Michal Marek Signed-off-by: Linus Torvalds commit e8444a3e3b56b268c6ca31a2f77040fd944834fb Merge: 95a17a2 c804c73 Author: Linus Torvalds Date: Sun Mar 13 15:56:22 2011 -0700 Merge git://git.infradead.org/users/dwmw2/mtd-2.6.38 * git://git.infradead.org/users/dwmw2/mtd-2.6.38: mtd: add "platform:" prefix for platform modalias mtd: mtd_blkdevs: fix double free on error path mtd: amd76xrom: fix oops at boot when resources are not available mtd: fix race in cfi_cmdset_0001 driver mtd: jedec_probe: initialise make sector erase command variable mtd: jedec_probe: Change variable name from cfi_p to cfi commit 95a17a23a2189512bc76e7a5901521129d7ae9c1 Merge: 28db837 c640e8c Author: Linus Torvalds Date: Sun Mar 13 15:52:48 2011 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon: fix page flipping hangs on r300/r400 drm/radeon: add pageflip hooks for fusion commit 28db837693c84bc64e20d84aad00e2c0f206468a Merge: 4f680ce 0aeea18 Author: Linus Torvalds Date: Sun Mar 13 15:50:37 2011 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: fix mis-synchronisation in blkdev_issue_zeroout() commit 4f680ceafafebed72c302d829d764de72710c169 Merge: 19234cd db72f3f Author: Linus Torvalds Date: Sun Mar 13 15:50:01 2011 -0700 Merge branch 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/asoc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ASoC: Ensure WM8958 gets all WM8994 late revision widgets ASoC: Fix typo in late revision WM8994 DAC2R name ASoC: Use the correct DAPM context when cleaning up final widget set ASoC: Fix broken bitfield definitions in WM8978 ASoC: AM3517: Update codec name after multi-component update commit 19234cdda517396e5e0b10e77493afa9e30095c3 Author: Axel Lin Date: Fri Mar 11 14:58:30 2011 -0800 gpio: add MODULE_DEVICE_TABLE The device table is required to load modules based on modaliases. After adding MODULE_DEVICE_TABLE, below entries will be added to modules.pcimap: pch_gpio 0x00008086 0x00008803 0xffffffff 0xffffffff 0x00000000 0x00000000 0x0 ml_ioh_gpio 0x000010db 0x0000802e 0xffffffff 0xffffffff 0x00000000 0x00000000 0x0 Signed-off-by: Axel Lin Cc: Tomoya MORINAGA Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2da28bfd9665f49d40abb4c7720b43135feaf79a Author: Andrea Arcangeli Date: Fri Mar 11 14:58:29 2011 -0800 thp: fix page_referenced to modify mapcount/vm_flags only if page is found When vmscan.c calls page_referenced(), if an anon page was created before a process forked, rmap will search for it in both of the processes, even though one of them might have since broken COW. If the child process mlocks the vma where the COWed page belongs to, page_referenced() running on the page mapped by the parent would lead to *vm_flags getting VM_LOCKED set erroneously (leading to the references on the parent page being ignored and evicting the parent page too early). *mapcount would also be decremented by page_referenced_one even if the page wasn't found by page_check_address. This also lets pmdp_clear_flush_young_notify() go ahead on a pmd_trans_splitting() pmd. We hold the page_table_lock so __split_huge_page_map() must wait the pmdp_clear_flush_young_notify() to complete before it can modify the pmd. The pmd is also still mapped in userland so the young bit may materialize through a tlb miss before split_huge_page_map runs. This will provide a more accurate page_referenced() behavior during split_huge_page(). Signed-off-by: Andrea Arcangeli Reported-by: Michel Lespinasse Reviewed-by: Michel Lespinasse Reviewed-by: Minchan Kim Reviewed-by: Johannes Weiner Reviewed-by: Rik van Riel Reviewed-by: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d9ebaa45472c92704f4814682eec21455edcfa1f Author: Hans de Goede Date: Sun Mar 13 13:50:33 2011 +0100 hwmon/f71882fg: Set platform drvdata to NULL later This avoids a possible race leading to trying to dereference NULL. Signed-off-by: Hans de Goede Acked-by: Jean Delvare Cc: stable@kernel.org Signed-off-by: Guenter Roeck commit 14a4019de88111d26ba444495fd14833ddb2d65e Author: Hans de Goede Date: Sun Mar 13 13:50:32 2011 +0100 hwmon/f71882fg: Fix a typo in a comment Signed-off-by: Hans de Goede Acked-by: Jean Delvare Signed-off-by: Guenter Roeck commit c640e8ca172c6a5c45abe8e2e8353900a84427fa Author: Dave Airlie Date: Fri Mar 11 21:17:41 2011 +1000 drm/radeon: fix page flipping hangs on r300/r400 We've been getting reports of complete system lockups with rv3xx hw on AGP and PCIE when running gnome-shell or kwin with compositing. It appears the hw really doesn't like setting these registers while stuff is running, this moves the setting of the registers into the modeset since they aren't required to be changed anywhere else. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=35183 Reported-and-tested-by: Álmos commit 36e39c40b3facc9b489a13f1d301fc53ff6960a3 Author: Chris Mason Date: Sat Mar 12 07:08:42 2011 -0500 Btrfs: break out of shrink_delalloc earlier Josef had changed shrink_delalloc to exit after three shrink attempts, which wasn't quite enough because new writers could race in and steal free space. But it also fixed deadlocks and stalls as we tried to recover delalloc reservations. The code was tweaked to loop 1024 times, and would reset the counter any time a small amount of progress was made. This was too drastic, and with a lot of writers we can end up stuck in shrink_delalloc forever. The shrink_delalloc loop is fairly complex because the caller is looping too, and the caller will go ahead and force a transaction commit to make sure we reclaim space. This reworks things to exit shrink_delalloc when we've forced some writeback and the delalloc reservations have gone down. This means the writeback has not just started but has also finished at least some of the metadata changes required to reclaim delalloc space. If we've got this wrong, we're returning ENOSPC too early, which is a big improvement over the current behavior of hanging the machine. Test 224 in xfstests hammers on this nicely, and with 1000 writers trying to fill a 1GB drive we get our first ENOSPC at 93% full. The other writers are able to continue until we get 100%. This is a worst case test for btrfs because the 1000 writers are doing small IO, and the small FS size means we don't have a lot of room for metadata chunks. Signed-off-by: Chris Mason commit 0aeea18964173715a1037034ef6838198f319319 Author: Lukas Czerner Date: Fri Mar 11 10:23:53 2011 +0100 block: fix mis-synchronisation in blkdev_issue_zeroout() BZ29402 https://bugzilla.kernel.org/show_bug.cgi?id=29402 We can hit serious mis-synchronization in bio completion path of blkdev_issue_zeroout() leading to a panic. The problem is that when we are going to wait_for_completion() in blkdev_issue_zeroout() we check if the bb.done equals issued (number of submitted bios). If it does, we can skip the wait_for_completition() and just out of the function since there is nothing to wait for. However, there is a ordering problem because bio_batch_end_io() is calling atomic_inc(&bb->done) before complete(), hence it might seem to blkdev_issue_zeroout() that all bios has been completed and exit. At this point when bio_batch_end_io() is going to call complete(bb->wait), bb and wait does not longer exist since it was allocated on stack in blkdev_issue_zeroout() ==> panic! (thread 1) (thread 2) bio_batch_end_io() blkdev_issue_zeroout() if(bb) { ... if (bb->end_io) ... bb->end_io(bio, err); ... atomic_inc(&bb->done); ... ... while (issued != atomic_read(&bb.done)) ... (let issued == bb.done) ... (do the rest of the function) ... return ret; complete(bb->wait); ^^^^^^^^ panic We can fix this easily by simplifying bio_batch and completion counting. Also remove bio_end_io_t *end_io since it is not used. Signed-off-by: Lukas Czerner Reported-by: Eric Whitney Tested-by: Eric Whitney Reviewed-by: Jeff Moyer CC: Dmitry Monakhov Signed-off-by: Jens Axboe commit c804c733846572ca85c2bba60c7fe6fa024dff18 Author: Axel Lin Date: Mon Mar 7 11:04:24 2011 +0800 mtd: add "platform:" prefix for platform modalias Since 43cc71eed1250755986da4c0f9898f9a635cb3bf (platform: prefix MODALIAS with "platform:"), the platform modalias is prefixed with "platform:". Signed-off-by: Axel Lin Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org commit bd637f6f22235b4613f9ab6555e8088a455c1ed4 Author: Maxim Levitsky Date: Sun Jan 9 01:25:06 2011 +0200 mtd: mtd_blkdevs: fix double free on error path This one liner patch fixes double free that will occur if add_mtd_blktrans_dev fails. On failure it frees the input argument, but all its users also free it on error which is natural thing to do. Thus don't free it. All credit for finding that bug belongs to reporters of the bug in the android bugzilla http://code.google.com/p/android/issues/detail?id=13761 Commit message tweaked by Artem. Signed-off-by: Maxim Levitsky Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org commit 82013d988fc03a1b908b2b0360a1e34f6152fda6 Author: Stanislaw Gruszka Date: Sat Jan 8 15:24:37 2011 +0100 mtd: amd76xrom: fix oops at boot when resources are not available For some unknown reasons resources needed by amd76xrom driver can be unavailable. And instead of returning an error, the driver keeps going and crash the kernel. This patch fixes the problem by making the driver return -EBUSY if the resources are not available. Commit messages tweaked by Artem. Reported-by: Russell Whitaker Signed-off-by: Stanislaw Gruszka Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org commit ecf3fde07c8dcb92a1bf3fbdfe70905d85cd00e1 Author: Joakim Tjernlund Date: Mon Feb 7 17:07:11 2011 +0100 mtd: fix race in cfi_cmdset_0001 driver As inval_cache_and_wait_for_operation() drop and reclaim the lock to invalidate the cache, some other thread may suspend the operation before reaching the for(;;) loop. Therefore the loop must start with checking the chip->state before reading status from the chip. Signed-off-by: Joakim Tjernlund Acked-by: Michael Cashwell Acked-by: Stefan Bigler Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org commit ceabebb2bd2672f709e4454e16bc6042732e2dfe Author: Antony Pavlov Date: Fri Feb 11 13:00:37 2011 +0300 mtd: jedec_probe: initialise make sector erase command variable In the commit 08968041bef437ec363623cd3218c2b083537ada (mtd: cfi_cmdset_0002: make sector erase command variable) introdused a field sector_erase_cmd. In the same commit initialisation of cfi->sector_erase_cmd made in cfi_chip_setup() (file drivers/mtd/chips/cfi_probe.c), so the CFI chip has no problem: ... cfi->cfi_mode = CFI_MODE_CFI; cfi->sector_erase_cmd = CMD(0x30); ... But for the JEDEC chips this initialisation is not carried out, so the JEDEC chips have sector_erase_cmd == 0. This patch adds the missing initialisation. Signed-off-by: Antony Pavlov Acked-by: Guillaume LECERF Signed-off-by: David Woodhouse CC: stable@kernel.org commit efba2e313ea1b1bd69a7c4659263becf43bb1adc Author: Antony Pavlov Date: Fri Feb 11 13:00:37 2011 +0300 mtd: jedec_probe: Change variable name from cfi_p to cfi In the following commit, we'll need to use the CMD() macro in order to fix the initialisation of the sector_erase_cmd field. That requires the local variable to be called 'cfi', so change it first in a simple patch. Signed-off-by: Antony Pavlov Acked-by: Guillaume LECERF Signed-off-by: David Woodhouse CC: stable@kernel.org commit fdc315a19a2c33da29dd87d4ca88f4e4407bd42d Author: Dave Airlie Date: Fri Mar 11 10:04:23 2011 +1000 drm/radeon: add pageflip hooks for fusion Looks like these got passed over with both being merged at the same time but not quite meeting in the middle. should fix: https://bugs.freedesktop.org/show_bug.cgi?id=34137 along with Michael's phoronix article. Reported-by: Chi-Thanh Christopher Nguyen Article-written-by: Michael Larabel @ phoronix Signed-off-by: Dave Airlie commit 78f9bbb5a6f41fcb7934848c7821b99718f7e338 Merge: 9179746 75c0fd9 Author: Linus Torvalds Date: Thu Mar 10 16:30:21 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ariadne: remove redundant NULL check ip6ip6: autoload ip6 tunnel net: bridge builtin vs. ipv6 modular ipv6: Don't create clones of host routes. pktgen: fix errata in show results ipv4: Fix erroneous uses of ifa_address. vxge: update MAINTAINERS r6040: bump to version 0.27 and date 23Feb2011 r6040: fix multicast operations rds: prevent BUG_ON triggering on congestion map updates bonding 802.3ad: Rename rx_machine_lock to state_machine_lock bonding 802.3ad: Fix the state machine locking v2 drivers/net/macvtap: fix error check net: fix multithreaded signal handling in unix recv routines net: Enter net/ipv6/ even if CONFIG_IPV6=n net/smsc911x.c: Set the VLAN1 register to fix VLAN MTU problem bnx2x: fix MaxBW configuration bnx2x: (NPAR) prevent HW access in D3 state bnx2x: fix link notification bnx2x: fix non-pmf device load flow Doing my first --no-ff merge here, to get the explicit merge commit. David did a back-merge in order to get commit 8909c9ad8ff0 ("net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules") so that we can add Stephen Hemminger's fix to handle ip6 tunnels as well, which uses the MODULE_ALIAS_NETDEV() macro created by that change. commit 75c0fd93c7d42362134e74fd381072a7642fcc3d Author: j223yang@asset.uwaterloo.ca Date: Thu Mar 10 12:36:37 2011 +0000 ariadne: remove redundant NULL check Simply remove redundant 'dev' NULL check. Signed-off-by: Jinqiu Yang Signed-off-by: David S. Miller commit 6dfbd87a20a737641ef228230c77f4262434fa24 Author: stephen hemminger Date: Thu Mar 10 11:43:19 2011 +0000 ip6ip6: autoload ip6 tunnel Add necessary alias to autoload ip6ip6 tunnel module. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit bef6e7e76868ab454d5e83635a4a7a1961c74fb5 Merge: dcbcdf2 9179746 Author: David S. Miller Date: Thu Mar 10 14:00:44 2011 -0800 Merge branch 'master' of /home/davem/src/GIT/linux-2.6/ commit dcbcdf22f500ac6e4ec06485341024739b9dc241 Author: Randy Dunlap Date: Thu Mar 10 13:45:57 2011 -0800 net: bridge builtin vs. ipv6 modular When configs BRIDGE=y and IPV6=m, this build error occurs: br_multicast.c:(.text+0xa3341): undefined reference to `ipv6_dev_get_saddr' BRIDGE_IGMP_SNOOPING is boolean; if it were tristate, then adding depends on IPV6 || IPV6=n to BRIDGE_IGMP_SNOOPING would be a good fix. As it is currently, making BRIDGE depend on the IPV6 config works. Reported-by: Patrick Schaaf Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 9179746652faf0aba07b8b7f770dcf29892a24c6 Merge: 4c418ba a4e36e6 Author: Linus Torvalds Date: Thu Mar 10 13:22:10 2011 -0800 Merge branch 'media_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'media_fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: [media] mantis_pci: remove asm/pgtable.h include [media] tda829x: fix regression in probe functions [media] mceusb: don't claim multifunction device non-IR parts [media] nuvoton-cir: fix wake from suspend [media] cx18: Add support for Hauppauge HVR-1600 models with s5h1411 [media] ivtv: Fix corrective action taken upon DMA ERR interrupt to avoid hang [media] cx25840: fix probing of cx2583x chips [media] cx23885: Remove unused 'err:' labels to quiet compiler warning [media] cx23885: Revert "Check for slave nack on all transactions" [media] DiB7000M: add pid filtering [media] Fix sysfs rc protocol lookup for rc-5-sz [media] au0828: fix VBI handling when in V4L2 streaming mode [media] ir-raw: Properly initialize the IR event (BZ#27202) [media] s2255drv: firmware re-loading changes [media] Fix double free of video_device in mem2mem_testdev [media] DM04/QQBOX memcpy to const char fix commit 4c418ba9695a24917a1fcfa48f7db3fd76337eb7 Author: Doe, YiCheng Date: Thu Mar 10 14:00:21 2011 -0600 ipmi: Fix IPMI errors due to timing problems This patch fixes an issue in OpenIPMI module where sometimes an ABORT command is sent after sending an IPMI request to BMC causing the IPMI request to fail. Signed-off-by: YiCheng Doe Signed-off-by: Corey Minyard Acked-by: Tom Mingarelli Tested-by: Andy Cress Tested-by: Mika Lansirine Tested-by: Brian De Wolf Cc: Jean Michel Audet Cc: Jozef Sudelsky Acked-by: Matthew Garrett Signed-off-by: Linus Torvalds commit 4afcc10a65bb1f30c4fa1dec2634df74160a8054 Merge: b5562c9 d891eed Author: Linus Torvalds Date: Thu Mar 10 13:16:01 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: fs/dcache: allow d_obtain_alias() to return unhashed dentries Check for immutable/append flag in fallocate path sysctl: the include of rcupdate.h is only needed in the kernel fat: fix d_revalidate oopsen on NFS exports jfs: fix d_revalidate oopsen on NFS exports ocfs2: fix d_revalidate oopsen on NFS exports gfs2: fix d_revalidate oopsen on NFS exports fuse: fix d_revalidate oopsen on NFS exports ceph: fix d_revalidate oopsen on NFS exports reiserfs xattr ->d_revalidate() shouldn't care about RCU /proc/self is never going to be invalidated... commit b5562c9a55996735e219b154c1e0f19ec10ce67a Merge: bf98f77 5471262 Author: Linus Torvalds Date: Thu Mar 10 13:09:26 2011 -0800 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, UV: Initialize the broadcast assist unit base destination node id properly x86, numa: Fix numa_emulation code with memory-less node0 x86, build: Make sure mkpiggy fails on read error commit bf98f77888c92fa3aeb28791ba3b5c30675076f3 Merge: d959707 0c3b916 Author: Linus Torvalds Date: Thu Mar 10 13:08:59 2011 -0800 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Fix sched rt group scheduling when hierachy is enabled commit d9597075fb6feb1b3dc71c352e334c5b0a37afde Merge: ba3820a 7ee235e Author: Linus Torvalds Date: Thu Mar 10 13:07:38 2011 -0800 Merge branch 'perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf symbols: Avoid resolving [kernel.kallsyms] to real path for buildid cache perf symbols: Fix vmlinux path when not using --symfs commit ba3820ade317ee36e496b9b40d2ec3987dd4aef0 Author: Takashi Iwai Date: Thu Mar 10 14:02:12 2011 +0100 drm/i915: Revive combination mode for backlight control This reverts commit 951f3512dba5bd44cda3e5ee22b4b522e4bb09fb drm/i915: Do not handle backlight combination mode specially since this commit introduced other regressions due to untouched LBPC register, e.g. the backlight dimmed after resume. In addition to the revert, this patch includes a fix for the original issue (weird backlight levels) by removing the wrong bit shift for computing the current backlight level. Also, including typo fixes (lpbc -> lbpc). Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34524 Acked-by: Indan Zupancic Reviewed-by: Keith Packard Reviewed-by: Jesse Barnes Cc: Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds commit 7e6b6465e6efbca3985258996be9c189da96c8bf Author: Miao Xie Date: Fri Feb 18 09:21:17 2011 +0000 btrfs: fix not enough reserved space btrfs_link() will insert 3 items(inode ref, dir name item and dir index item) into the b+ tree and update 2 items(its inode, and parent's inode) in the b+ tree. So we should reserve space for these 5 items, not 3 items. Reported-by: Tsutomu Itoh Signed-off-by: Miao Xie Signed-off-by: Chris Mason commit b4966b7770349deb05e3dd2bd2c65d2d044abbbb Author: Daniel J Blueman Date: Wed Mar 9 16:46:42 2011 +0000 btrfs: fix dip leak The btrfs DIO code leaks dip structs when dip->csums allocation fails; bio->bi_end_io isn't set at the point where the free_ordered branch is consequently taken, thus bio_endio doesn't call the function which would free it in the normal case. Fix. Signed-off-by: Daniel J Blueman Acked-by: Miao Xie Signed-off-by: Chris Mason commit db72f3fcd4df461b87c696daf362a1124835d608 Merge: ffd6eae 7c2de63 Author: Takashi Iwai Date: Thu Mar 10 16:03:09 2011 +0100 Merge branch 'for-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound-2.6 into fix/asoc commit d891eedbc3b1b0fade8a9ce60cc0eba1cccb59e5 Author: J. Bruce Fields Date: Tue Jan 18 15:45:09 2011 -0500 fs/dcache: allow d_obtain_alias() to return unhashed dentries Without this patch, inodes are not promptly freed on last close of an unlinked file by an nfs client: client$ mount -tnfs4 server:/export/ /mnt/ client$ tail -f /mnt/FOO ... server$ df -i /export server$ rm /export/FOO (^C the tail -f) server$ df -i /export server$ echo 2 >/proc/sys/vm/drop_caches server$ df -i /export the df's will show that the inode is not freed on the filesystem until the last step, when it could have been freed after killing the client's tail -f. On-disk data won't be deallocated either, leading to possible spurious ENOSPC. This occurs because when the client does the close, it arrives in a compound with a putfh and a close, processed like: - putfh: look up the filehandle.  The only alias found for the inode will be DCACHE_UNHASHED alias referenced by the filp this, so it creates a new DCACHE_DISCONECTED dentry and returns that instead. - close: closes the existing filp, which is destroyed immediately by dput() since it's DCACHE_UNHASHED. - end of the compound: release the reference to the current filehandle, and dput() the new DCACHE_DISCONECTED dentry, which gets put on the unused list instead of being destroyed immediately. Nick Piggin suggested fixing this by allowing d_obtain_alias to return the unhashed dentry that is referenced by the filp, instead of making it create a new dentry. Leave __d_find_alias() alone to avoid changing behavior of other callers. Also nfsd doesn't need all the checks of __d_find_alias(); any dentry, hashed or unhashed, disconnected or not, should work. Signed-off-by: J. Bruce Fields Signed-off-by: Al Viro commit 1ca551c6caae7b52178555cdedea6ca26444be46 Author: Marco Stornelli Date: Sat Mar 5 11:10:19 2011 +0100 Check for immutable/append flag in fallocate path In the fallocate path the kernel doesn't check for the immutable/append flag. It's possible to have a race condition in this scenario: an application open a file in read/write and it does something, meanwhile root set the immutable flag on the file, the application at that point can call fallocate with success. In addition, we don't allow to do any unreserve operation on an append only file but only the reserve one. Signed-off-by: Marco Stornelli Signed-off-by: Al Viro commit 991ac30d8b30ab6051dff5a7b07d84e6f5efa3a6 Author: Stephen Rothwell Date: Thu Mar 10 11:25:43 2011 +1100 sysctl: the include of rcupdate.h is only needed in the kernel Fixes this built error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by: Stephen Rothwell Acked-by: Al Viro Signed-off-by: Al Viro commit 9177ada99d5e69fe91950b3ef5c23f2bcd109987 Author: Al Viro Date: Thu Mar 10 03:45:49 2011 -0500 fat: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit 8ce84eeb5b40da21f20174dd25891a8409534237 Author: Al Viro Date: Thu Mar 10 03:45:28 2011 -0500 jfs: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit 4714e63731a8a641b5e0ed5e2e2191c13bf2d71a Author: Al Viro Date: Thu Mar 10 03:45:07 2011 -0500 ocfs2: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit 53fe924161ff18d24c5c1c256549e9c1b9874827 Author: Al Viro Date: Thu Mar 10 03:44:48 2011 -0500 gfs2: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit 529c5f958f9e60abaa7407986034b17d17536bf2 Author: Al Viro Date: Thu Mar 10 03:44:31 2011 -0500 fuse: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit 0eb980e31770cfeff6e27760b4692d595b8dbf28 Author: Al Viro Date: Thu Mar 10 03:44:05 2011 -0500 ceph: fix d_revalidate oopsen on NFS exports can't blindly check nd->flags in ->d_revalidate() Signed-off-by: Al Viro commit c78f4cc5e7d642c7009089817c12d8984e7ba872 Author: Al Viro Date: Wed Feb 16 10:14:56 2011 -0500 reiserfs xattr ->d_revalidate() shouldn't care about RCU ... it returns an error unconditionally Signed-off-by: Al Viro commit ae50adcb0ac4cde67a7aec8ae67249d1b2be2948 Author: Al Viro Date: Wed Feb 16 10:04:50 2011 -0500 /proc/self is never going to be invalidated... Signed-off-by: Al Viro commit 7343ff31ebf01691ea4515d3126467434b9d22d6 Author: David S. Miller Date: Wed Mar 9 19:55:25 2011 -0800 ipv6: Don't create clones of host routes. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=29252 Addresses https://bugzilla.kernel.org/show_bug.cgi?id=30462 In commit d80bc0fd262ef840ed4e82593ad6416fa1ba3fc4 ("ipv6: Always clone offlink routes.") we forced the kernel to always clone offlink routes. The reason we do that is to make sure we never bind an inetpeer to a prefixed route. The logic turned on here has existed in the tree for many years, but was always off due to a protecting CPP define. So perhaps it's no surprise that there is a logic bug here. The problem is that we canot clone a route that is already a host route (ie. has DST_HOST set). Because if we do, an identical entry already exists in the routing tree and therefore the ip6_rt_ins() call is going to fail. This sets off a series of failures and high cpu usage, because when ip6_rt_ins() fails we loop retrying this operation a few times in order to handle a race between two threads trying to clone and insert the same host route at the same time. Fix this by simply using the route as-is when DST_HOST is set. Reported-by: slash@ac.auone-net.jp Reported-by: Ernst Sjöstrand Signed-off-by: David S. Miller commit 35d34df711e8b44846e759d8cfddb4ec6877cccb Merge: ab02a95 36e8695 Author: Linus Torvalds Date: Wed Mar 9 16:46:06 2011 -0800 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/pseries: Disable VPNH feature powerpc/iseries: Fix early init access to lppaca commit ab02a9540541dd7b2012f32f5e311c3cbd772387 Merge: 684adca 8909c9a Author: Linus Torvalds Date: Wed Mar 9 16:45:02 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules commit 684adca4f84365ca327e06dba696b62de7a79eca Author: Stephen Rothwell Date: Thu Mar 10 11:14:17 2011 +1100 sysctl: the include of rcupdate.h is only needed in the kernel Fixes this build-check error: include/linux/sysctl.h:28: included file 'linux/rcupdate.h' is not exported Signed-off-by: Stephen Rothwell Signed-off-by: Linus Torvalds commit 8909c9ad8ff03611c9c96c9a92656213e4bb495b Author: Vasiliy Kulikov Date: Wed Mar 2 00:33:13 2011 +0300 net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules Since a8f80e8ff94ecba629542d9b4b5f5a8ee3eb565c any process with CAP_NET_ADMIN may load any module from /lib/modules/. This doesn't mean that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are limited to /lib/modules/**. However, CAP_NET_ADMIN capability shouldn't allow anybody load any module not related to networking. This patch restricts an ability of autoloading modules to netdev modules with explicit aliases. This fixes CVE-2011-1019. Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior of loading netdev modules by name (without any prefix) for processes with CAP_SYS_MODULE to maintain the compatibility with network scripts that use autoloading netdev modules by aliases like "eth0", "wlan0". Currently there are only three users of the feature in the upstream kernel: ipip, ip_gre and sit. root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) -- root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: fffffff800001000 CapEff: fffffff800001000 CapBnd: fffffff800001000 root@albatros:~# modprobe xfs FATAL: Error inserting xfs (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted root@albatros:~# lsmod | grep xfs root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit sit: error fetching interface information: Device not found root@albatros:~# lsmod | grep sit root@albatros:~# ifconfig sit0 sit0 Link encap:IPv6-in-IPv4 NOARP MTU:1480 Metric:1 root@albatros:~# lsmod | grep sit sit 10457 0 tunnel4 2957 1 sit For CAP_SYS_MODULE module loading is still relaxed: root@albatros:~# grep Cap /proc/$$/status CapInh: 0000000000000000 CapPrm: ffffffffffffffff CapEff: ffffffffffffffff CapBnd: ffffffffffffffff root@albatros:~# ifconfig xfs xfs: error fetching interface information: Device not found root@albatros:~# lsmod | grep xfs xfs 745319 0 Reference: https://lkml.org/lkml/2011/2/24/203 Signed-off-by: Vasiliy Kulikov Signed-off-by: Michael Tokarev Acked-by: David S. Miller Acked-by: Kees Cook Signed-off-by: James Morris commit 36e8695ca5dcf48c837a6efe6f780c47ac9ec808 Author: Benjamin Herrenschmidt Date: Wed Mar 9 13:00:14 2011 +0000 powerpc/pseries: Disable VPNH feature This feature triggers nasty races in the scheduler between the rebuilding of the topology and the load balancing code, causing the machine to hang. Disable it for now until the races are fixed. Signed-off-by: Benjamin Herrenschmidt commit f2f6dad6ca3b06ae35a2e7b63f38158242c01531 Author: Benjamin Herrenschmidt Date: Sun Mar 6 18:02:31 2011 +0000 powerpc/iseries: Fix early init access to lppaca The combination of commit 8154c5d22d91cd16bd9985b0638c8957e4688d0e and 93c22703efa72c7527dbd586d1951c1f4a85fd70 Broke boot on iSeries. The problem is that iSeries very early boot code, which generates the device-tree and runs before our normal early initializations does need access the lppaca's very early, before the PACA array is initialized, and in fact even before the boot PACA has been initialized (it contains all 0's at this stage). However, the first patch above makes that code use the new llpaca_of(cpu) accessor, which itself is changed by the second patch to use the PACA array. We fix that by reverting iSeries to directly dereferencing the array. In addition, we fix all iterators in the iSeries code to always skip CPU whose number is above 63 which is the maximum size of that array and the maximum number of supported CPUs on these machines. Additionally, we make sure the boot_paca is properly initialized in our early startup code. Signed-off-by: Benjamin Herrenschmidt commit 3979491701cfb2aa7477f5baf40553355391418b Merge: 6b684cd 3ec07aa Author: Linus Torvalds Date: Wed Mar 9 14:52:09 2011 -0800 Merge branch 'for-2.6.38' of git://linux-nfs.org/~bfields/linux * 'for-2.6.38' of git://linux-nfs.org/~bfields/linux: nfsd: wrong index used in inner loop nfsd4: fix bad pointer on failure to find delegation NFSD: fix decode_cb_sequence4resok commit 03a14ab134f4811ab1475f07b1305ccaf38b690f Author: Daniel Turull Date: Wed Mar 9 14:11:00 2011 -0800 pktgen: fix errata in show results The units in show_results in pktgen were not correct. The results are in usec but it was displayed nsec. Reported-by: Jong-won Lee Signed-off-by: Daniel Turull Signed-off-by: David S. Miller commit 6b684cd5799cd1e691024ca3a688d1cdec9d4824 Merge: 1b7e7e6 d406577 Author: Linus Torvalds Date: Wed Mar 9 14:04:40 2011 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: watchdog: sbc_fitpc2_wdt, fix crash on systems without DMI_BOARD_NAME commit 1b7e7e6ffc08b3a8fb27bccd8fc740d77758db5b Merge: fbf855d 6dbc2f3 Author: Linus Torvalds Date: Wed Mar 9 14:03:59 2011 -0800 Merge branch 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux * 'for-2639-rc7/i2c-fixes' of git://git.fluff.org/bjdooks/linux: i2c-eg20t: include slab.h for memory allocations i2c-ocores: Fix pointer type mismatch error i2c-omap: Program I2C_WE on OMAP4 to enable i2c wakeup commit fbf855d7c709e991ff5445d4bac432a08b942baa Author: Matt Turner Date: Wed Mar 9 11:15:13 2011 -0500 alpha: fix compile error from IRQ clean up Signed-off-by: Matt Turner Signed-off-by: Linus Torvalds commit cfd80652467717ca7346857d6d8c94503d74f3a3 Merge: 687530b 1f858ef Author: Linus Torvalds Date: Wed Mar 9 14:01:42 2011 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] pcc-cpufreq: don't load driver if get_freq fails during init. commit 687530b44de7e0fe70fabb4200d4cabce3af1a0c Merge: 78833dd bad3bab Author: Linus Torvalds Date: Wed Mar 9 14:00:44 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: fix CONFIG_MMC_UNSAFE_RESUME regression commit 78833dd70602be6b71ef34225f708b1e500947dc Merge: a5abba9 b306419 Author: Linus Torvalds Date: Wed Mar 9 13:55:51 2011 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: nd->inode is not set on the second attempt in path_walk() unfuck proc_sysctl ->d_compare() minimal fix for do_filp_open() race commit d406577526a611e6be1f6b1cfeaf094dd95fa439 Author: Jiri Slaby Date: Mon Feb 28 10:16:29 2011 +0100 watchdog: sbc_fitpc2_wdt, fix crash on systems without DMI_BOARD_NAME Some systems don't provide DMI_BOARD_NAME in their DMI tables. Avoid crash in such situations in fitpc2_wdt_init. The fix is to check if the dmi_get_system_info return value is NULL. The oops: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] strstr+0x26/0xa0 PGD 3966e067 PUD 39605067 PMD 0 Oops: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map CPU 1 Modules linked in: ... Pid: 1748, comm: modprobe Not tainted 2.6.37-22-default #1 /Bochs RIP: 0010:[] [] strstr+0x26/0xa0 RSP: 0018:ffff88003ad73f18 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 00000000ffffffed RCX: 00000000ffffffff RDX: ffffffffa003f4cc RSI: ffffffffa003f4c2 RDI: 0000000000000000 ... CR2: 0000000000000000 CR3: 000000003b7ac000 CR4: 00000000000006e0 ... Process modprobe (pid: 1748, threadinfo ffff88003ad72000, task ffff88002e6365c0) Stack: ... Call Trace: [] fitpc2_wdt_init+0x1f/0x13c [sbc_fitpc2_wdt] [] do_one_initcall+0x3a/0x170 ... Code: f3 c3 0f 1f 00 80 3e 00 53 48 89 f8 74 1b 48 89 f2 0f 1f 40 00 48 83 c2 01 80 3a 00 75 f7 49 89 d0 48 89 f8 49 29 f0 75 02 5b c3 <80> 3f 00 74 0e 0f 1f 44 00 00 48 83 c0 01 80 38 00 75 f7 49 89 Signed-off-by: Jiri Slaby Signed-off-by: Wim Van Sebroeck commit 6c91afe1a984d43f922a6a70c7c390b7fb8de45e Author: David S. Miller Date: Wed Mar 9 13:27:16 2011 -0800 ipv4: Fix erroneous uses of ifa_address. In usual cases ifa_address == ifa_local, but in the case where SIOCSIFDSTADDR sets the destination address on a point-to-point link, ifa_address gets set to that destination address. Therefore we should use ifa_local when we want the local interface address. There were two cases where the selection was done incorrectly: 1) When devinet_ioctl() does matching, it checks ifa_address even though gifconf correct reported ifa_local to the user 2) IN_DEV_ARP_NOTIFY handling sends a gratuitous ARP using ifa_address instead of ifa_local. Reported-by: Julian Anastasov Signed-off-by: David S. Miller commit 7c2de633863fcd46537d9ddbf5a9701f48225268 Author: Mark Brown Date: Wed Mar 9 19:10:15 2011 +0000 ASoC: Ensure WM8958 gets all WM8994 late revision widgets Without this fix the driver won't instantiate properly on relevant devices. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org commit 0627bd2575a30a83901b79d7bcf2ca1fa09fbb8b Author: Mark Brown Date: Wed Mar 9 19:09:17 2011 +0000 ASoC: Fix typo in late revision WM8994 DAC2R name Without this fix the driver won't instantiate properly on relevant devices. Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org commit 1f858ef2fbabdc5e645644010a31a40c32e397c9 Author: Naga Chumbalkar Date: Wed Mar 9 14:02:49 2011 +0000 [CPUFREQ] pcc-cpufreq: don't load driver if get_freq fails during init. Return 0 on failure. This will cause the initialization of the driver to fail and prevent the driver from loading if the BIOS cannot handle the PCC interface command to "get frequency". Otherwise, the driver will load and display a very high value like "4294967274" (which is actually -EINVAL) for frequency: # cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_cur_freq 4294967274 Signed-off-by: Naga Chumbalkar CC: stable@kernel.org Signed-off-by: Dave Jones commit 7ee235efe5f86f239ce73915fd2e15f4d14259c6 Author: Lin Ming Date: Thu Mar 3 23:23:57 2011 +0800 perf symbols: Avoid resolving [kernel.kallsyms] to real path for buildid cache kallsyms has a virtual file name [kernel.kallsyms]. Currently, it can't be added to buildid cache successfully because the code (build_id_cache__add_s) tries to resolve [kernel.kallsyms] to a real absolute pathname and that fails. Fixes it by not resolving it and just use the name [kernel.kallsyms]. So dir ~/.debug/[kernel.kallsyms] is created. Original bug report at: https://lkml.org/lkml/2011/3/1/524 Tested-by: Han Pingtian Cc: Han Pingtian Cc: Ingo Molnar Cc: Peter Zijlstra LKML-Reference: <1299165837-27817-1-git-send-email-ming.m.lin@intel.com> Signed-off-by: Lin Ming Signed-off-by: Arnaldo Carvalho de Melo commit 5471262290a6695b3300903267e0a2584f721000 Author: Cliff Wickman Date: Wed Mar 9 08:15:57 2011 -0600 x86, UV: Initialize the broadcast assist unit base destination node id properly The BAU's initialization of the broadcast description header is lacking the coherence domain (high bits) in the nasid. This causes a catastrophic system failure when running on a system with multiple coherence domains. Signed-off-by: Cliff Wickman LKML-Reference: Signed-off-by: Ingo Molnar commit 28e868081086c495c897a48c50d2d5187ef677d2 Author: Mark Brown Date: Tue Mar 8 19:29:53 2011 +0000 ASoC: Use the correct DAPM context when cleaning up final widget set Now we've got multi-component we need to make sure that the DAPM context (and hence register I/O context) we use to apply the pending updates at the end of a DAPM sequence is the one we were processing rather than the one that was used to initate the state change. Signed-off-by: Mark Brown Acked-by: Liam Girdwood commit 823dba5191220fc94b83dc0b3f2178ff0842e294 Author: Mark Brown Date: Wed Mar 2 11:01:18 2011 +0000 ASoC: Fix broken bitfield definitions in WM8978 Signed-off-by: Mark Brown Acked-by: Liam Girdwood Cc: stable@kernel.org commit ffd6eae2a0d18ca4a741615292a9c9ce904307fb Author: Abhilash K V Date: Tue Mar 8 21:02:43 2011 +0530 ASoC: AM3517: Update codec name after multi-component update The i2c client device name (".2-001a" in this case, including the separator period) for the AIC23 codec on the TI AM3517-EVM was appended to the codec_name member of am3517evm_dai to resolve the names mismatch happening in soc_bind_dai_link(), due to which the card was not getting registered. Signed-off-by: Abhilash K V Acked-by: Jarkko Nikula Acked-by: Mark Brown Signed-off-by: Liam Girdwood commit b306419ae08d9def53f2142a37cc0a58622307a8 Author: Al Viro Date: Tue Mar 8 21:16:28 2011 -0500 nd->inode is not set on the second attempt in path_walk() We leave it at whatever it had been pointing to after the first link_path_walk() had failed with -ESTALE. Things do not work well after that... Signed-off-by: Al Viro commit 3ec07aa9522e3d5e9d5ede7bef946756e623a0a0 Author: roel Date: Tue Mar 8 22:32:26 2011 +0100 nfsd: wrong index used in inner loop Index i was already used in the outer loop Cc: stable@kernel.org Signed-off-by: Roel Kluin Signed-off-by: J. Bruce Fields commit 6dbc2f35ab457770d121d119788fc89c79124734 Author: Wolfram Sang Date: Wed Feb 23 11:11:35 2011 +0100 i2c-eg20t: include slab.h for memory allocations Fixes (with v2.6.38-rc3/parisc/parisc-allmodconfig): src/drivers/i2c/busses/i2c-eg20t.c:720: error: implicit declaration of function 'kzalloc' src/drivers/i2c/busses/i2c-eg20t.c:790: error: implicit declaration of function 'kfree' Reported-by: Geert Uytterhoeven Signed-off-by: Wolfram Sang Cc: Tomoya MORINAGA Cc: Ben Dooks Signed-off-by: Ben Dooks commit 12c383238d675f41e8ecdb8278bfa30c9f2781d4 Author: Grant Likely Date: Mon Feb 28 13:52:32 2011 -0700 i2c-ocores: Fix pointer type mismatch error ocores_i2c_of_probe needs to use a const __be32 type for handing device tree property values. This patch fixed the following build warning: CC drivers/i2c/busses/i2c-ocores.o drivers/i2c/busses/i2c-ocores.c: In function 'ocores_i2c_of_probe': drivers/i2c/busses/i2c-ocores.c:254: warning: assignment discards qualifiers from pointer target type drivers/i2c/busses/i2c-ocores.c:261: warning: assignment discards qualifiers from pointer target type Signed-off-by: Grant Likely Cc: Peter Korsgaard Cc: Ben Dooks Cc: linux-i2c@vger.kernel.org Signed-off-by: Ben Dooks commit e380688217feba40db450253d16e9fb2c59a625a Author: Jon Mason Date: Mon Mar 7 07:02:01 2011 +0000 vxge: update MAINTAINERS Exar has exited the 10G Ethernet NIC market, orphaning both the s2io and vxge drivers. With the promise of free hardware, I'll take over maintainership. Signed-off-by: Jon Mason Signed-off-by: David S. Miller commit 86f99fffffc631b8fa03d07219dc0c67bb65893d Author: Florian Fainelli Date: Mon Mar 7 00:09:42 2011 +0000 r6040: bump to version 0.27 and date 23Feb2011 Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit c60c9c71ade23351d9cd9d1ef96ad007eb4a15ab Author: Shawn Lin Date: Mon Mar 7 00:09:40 2011 +0000 r6040: fix multicast operations The original code does not work well when the number of mulitcast address to handle is greater than MCAST_MAX. It only enable promiscous mode instead of multicast hash table mode, so the hash table function will not be activated and all multicast frames will be recieved in this condition. This patch fixes the following issues with the r6040 NIC operating in multicast: 1) When the IFF_ALLMULTI flag is set, we should write 0xffff to the NIC hash table registers to make it process multicast traffic. 2) When the number of multicast address to handle is smaller than MCAST_MAX, we should use the NIC multicast registers MID1_{L,M,H}. 3) The hashing of the address was not correct, due to an invalid substraction (15 - (crc & 0x0f)) instead of (crc & 0x0f) and an incorrect crc algorithm (ether_crc_le) instead of (ether_crc). 4) If necessary, we should set HASH_EN flag in MCR0 to enable multicast hash table function. Reported-by: Marc Leclerc Tested-by: Marc Leclerc Signed-off-by: Shawn Lin Signed-off-by: Albert Chen Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller commit bad3babace2ee4d1763b4016a662a5c660ab92e9 Author: Ohad Ben-Cohen Date: Tue Mar 8 23:32:02 2011 +0200 mmc: fix CONFIG_MMC_UNSAFE_RESUME regression 30201e7f3 ("mmc: skip detection of nonremovable cards on rescan") allowed skipping detection of nonremovable cards on mmc_rescan(). The intention was to only skip detection of hardwired cards that cannot be removed, so make sure this is indeed the case by directly checking for (lack of) MMC_CAP_NONREMOVABLE, instead of using mmc_card_is_removable(), which is overloaded with CONFIG_MMC_UNSAFE_RESUME semantics. The user-visible symptom of the bug this patch fixes is that no "mmc: card XXXX removed" message appears in dmesg when a card is removed and CONFIG_MMC_UNSAFE_RESUME=y. Reported-and-tested-by: Dmitry Shmidt Reported-and-tested-by: Maxim Levitsky Signed-off-by: Ohad Ben-Cohen Signed-off-by: Chris Ball commit 6094628bfd94323fc1cea05ec2c6affd98c18f7f Author: Neil Horman Date: Wed Mar 2 06:28:22 2011 +0000 rds: prevent BUG_ON triggering on congestion map updates Recently had this bug halt reported to me: kernel BUG at net/rds/send.c:329! Oops: Exception in kernel mode, sig: 5 [#1] SMP NR_CPUS=1024 NUMA pSeries Modules linked in: rds sunrpc ipv6 dm_mirror dm_region_hash dm_log ibmveth sg ext4 jbd2 mbcache sd_mod crc_t10dif ibmvscsic scsi_transport_srp scsi_tgt dm_mod [last unloaded: scsi_wait_scan] NIP: d000000003ca68f4 LR: d000000003ca67fc CTR: d000000003ca8770 REGS: c000000175cab980 TRAP: 0700 Not tainted (2.6.32-118.el6.ppc64) MSR: 8000000000029032 CR: 44000022 XER: 00000000 TASK = c00000017586ec90[1896] 'krdsd' THREAD: c000000175ca8000 CPU: 0 GPR00: 0000000000000150 c000000175cabc00 d000000003cb7340 0000000000002030 GPR04: ffffffffffffffff 0000000000000030 0000000000000000 0000000000000030 GPR08: 0000000000000001 0000000000000001 c0000001756b1e30 0000000000010000 GPR12: d000000003caac90 c000000000fa2500 c0000001742b2858 c0000001742b2a00 GPR16: c0000001742b2a08 c0000001742b2820 0000000000000001 0000000000000001 GPR20: 0000000000000040 c0000001742b2814 c000000175cabc70 0800000000000000 GPR24: 0000000000000004 0200000000000000 0000000000000000 c0000001742b2860 GPR28: 0000000000000000 c0000001756b1c80 d000000003cb68e8 c0000001742b27b8 NIP [d000000003ca68f4] .rds_send_xmit+0x4c4/0x8a0 [rds] LR [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] Call Trace: [c000000175cabc00] [d000000003ca67fc] .rds_send_xmit+0x3cc/0x8a0 [rds] (unreliable) [c000000175cabd30] [d000000003ca7e64] .rds_send_worker+0x54/0x100 [rds] [c000000175cabdb0] [c0000000000b475c] .worker_thread+0x1dc/0x3c0 [c000000175cabed0] [c0000000000baa9c] .kthread+0xbc/0xd0 [c000000175cabf90] [c000000000032114] .kernel_thread+0x54/0x70 Instruction dump: 4bfffd50 60000000 60000000 39080001 935f004c f91f0040 41820024 813d017c 7d094a78 7d290074 7929d182 394a0020 <0b090000> 40e2ff68 4bffffa4 39200000 Kernel panic - not syncing: Fatal exception Call Trace: [c000000175cab560] [c000000000012e04] .show_stack+0x74/0x1c0 (unreliable) [c000000175cab610] [c0000000005a365c] .panic+0x80/0x1b4 [c000000175cab6a0] [c00000000002fbcc] .die+0x21c/0x2a0 [c000000175cab750] [c000000000030000] ._exception+0x110/0x220 [c000000175cab910] [c000000000004b9c] program_check_common+0x11c/0x180 Signed-off-by: David S. Miller commit ea8efc74bd0402b4d5f663d007b4e25fa29ea778 Author: Chris Mason Date: Tue Mar 8 11:54:40 2011 -0500 Btrfs: make sure not to return overlapping extents to fiemap The btrfs fiemap code was incorrectly returning duplicate or overlapping extents in some cases. cp was blindly trusting this result and we would end up with a destination file that was bigger than the original because some bytes were copied twice. The fix here adjusts our offsets to make sure we're always moving forward in the fiemap results. Signed-off-by: Chris Mason commit dfef6dcd35cb4a251f6322ca9b2c06f0bb1aa1f4 Author: Al Viro Date: Tue Mar 8 01:25:28 2011 -0500 unfuck proc_sysctl ->d_compare() a) struct inode is not going to be freed under ->d_compare(); however, the thing PROC_I(inode)->sysctl points to just might. Fortunately, it's enough to make freeing that sucker delayed, provided that we don't step on its ->unregistering, clear the pointer to it in PROC_I(inode) before dropping the reference and check if it's NULL in ->d_compare(). b) I'm not sure that we *can* walk into NULL inode here (we recheck dentry->seq between verifying that it's still hashed / fetching dentry->d_inode and passing it to ->d_compare() and there's no negative hashed dentries in /proc/sys/*), but if we can walk into that, we really should not have ->d_compare() return 0 on it! Said that, I really suspect that this check can be simply killed. Nick? Signed-off-by: Al Viro commit 9ac3524a948cab48137a8b40a4fa8ae1092b0a24 Author: Nils Carlson Date: Thu Mar 3 22:09:12 2011 +0000 bonding 802.3ad: Rename rx_machine_lock to state_machine_lock Rename the rx_machine_lock to state_machine_lock as this makes more sense in light of it now protecting all the state machines against concurrency. Signed-off-by: Nils Carlson Signed-off-by: David S. Miller commit 16d79d7dc98e56d4700054b9b785a92102d8998c Author: Nils Carlson Date: Thu Mar 3 22:09:11 2011 +0000 bonding 802.3ad: Fix the state machine locking v2 Changes since v1: * Clarify an unclear comment * Move a (possible) name change to a separate patch The ad_rx_machine, ad_periodic_machine and ad_port_selection_logic functions all inspect and alter common fields within the port structure. Previous to this patch, only the ad_rx_machines were mutexed, and the periodic and port_selection could run unmutexed against an ad_rx_machine trigged by an arriving LACPDU. This patch remedies the situation by protecting all the state machines from concurrency. This is accomplished by locking around all the state machines for a given port, which are executed at regular intervals; and the ad_rx_machine when handling an incoming LACPDU. Signed-off-by: Nils Carlson Signed-off-by: David S. Miller commit ce3c869283739379134e1a90c37dd1a30b5f31b7 Author: Nicolas Kaiser Date: Fri Mar 4 13:49:41 2011 +0000 drivers/net/macvtap: fix error check 'len' is unsigned of type size_t and can't be negative. Signed-off-by: Nicolas Kaiser Acked-by: Arnd Bergmann Signed-off-by: David S. Miller commit b3ca9b02b00704053a38bfe4c31dbbb9c13595d0 Author: Rainer Weikusat Date: Mon Feb 28 04:50:55 2011 +0000 net: fix multithreaded signal handling in unix recv routines The unix_dgram_recvmsg and unix_stream_recvmsg routines in net/af_unix.c utilize mutex_lock(&u->readlock) calls in order to serialize read operations of multiple threads on a single socket. This implies that, if all n threads of a process block in an AF_UNIX recv call trying to read data from the same socket, one of these threads will be sleeping in state TASK_INTERRUPTIBLE and all others in state TASK_UNINTERRUPTIBLE. Provided that a particular signal is supposed to be handled by a signal handler defined by the process and that none of this threads is blocking the signal, the complete_signal routine in kernel/signal.c will select the 'first' such thread it happens to encounter when deciding which thread to notify that a signal is supposed to be handled and if this is one of the TASK_UNINTERRUPTIBLE threads, the signal won't be handled until the one thread not blocking on the u->readlock mutex is woken up because some data to process has arrived (if this ever happens). The included patch fixes this by changing mutex_lock to mutex_lock_interruptible and handling possible error returns in the same way interruptions are handled by the actual receive-code. Signed-off-by: Rainer Weikusat Signed-off-by: David S. Miller commit 2ea6d8c446752008df7f37867f0cf7483533b05e Author: Thomas Graf Date: Thu Mar 3 23:35:07 2011 +0000 net: Enter net/ipv6/ even if CONFIG_IPV6=n exthdrs_core.c and addrconf_core.c in net/ipv6/ contain bits which must be made available even if IPv6 is disabled. net/ipv6/Makefile already correctly includes them if CONFIG_IPV6=n but net/Makefile prevents entering the subdirectory. Signed-off-by: Thomas Graf Acked-by: Randy Dunlap Signed-off-by: David S. Miller commit f277e65e7a2d360189f760baca42f3ca2f62dd7a Author: Göran Weinholt Date: Wed Mar 2 04:07:21 2011 +0000 net/smsc911x.c: Set the VLAN1 register to fix VLAN MTU problem The smsc911x driver would drop frames longer than 1518 bytes, which is a problem for networks with VLAN tagging. The VLAN1 tag register is used to increase the legal frame size to 1522 when a VLAN tag is identified. Signed-off-by: Göran Weinholt Signed-off-by: David S. Miller commit 32b007b4e19b50ff4d27ea8b69cd6d744cfec86b Author: J. Bruce Fields Date: Sun Mar 6 19:11:03 2011 -0500 nfsd4: fix bad pointer on failure to find delegation In case of a nonempty list, the return on error here is obviously bogus; it ends up being a pointer to the list head instead of to any valid delegation on the list. In particular, if nfsd4_delegreturn() hits this case, and you're quite unlucky, then renew_client may oops, and it may take an embarassingly long time to figure out why. Facepalm. BUG: unable to handle kernel NULL pointer dereference at 0000000000000090 IP: [] nfsd4_delegreturn+0x125/0x200 ... Cc: stable@kernel.org Signed-off-by: J. Bruce Fields commit 31339acd07b4ba687906702085127895a56eb920 Author: Chris Mason Date: Mon Mar 7 11:10:24 2011 -0500 Btrfs: deal with short returns from copy_from_user When copy_from_user is only able to copy some of the bytes we requested, we may end up creating a partially up to date page. To avoid garbage in the page, we need to treat a partial copy as a zero length copy. This makes the rest of the file_write code drop the page and retry the whole copy instead of marking the partially up to date page as dirty. Signed-off-by: Chris Mason cc: stable@kernel.org commit b1bf862e9dad431175a1174379476299dbfdc017 Author: Chris Mason Date: Mon Feb 28 09:52:08 2011 -0500 Btrfs: fix regressions in copy_from_user handling Commit 914ee295af418e936ec20a08c1663eaabe4cd07a fixed deadlocks in btrfs_file_write where we would catch page faults on pages we had locked. But, there were a few problems: 1) The x86-32 iov_iter_copy_from_user_atomic code always fails to copy data when the amount to copy is more than 4K and the offset to start copying from is not page aligned. The result was btrfs_file_write looping forever retrying the iov_iter_copy_from_user_atomic We deal with this by changing btrfs_file_write to drop down to single page copies when iov_iter_copy_from_user_atomic starts returning failure. 2) The btrfs_file_write code was leaking delalloc reservations when iov_iter_copy_from_user_atomic returned zero. The looping above would result in the entire filesystem running out of delalloc reservations and constantly trying to flush things to disk. 3) btrfs_file_write will lock down page cache pages, make sure any writeback is finished, do the copy_from_user and then release them. Before the loop runs we check the first and last pages in the write to see if they are only being partially modified. If the start or end of the write isn't aligned, we make sure the corresponding pages are up to date so that we don't introduce garbage into the file. With the copy_from_user changes, we're allowing the VM to reclaim the pages after a partial update from copy_from_user, but we're not making sure the page cache page is up to date when we loop around to resume the write. We deal with this by pushing the up to date checks down into the page prep code. This fits better with how the rest of file_write works. Signed-off-by: Chris Mason Reported-by: Mitch Harder cc: stable@kernel.org commit 120bdaa47cdd1ca37ce938c888bb08e33e6181a8 Author: Rajendra Nayak Date: Fri Mar 4 19:02:24 2011 +0530 i2c-omap: Program I2C_WE on OMAP4 to enable i2c wakeup For the I2C module to be wakeup capable, programming I2C_WE register (which was skipped for OMAP4430) is needed even on OMAP4. This fixes i2c controller timeouts which were seen recently with the static dependency being cleared between MPU and L4PER clockdomains. Signed-off-by: Rajendra Nayak [ben-linux@fluff.org: re-flowed description] Signed-off-by: Ben Dooks commit 9b3de1ef1ba0aa1129a9f857f07a6a97d954c6fd Author: Dmitry Kravkov Date: Sun Mar 6 10:51:37 2011 +0000 bnx2x: fix MaxBW configuration Increase resolution of MaxBW algorithm to suit Min Bandwidth configuration. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit e3835b99333eb3ac7222f6fc0af5cae46074ac49 Author: Dmitry Kravkov Date: Sun Mar 6 10:50:44 2011 +0000 bnx2x: (NPAR) prevent HW access in D3 state Changing speed setting in NPAR requires HW access, this patch delays the access to D0 state when performed in D3. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 9fdc3e9566b3ae691aefc3aa7b8dca6cac32c95e Author: Dmitry Kravkov Date: Sun Mar 6 10:49:15 2011 +0000 bnx2x: fix link notification Report link to OS and other PFs after HW is fully reconfigured according to new link parameters. (Affected only Multi Function modes). Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit c4154f25c85a44c8ff331c3d28e8d9d2f710a553 Author: Dmitry Kravkov Date: Sun Mar 6 10:49:25 2011 +0000 bnx2x: fix non-pmf device load flow Remove port MAX BW configuration from non-pmf functions, which caused reconfigure of HW according to 10G (fake) link. Signed-off-by: Dmitry Kravkov Signed-off-by: Eilon Greenstein Signed-off-by: David S. Miller commit 1858efd471624ecb37e6b5462cab8076f47d1cee Author: Al Viro Date: Fri Mar 4 13:14:21 2011 -0500 minimal fix for do_filp_open() race failure exits on the no-O_CREAT side of do_filp_open() merge with those of O_CREAT one; unfortunately, if do_path_lookup() returns -ESTALE, we'll get out_filp:, notice that we are about to return -ESTALE without having trying to create the sucker with LOOKUP_REVAL and jump right into the O_CREAT side of code. And proceed to try and create a file. Usually that'll fail with -ESTALE again, but we can race and get that attempt of pathname resolution to succeed. open() without O_CREAT really shouldn't end up creating files, races or not. The real fix is to rearchitect the whole do_filp_open(), but for now splitting the failure exits will do. Signed-off-by: Al Viro commit 3b28cf32cc32594710590685ee478f697ed4f328 Author: Yinghai Lu Date: Wed Mar 2 15:14:58 2011 -0800 x86, numa: Fix numa_emulation code with memory-less node0 This crash happens on a system that does not have RAM on node0. When numa_emulation is compiled in, and: 1. we boot the system without numa=fake... 2. or we boot the system with numa=fake=128 to make emulation fail we will get: [ 0.076025] ------------[ cut here ]------------ [ 0.080004] kernel BUG at arch/x86/mm/numa_64.c:788! [ 0.080004] invalid opcode: 0000 [#1] SMP [...] need to use early_cpu_to_node() directly, because cpu_to_apicid and apicid_to_node will return node0 that is not onlined. Signed-off-by: Yinghai Lu Acked-by: Tejun Heo Cc: David Rientjes LKML-Reference: <4D6ECF72.5010308@kernel.org> Signed-off-by: Ingo Molnar commit 0c3b9168017cbad2c4af3dd65ec93fe646eeaa62 Author: Balbir Singh Date: Thu Mar 3 17:04:35 2011 +0530 sched: Fix sched rt group scheduling when hierachy is enabled The current sched rt code is broken when it comes to hierarchical scheduling, this patch fixes two problems 1. It adds redundant enqueuing (harmless) when it finds a queue has tasks enqueued, but it has no run time and it is not throttled. 2. The most important change is in sched_rt_rq_enqueue/dequeue. The code just picks the rt_rq belonging to the current cpu on which the period timer runs, the patch fixes it, so that the correct rt_se is enqueued/dequeued. Tested with a simple hierarchy /c/d, c and d assigned similar runtimes of 50,000 and a while 1 loop runs within "d". Both c and d get throttled, without the patch, the task just stops running and never runs (depends on where the sched_rt b/w timer runs). With the patch, the task is throttled and runs as expected. [ bharata, suggestions on how to pick the rt_se belong to the rt_rq and correct cpu ] Signed-off-by: Balbir Singh Acked-by: Bharata B Rao Signed-off-by: Peter Zijlstra Cc: stable@kernel.org LKML-Reference: <20110303113435.GA2868@balbir.in.ibm.com> Signed-off-by: Ingo Molnar commit a4e36e60a6f62db6282e718cc228bde1a4e31eba Author: Arnaud Patard (Rtp) Date: Mon Feb 28 10:15:59 2011 -0300 [media] mantis_pci: remove asm/pgtable.h include mantis_pci.c is including asm/pgtable.h and it's leading to a build failure on arm. It has been noticed here : https://buildd.debian.org/fetch.cgi?pkg=linux-2.6&arch=armel&ver=2.6.38~rc6-1~experimental.1&stamp=1298430952&file=log&as=raw As this header doesn't seem to be used, I'm removing it. I've build tested it with arm and x86. Signed-off-by: Arnaud Patard Signed-off-by: Mauro Carvalho Chehab commit 89a8969afa300c202066c23cc5cc9e42eb81967c Author: Jarod Wilson Date: Tue Mar 1 12:38:48 2011 -0300 [media] tda829x: fix regression in probe functions In commit 567aba0b7997dad5fe3fb4aeb174ee9018df8c5b, the probe address for tda8290_probe and tda8295_probe was hard-coded to 0x4b, which is the default i2c address for those devices, but its possible for the device to be at an alternate address, 0x42, which is the case for the HVR-1950. If we probe the wrong address, probe fails and we have a non-working device. We have the actual address passed into the function by way of i2c_props, we just need to use it. Also fix up some copy/paste comment issues and streamline debug spew a touch. Verified to restore my HVR-1950 to full working order. Special thanks to Ken Bass for reporting the issue in the first place, and to both he and Gary Buhrmaster for aiding in debugging and analysis of the problem. Reported-by: Ken Bass Tested-by: Jarod Wilson Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit a6994eb0a706bf36bcb3b5f7e439c5b76c31cfe5 Author: Jarod Wilson Date: Tue Mar 1 12:38:28 2011 -0300 [media] mceusb: don't claim multifunction device non-IR parts There's a Realtek combo card reader and IR receiver device with multiple usb interfaces on it. The mceusb driver is incorrectly grabbing all of them. This change should make it bind to only interface 2 (patch based on lsusb output on the linux-media list from Lucian Muresan). Tested regression-free with the six mceusb devices I have myself. Reported-by: Patrick Boettcher Reported-by: Lucian Muresan Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 3198ed161c9be9bbd15bb2e9c22561248cac6e6a Author: Jarod Wilson Date: Tue Mar 1 12:38:02 2011 -0300 [media] nuvoton-cir: fix wake from suspend The CIR Wake FIFO is 67 bytes long, but the stock remote appears to only populate 65 of them. Limit comparison to 65 bytes, and wake from suspend works a whole lot better (it wasn't working at all for most folks). Fix based on comparison with the old lirc_wb677 driver from Nuvoton, debugging and testing done by Dave Treacy by way of the lirc mailing list. Reported-by: Dave Treacy Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit e3bfeabbf5ba5da7f6cc5d53a83cb7765220c619 Author: Devin Heitmueller Date: Sat Feb 26 02:44:38 2011 -0300 [media] cx18: Add support for Hauppauge HVR-1600 models with s5h1411 The newest variants of the HVR-1600 have an s5h1411/tda18271 for the digital frontend. Add support for these boards. Thanks to Hauppauge Computer Works for providing sample hardware. [awalls@md.metrocast.net: Changed an additional log message to clarify for the end user that the driver is defaulting to an original HVR-1600 for unknown model numbers.] Signed-off-by: Devin Heitmueller Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit d213ad08362909ab50fbd6568fcc9fd568268d29 Author: Michael Date: Sat Feb 26 01:56:34 2011 -0300 [media] ivtv: Fix corrective action taken upon DMA ERR interrupt to avoid hang After upgrading the kernel from stock Ubuntu 7.10 to 10.04, with no hardware changes, I started getting the dreaded DMA TIMEOUT errors, followed by inability to encode until the machine was rebooted. I came across a post from Andy in March (http://www.gossamer-threads.com/lists/ivtv/users/40943#40943) where he speculates that perhaps the corrective actions being taken after a DMA ERROR are not sufficient to recover the situation. After some testing I suspect that this is indeed the case, and that in fact the corrective action may be what hangs the card's DMA engine, rather than the original error. Specifically these DMA ERROR IRQs seem to present with two different values in the IVTV_REG_DMASTATUS register: 0x11 and 0x13. The current corrective action is to clear that status register back to 0x01 or 0x03, and then issue the next DMA request. In the case of a 0x13 this seems to result in a minor glitch in the encoded stream due to the failed transfer that was not retried, but otherwise things continue OK. In the case of a 0x11 the card's DMA write engine is never heard from again, and a DMA TIMEOUT follows shortly after. 0x11 is the killer. I suspect that the two cases need to be handled differently. The difference is in bit 1 (0x02), which is set when the error is about to be successfully recovered, and clear when things are about to go bad. Bit 1 of DMASTATUS is described differently in different places either as a positive "write finished", or an inverted "write busy". If we take the first definition, then when an error arises with state 0x11, it means that the write did not complete. It makes sense to start a new transfer, as in the current code. But if we take the second definition, then 0x11 means "an error but the write engine is still busy". Trying to feed it a new transfer in this situation might not be a good idea. As an experiment, I added code to ignore the DMA ERROR IRQ if DMASTATUS is 0x11. I.e., don't start a new transfer, don't clear our flags, etc. The hope was that the card would complete the transfer and issue a ENC DMA COMPLETE, either successfully or with an error condition there. However the card still hung. The only remaining corrective action being taken with a 0x11 status was then the write back to the status register to clear the error, i.e. DMASTATUS = DMASTATUS & ~3. This would have the effect of clearing the error bit 4, while leaving the lower bits indicating DMA write busy. Strangely enough, removing this write to the status register solved the problem! If the DMA ERROR IRQ with DMASTATUS=0x11 is completely ignored, with no corrective action at all, then the card will complete the transfer and issue a new IRQ. If the status register is written to when it has the value 0x11, then the DMA engine hangs. Perhaps it's illegal to write to DMASTATUS while the read or write busy bit is set? At any rate, it appears that the current corrective action is indeed making things worse rather than better. I put together a patch that modifies ivtv_irq_dma_err to do the following: - Don't write back to IVTV_REG_DMASTATUS. - If write-busy is asserted, leave the card alone. Just extend the timeout slightly. - If write-busy is de-asserted, retry the current transfer. This has completely fixed my DMA TIMEOUT woes. DMA ERR events still occur, but now they seem to be correctly handled. 0x11 events no longer hang the card, and 0x13 events no longer result in a glitch in the stream, as the failed transfer is retried. I'm happy. I've inlined the patch below in case it is of interest. As described above, I have a theory about why it works (based on a different interpretation of bit 1 of DMASTATUS), but I can't guarantee that my theory is correct. There may be another explanation, or it may be a fluke. Maybe ignoring that IRQ entirely would be equally effective? Maybe the status register read/writeback sequence is race condition if the card changes it in the mean time? Also as I am using a PVR-150 only, I have not been able to test it on other cards, which may be especially relevant for 350s that support concurrent decoding. Hopefully the patch does not break the DMA READ path. Mike [awalls@md.metrocast.net: Modified patch to add a verbose comment, make minor brace reformats, and clear the error flags in the IVTV_REG_DMASTATUS iff both read and write DMA were not in progress. Mike's conjecture about a race condition with the writeback is correct; it can confuse the DMA engine.] [Comment and analysis from the ML post by Michael ] Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 1e6406b8f0dc1ae7d7c39c9e1ac6ca78e016ebfb Author: Sven Barth Date: Sun Feb 13 22:09:43 2011 -0300 [media] cx25840: fix probing of cx2583x chips Fix the probing of cx2583x chips, because two controls were clustered that are not created for these chips. This regression was introduced in 2.6.36. Signed-off-by: Sven Barth Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 593110d143f85d1aca227685edd571f137388b24 Author: Andy Walls Date: Sun Feb 13 22:01:38 2011 -0300 [media] cx23885: Remove unused 'err:' labels to quiet compiler warning The previous revert-commit, that affected cx23885-i2c.c, left some unused labels that the compiler griped about. Clean them up. Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit 67914b5c400d6c213f9e56d7547a2038ab5c06f4 Author: Andy Walls Date: Sun Feb 13 21:52:50 2011 -0300 [media] cx23885: Revert "Check for slave nack on all transactions" This reverts commit 44835f197bf1e3f57464f23dfb239fef06cf89be. With the CX23885 hardware I2C master, checking for I2C slave ACK/NAK is not valid when the I2C_EXTEND or I2C_NOSTOP bits are set. Revert the commit that checks for I2C slave ACK/NAK on all transactions, so that XC5000 tuners work with the CX23885 again. Thanks go to Mark Zimmerman for reporting and bisecting this problem. Bisected-by: Mark Zimmerman Reported-by: Mark Zimmerman Signed-off-by: Andy Walls Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit e192a7cf0effe7680264a5bc35c0ad1bdcdc921c Author: Olivier Grenie Date: Fri Jan 14 13:58:59 2011 -0300 [media] DiB7000M: add pid filtering This patch adds the pid filtering for the dib7000M demod. It also corrects the pid filtering for the dib7700 based board. It should prevent an oops, when using dib7700p based board. References: https://bugzilla.novell.com/show_bug.cgi?id=644807 Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Tested-by: Pavel SKARKA Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 0a91be40ed67ca72a81cfd842d5c2604ff1a54a4 Author: Antti Seppälä Date: Sun Feb 13 07:29:15 2011 -0300 [media] Fix sysfs rc protocol lookup for rc-5-sz With the current matching rules the lookup for rc protocol named rc-5-sz matches with "rc-5" before finding "rc-5-sz". Thus one is able to never enable/disable the rc-5-sz protocol via sysfs. Fix the lookup to require an exact match which allows the manipulation of sz protocol. Signed-off-by: Antti Seppälä Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 6670e9cdaf554290e26121aa72f0118f2fac52e5 Author: Daniel J Blueman Date: Wed Feb 23 09:33:59 2011 +0800 x86, build: Make sure mkpiggy fails on read error Ensure build doesn't silently continue despite read failure, addressing a warning due to the unchecked call. Signed-off-by: Daniel J Blueman LKML-Reference: Signed-off-by: H. Peter Anvin commit 52208ae3fc60cbcb214c10fb8b82304199e2cc3a Author: Nicholas Bellinger Date: Thu Feb 24 16:58:20 2011 -0800 [SCSI] target: Fix t_transport_aborted handling in LUN_RESET + active I/O shutdown This patch addresses two outstanding bugs related to T_TASK(cmd)->t_transport_aborted handling during TMR LUN_RESET and active I/O shutdown. This first involves adding two explict t_transport_aborted=1 assignments in core_tmr_lun_reset() in order to signal the task has been aborted, and updating transport_generic_wait_for_tasks() to skip sleeping when t_transport_aborted=1 has been set. This fixes an issue where transport_generic_wait_for_tasks() would end up sleeping indefinately when called from fabric module context while TMR LUN_RESET was happening with long outstanding backend struct se_task not yet being completed. The second adds a missing call to transport_remove_task_from_execute_queue() when task->task_execute_queue=1 is set in order to fix an OOPs when task->t_execute_list has not been dropped. It also fixes the same case in transport_processing_shutdown() to prevent the issue from happening during active I/O struct se_device shutdown. Signed-off-by: Nicholas A. Bellinger Signed-off-by: James Bottomley commit a639dc64e52183a361c260e562e73b0800b89072 Author: Arnaldo Carvalho de Melo Date: Mon Feb 28 13:54:38 2011 -0300 perf symbols: Fix vmlinux path when not using --symfs The ec5761e cset introduced the symfs feature with a bug for loading vmlinux files that ended up causing this failure: [root@emilia v2.6.38-rc5+]# strace -e trace=open perf top --vmlinux ./vmlinux 2>&1 | tail -3 open("/./vmlinux", O_RDONLY) = -1 ENOENT (No such file or directory) ./vmlinux with build id b9266bf40e98dadb5d43a2f3e95d3c5d4aff46dc not found, continuing without symbols The ./vmlinux file can't be used [root@emilia v2.6.38-rc5+]# Remove the extra slash, just like is done in the DSO__ORIG_DSO handling in dso__load() and other parts of the ec5761e cset. Reported-by: Ingo Molnar Cc: David Ahern Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Mike Galbraith Cc: Paul Mackerras Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Tom Zanussi LKML-Reference: Signed-off-by: Arnaldo Carvalho de Melo commit 2c9c8f36c34e1defcaa7e4c298651998b47f5282 Author: Benny Halevy Date: Tue Feb 22 14:43:22 2011 -0800 NFSD: fix decode_cb_sequence4resok Fix bug introduced in patch 85a56480 NFSD: Update XDR decoders in NFSv4 callback client Although decode_cb_sequence4resok ignores highest slotid and target highest slotid it must account for their space in their xdr stream when calling xdr_inline_decode Cc: Chuck Lever Signed-off-by: Benny Halevy Signed-off-by: J. Bruce Fields commit 54ebb8b83f2be99413261c8ba8238b390159a026 Author: Devin Heitmueller Date: Sun Jan 23 19:12:27 2011 -0300 [media] au0828: fix VBI handling when in V4L2 streaming mode au0828: fix VBI handling when in V4L2 streaming mode It turns up V4L2 streaming mode (a.k.a mmap) was broken for VBI streaming. This was causing libzvbi to fall back to V4L1 capture mode, and is a blatent violation of the V4L2 specification. Make the implementation work properly in this mode. Signed-off-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab commit 83587839d648e2a9b5edb5b9d4d9118ead56f22d Author: Mauro Carvalho Chehab Date: Thu Jan 20 18:16:50 2011 -0300 [media] ir-raw: Properly initialize the IR event (BZ#27202) Changeset 4651918a4afdd49bdea21d2f919b189ef17a6399 changed the way events are stored. However, it forgot to fix ir_raw_event_store_edge() to work with the new way. Due to that, the decoders will likely do bad things. Signed-off-by: Mauro Carvalho Chehab commit 752eb7ae5075506fb6ac96a901b0e5b3e459f001 Author: sensoray-dev Date: Wed Jan 19 17:41:45 2011 -0300 [media] s2255drv: firmware re-loading changes Change for firmware re-loading and updated firmware versions. Signed-off-by: Dean Anderson Signed-off-by: Mauro Carvalho Chehab commit 0552774d0670692f37a8d94374ed16fd9f676dbf Author: Pawel Osciak Date: Sun Jan 16 16:22:20 2011 -0300 [media] Fix double free of video_device in mem2mem_testdev video_device is already being freed in video_device.release callback on release. Signed-off-by: Pawel Osciak Reported-by: Roland Kletzing Signed-off-by: Mauro Carvalho Chehab commit 15c88fad4b7dca6b66cebe53c641593b95432fec Author: Malcolm Priestley Date: Sat Jan 15 21:58:57 2011 -0300 [media] DM04/QQBOX memcpy to const char fix Driver Version v1.75 Kernel oops appears in 2.6.37-rc8 in lme_firmware_switch because of a memcpy to a const char. Signed-off-by: Malcolm Priestley Signed-off-by: Mauro Carvalho Chehab