commit 899611ee7d373e5eeda08e9a8632684e1ebbbf00 Author: Linus Torvalds Date: Tue Sep 28 18:01:22 2010 -0700 Linux 2.6.36-rc6 commit 62bdb288bf464862a2801b2e53aadc6c4d100fab Author: David Howells Date: Wed Sep 29 01:57:02 2010 +0100 MN10300: Handle missing sys_cacheflush() when caching disabled When caching is disabled on the MN10300 arch, the sys_cacheflush() function is removed by conditional stuff in the makefiles, but is still referred to by the syscall table. Provide a null version that just returns 0 when caching is disabled (or -EINVAL if the arguments are silly). Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 0f44fbd297e1cda5d9ecc9f5321a86fe647c7d4a Author: Linus Torvalds Date: Tue Sep 28 13:26:57 2010 -0700 alpha: fix compile problem in arch/alpha/kernel/signal.c Tssk. Apparently Al hadn't checked commit c52c2ddc1dfa ("alpha: switch osf_sigprocmask() to use of sigprocmask()") at all. It doesn't compile. Fixed as per suggestions from Michael Cree. Reported-by: Michael Cree Cc: Al Viro Signed-off-by: Linus Torvalds commit 7268e3c4b5eb8e3206a467d664c6e17773f2d19e Merge: b4d3264 fad16e7 Author: Linus Torvalds Date: Tue Sep 28 12:38:52 2010 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ahci: fix module refcount breakage introduced by libahci split commit fad16e7a7f67eef8d33f8ad58850db89382b09ce Author: Tejun Heo Date: Tue Sep 21 09:25:48 2010 +0200 ahci: fix module refcount breakage introduced by libahci split libata depends on scsi_host_template for module reference counting and sht's should be owned by each low level driver. During libahci split, the sht was left with libahci.ko leaving the actual low level drivers not reference counted. This made ahci and ahci_platform always unloadable even while they're being actively used. Fix it by defining AHCI_SHT() macro in ahci.h and defining a sht for each low level ahci driver. stable: only applicable to 2.6.35. Signed-off-by: Tejun Heo Reported-by: Pedro Francisco Tested-by: Michael Tokarev Cc: stable@kernel.org Signed-off-by: Jeff Garzik commit b4d32648c190711177a664af7d51149a8950555e Merge: 0d70397 fff2017 Author: Linus Torvalds Date: Tue Sep 28 12:13:13 2010 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: hwmon (coretemp): Fix build breakage if SMP is undefined commit 0d70397bc72f2122f9702093cce3039ec3ae7575 Merge: a2724f2 0e52247 Author: Linus Torvalds Date: Tue Sep 28 12:02:22 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: fix pci_resource_alignment prototype commit a2724f28d9f99b7b42e800b528902f0e3321873b Merge: 050026f 01db403 Author: Linus Torvalds Date: Tue Sep 28 12:01:26 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (47 commits) tcp: Fix >4GB writes on 64-bit. net/9p: Mount only matching virtio channels de2104x: fix ethtool tproxy: check for transparent flag in ip_route_newports ipv6: add IPv6 to neighbour table overflow warning tcp: fix TSO FACK loss marking in tcp_mark_head_lost 3c59x: fix regression from patch "Add ethtool WOL support" ipv6: add a missing unregister_pernet_subsys call s390: use free_netdev(netdev) instead of kfree() sgiseeq: use free_netdev(netdev) instead of kfree() rionet: use free_netdev(netdev) instead of kfree() ibm_newemac: use free_netdev(netdev) instead of kfree() smsc911x: Add MODULE_ALIAS() net: reset skb queue mapping when rx'ing over tunnel br2684: fix scheduling while atomic de2104x: fix TP link detection de2104x: fix power management de2104x: disable autonegotiation on broken hardware net: fix a lockdep splat e1000e: 82579 do not gate auto config of PHY by hardware during nominal use ... commit fff2017354a3a9906862aabbf2a1cae5b4330e40 Author: Guenter Roeck Date: Mon Sep 27 18:01:49 2010 -0700 hwmon (coretemp): Fix build breakage if SMP is undefined Commit e40cc4bdfd4b89813f072f72bd9c7055814d3f0f introduced a build breakage if CONFIG_SMP is undefined. This commit fixes the problem. This fix is only a workaround. For a real fix, cpu_sibling_mask() should be defined in UP include code, eg in linux/smp.h, and asm/smp.h should not be included directly. This fix is currently not possible because asm/smp.h defines cpu_sibling_mask() unconditionally and is included directly from many source files. Reported-by: Ingo Molnar Tested-by: Ingo Molnar Signed-off-by: Guenter Roeck Cc: Fenghua Yu commit 050026feae5bd4fe2db4096b63b15abce7c47faa Merge: 252a52a c9e2fbd Author: Linus Torvalds Date: Mon Sep 27 21:19:27 2010 -0700 Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Avoid 'constant_test_bit()' misoptimization due to cast to non-volatile commit 01db403cf99f739f86903314a489fb420e0e254f Author: David S. Miller Date: Mon Sep 27 20:24:54 2010 -0700 tcp: Fix >4GB writes on 64-bit. Fixes kernel bugzilla #16603 tcp_sendmsg() truncates iov_len to an 'int' which a 4GB write to write zero bytes, for example. There is also the problem higher up of how verify_iovec() works. It wants to prevent the total length from looking like an error return value. However it does this using 'int', but syscalls return 'long' (and thus signed 64-bit on 64-bit machines). So it could trigger false-positives on 64-bit as written. So fix it to use 'long'. Reported-by: Olaf Bonorden Reported-by: Daniel Büse Reported-by: Andrew Morton Signed-off-by: David S. Miller commit 252a52aa4fa22a668f019e55b3aac3ff71ec1c29 Author: Dan Rosenberg Date: Mon Sep 27 12:30:28 2010 -0400 Fix pktcdvd ioctl dev_minor range check The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom"). Signed-off-by: Dan Rosenberg [ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds commit 95929eff2cb01e9858779283795f4e3943ee020d Author: David Howells Date: Mon Sep 27 13:12:33 2010 +0100 MN10300: Default config choice GDBSTUB_TTYSM0 should be GDBSTUB_ON_TTYSM0 The configuration choice for the port on which the GDB stub listens has a default of GDBSTUB_TTYSM0, but this should be GDBSTUB_ON_TTYSM0 to match the option. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 0b20406cda621c2495d10baab1e87127ceb43337 Author: Sven Eckelmann Date: Mon Sep 27 15:54:44 2010 -0700 net/9p: Mount only matching virtio channels p9_virtio_create will only compare the the channel's tag characters against the device name till the end of the channel's tag but not till the end of the device name. This means that if a user defines channels with the tags foo and foobar then he would mount foo when he requested foonot and may mount foo when he requested foobar. Thus it is necessary to check both string lengths against each other in case of a successful partial string match. Signed-off-by: Sven Eckelmann Signed-off-by: David S. Miller commit 387a85628782690b56492dae4bbf544639f5d4a9 Author: Ondrej Zary Date: Mon Sep 27 11:41:45 2010 +0000 de2104x: fix ethtool When the interface is up, using ethtool breaks it because: a) link is put down but media_timer interval is not shortened to NO_LINK b) rxtx is stopped but not restarted Also manual 10baseT-HD (and probably FD too - untested) mode does not work - the link is forced up, packets are transmitted but nothing is received. Changing CSR14 value to match documentation (not disabling link check) fixes this. Signed-off-by: Ondrej Zary Acked-by: Jeff Garzik Signed-off-by: David S. Miller commit 824044c19552e8a5f345781ccd1c2062673a41ad Merge: fb0c5f0 5786aee Author: David S. Miller Date: Mon Sep 27 15:04:23 2010 -0700 Merge branch 'vhost-net' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost commit fb0c5f0bc8b69b40549449ee7fc65f3706f12062 Author: Ulrich Weber Date: Mon Sep 27 03:31:00 2010 +0000 tproxy: check for transparent flag in ip_route_newports as done in ip_route_connect() Signed-off-by: Ulrich Weber Signed-off-by: David S. Miller commit 7e1b33e5ea392dfc984fc63b76ca75acbf249dcd Author: Ulrich Weber Date: Mon Sep 27 15:02:18 2010 -0700 ipv6: add IPv6 to neighbour table overflow warning IPv4 and IPv6 have separate neighbour tables, so the warning messages should be distinguishable. [ Add a suitable message prefix on the ipv4 side as well -DaveM ] Signed-off-by: Ulrich Weber Signed-off-by: David S. Miller commit b3de7559afbb7a8a35b4be975a6adf6c5e3cdca0 Author: Yuchung Cheng Date: Fri Sep 24 13:22:06 2010 +0000 tcp: fix TSO FACK loss marking in tcp_mark_head_lost When TCP uses FACK algorithm to mark lost packets in tcp_mark_head_lost(), if the number of packets in the (TSO) skb is greater than the number of packets that should be marked lost, TCP incorrectly exits the loop and marks no packets lost in the skb. This underestimates tp->lost_out and affects the recovery/retransmission. This patch fargments the skb and marks the correct amount of packets lost. Signed-off-by: Yuchung Cheng Acked-by: Ilpo Järvinen Signed-off-by: David S. Miller commit d6f74be08d4388222ac83eeba0ade72659e7d247 Merge: 6e029fe bec658f Author: Linus Torvalds Date: Mon Sep 27 12:33:54 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: RDMA/cxgb3: Turn off RX coalescing for iWARP connections commit 6e029fe3737b022610ededf9e70ee84fb2bdc045 Merge: 26d1e7c 2de59fe Author: Linus Torvalds Date: Mon Sep 27 12:32:36 2010 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: (28 commits) ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tile ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICE ARM: 6408/1: omap: Map only available sram memory ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entries ARM: pxa: remove pr_ uses of KERN_ ARM: pxa168fb: clear enable bit when not active ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configured ARM: pxa168: fix corrected reset vector ARM: pxa: Use PIO for PI2C communication on Palm27x ARM: pxa: Fix Vpac270 gpio_power for MMC ARM: 6401/1: plug a race in the alignment trap handler ARM: 6406/1: at91sam9g45: fix i2c bus speed leds: leds-ns2: fix locking ARM: dove: fix __io() definition to use bus based offset dmaengine: fix interrupt clearing for mv_xor ARM: kirkwood: Unbreak PCIe I/O port ARM: Fix build error when using KCONFIG_CONFIG ARM: 6383/1: Implement phys_mem_access_prot() to avoid attributes aliasing ARM: 6400/1: at91: fix arch_gettimeoffset fallout ARM: 6398/1: add proc info for ARM11MPCore/Cortex-A9 from ARM ... commit 26d1e7ced7a51c9ebcff058a9671513fe1fe05b1 Merge: befd1c7 1d6400c Author: Linus Torvalds Date: Mon Sep 27 12:32:00 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: net/9p: fix memory handling/allocation in rdma_request() commit befd1c7aae617fe6ea3d78f77773d171a8413b15 Merge: a11377e 00740c5 Author: Linus Torvalds Date: Mon Sep 27 12:31:12 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: amd64_edac: Fix driver module removal commit a11377e47cf3f0174ea97a699a8ae0929b179aef Merge: 381ba32 c8da96e Author: Linus Torvalds Date: Mon Sep 27 12:29:39 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: TOMOYO: Don't abuse sys_getpid(), sys_getppid() commit 381ba329e578755bc974b46c6a6f2ac286e89b40 Merge: 6509756 cf9a2f3 Author: Linus Torvalds Date: Mon Sep 27 12:28:19 2010 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915/sdvo: Handle unsupported GET_SUPPORTED_ENHANCEMENTS gracefully drm/i915/sdvo: Cleanup connector on error path drm/i915: Fix 945GM regression in e259befd commit 65097561b91c4f8ce92a2905f150900f1779ccd1 Merge: 9a457a5 9320f7c Author: Linus Torvalds Date: Mon Sep 27 12:27:00 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove mmc: sdhci-s3c: fix incorrect spinlock usage after merge mmc: MAINTAINERS: add myself as MMC maintainer commit 9a457a524762edc1bb1ded65b7a75c01738632d5 Merge: bc5fbd9 40d24ff Author: Linus Torvalds Date: Mon Sep 27 12:26:33 2010 -0700 Merge branch 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6 * 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: pcmcia: pd6729: Fix error path pcmcia: preserve configuration information if request_io fails partly commit bc5fbd9cc8b72ea591557c1277237a43c65ce775 Merge: 6a6aa2b eecfd57 Author: Linus Torvalds Date: Mon Sep 27 12:25:10 2010 -0700 Merge git://git.infradead.org/iommu-2.6 * git://git.infradead.org/iommu-2.6: intel-iommu: Use symbolic values instead of magic numbers in Lenovo w/a intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space commit 6a6aa2b7e47c725b5256ff0f7462fe1247cabf5a Merge: f061934 7329cf0 Author: Linus Torvalds Date: Mon Sep 27 12:22:21 2010 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/amd-iommu: Fix rounding-bug in __unmap_single x86/amd-iommu: Work around S3 BIOS bug x86/amd-iommu: Set iommu configuration flags in enable-loop x86, setup: Fix earlyprintk=serial,0x3f8,115200 x86, setup: Fix earlyprintk=serial,ttyS0,115200 commit f0619343ce782a731f55b8ba06d9a7e7d28a0fb8 Merge: 60bdb72 63e6be6 Author: Linus Torvalds Date: Mon Sep 27 12:21:48 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf, x86: Catch spurious interrupts after disabling counters tracing/x86: Don't use mcount in kvmclock.c tracing/x86: Don't use mcount in pvclock.c commit 60bdb72e3c2e808228612f672bd8d18e82872de3 Author: Al Viro Date: Sun Sep 26 19:29:12 2010 +0100 mn10300: check __get_user/__put_user results... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 8e87354d01b3046aa5e1080419178191f3dce8f0 Author: Al Viro Date: Sun Sep 26 19:29:02 2010 +0100 mn10300: get rid of set_fs(USER_DS) in sigframe setup It really has no business being there; short of a serious kernel bug we should already have USER_DS at that point. It shouldn't have been done on x86 either... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit c05628b49b19187841d635dddd3e47caab33242b Author: Al Viro Date: Sun Sep 26 19:28:52 2010 +0100 mn10300: ->restart_block.fn needs to be reset on sigreturn Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 00cbf6080c7d60b999864afcd9010e0bbc7c5db6 Author: Al Viro Date: Sun Sep 26 19:28:42 2010 +0100 mn10300: prevent double syscall restarts set ->orig_d0 to -1, same as what sigreturn does Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit e46924d246e028c94689087db0699438343a344e Author: Al Viro Date: Sun Sep 26 19:28:32 2010 +0100 mn10300: avoid SIGSEGV delivery loop force_sigsegv() is there for purpose... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 18e6bfa96d4d810ad9a69e17f08e0d0089379f22 Author: Al Viro Date: Sun Sep 26 19:28:22 2010 +0100 alpha: __get_user/__put_user results need to be checked... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit c52c2ddc1dfa6fe85ffd5e4c57cf91f6982639fe Author: Al Viro Date: Sun Sep 26 19:28:12 2010 +0100 alpha: switch osf_sigprocmask() to use of sigprocmask() get rid of a useless wrapper, while we are at it Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 3fd6c88ef875a14740801ebfc6b6e4e064a1cdd4 Author: Jan Beulich Date: Mon Sep 27 11:07:00 2010 -0700 3c59x: fix regression from patch "Add ethtool WOL support" This patch (commit 690a1f2002a3091bd18a501f46c9530f10481463) added a new call site for acpi_set_WOL() without checking that the function is actually suitable to be called via vortex_set_wol+0xcd/0xe0 [3c59x] dev_ethtool+0xa5a/0xb70 dev_ioctl+0x2e0/0x4b0 T.961+0x49/0x50 sock_ioctl+0x47/0x290 do_vfs_ioctl+0x7f/0x340 sys_ioctl+0x80/0xa0 system_call_fastpath+0x16/0x1b i.e. outside of code paths run when the device is not yet enabled or already disabled. In particular, putting the device into D3hot is a pretty bad idea when it was already brought up. Furthermore, all prior callers of the function made sure they're actually dealing with a PCI device, while the newly added one didn't. In the same spirit, the .get_wol handler shouldn't indicate support for WOL for non-PCI devices. Signed-off-by: Jan Beulich Signed-off-by: David S. Miller commit bec658ff31453a5726b1c188674d587a5d40c482 Author: Steve Wise Date: Sat Sep 18 19:38:21 2010 -0500 RDMA/cxgb3: Turn off RX coalescing for iWARP connections The HW by default has RX coalescing on. For iWARP connections, this causes a 100ms delay in connection establishement due to the ingress MPA Start message being stalled in HW. So explicitly turn RX coalescing off when setting up iWARP connections. This was causing very bad performance for NP64 gather operations using Open MPI, due to the way it sets up connections on larger jobs. Signed-off-by: Steve Wise Cc: Signed-off-by: Roland Dreier commit 2de59fea8b3095d1df4c729fda041625930aab4f Author: Will Deacon Date: Mon Sep 27 14:55:15 2010 +0100 ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tile The PL310 on the ct-ca9x4 tile for the Versatile Express does not need to add additional latency when accessing its cache RAMs. Unfortunately, the boot monitor sets this up for an 8-cycle delay on reads and writes, resulting in greatly reduced memory performance when the L2 cache is enabled. This patch sets the L2 RAM latencies to the correct value of 1 cycle on the ct-ca9x4 tile before enabling the L2 cache. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit 1d6400c7c9cfd38976b25d55b357200ad3ff1be9 Author: Davidlohr Bueso Date: Mon Sep 13 15:53:18 2010 +0000 net/9p: fix memory handling/allocation in rdma_request() Return -ENOMEM when erroring on kmalloc and fix memory leaks when returning on error. Signed-off-by: Davidlohr Bueso Reviewed-by: Aneesh Kumar K.V Signed-off-by: Eric Van Hensbergen commit 00740c58541b6087d78418cebca1fcb86dc6077d Author: Borislav Petkov Date: Sun Sep 26 12:42:23 2010 +0200 amd64_edac: Fix driver module removal f4347553b30ec66530bfe63c84530afea3803396 removed the edac polling mechanism in favor of using a notifier chain for conveying MCE information to edac. However, the module removal path didn't test whether the driver had setup the polling function workqueue at all and the rmmod process was hanging in the kernel at try_to_del_timer_sync() in the cancel_delayed_work() path, trying to cancel an uninitialized work struct. Fix that by adding a balancing check to the workqueue removal path. Signed-off-by: Borislav Petkov commit c9e2fbd909c20b165b2b9ffb59f8b674cf0a55b0 Author: Alexander Chumachenko Date: Thu Apr 1 15:34:52 2010 +0300 x86: Avoid 'constant_test_bit()' misoptimization due to cast to non-volatile While debugging bit_spin_lock() hang, it was tracked down to gcc-4.4 misoptimization of non-inlined constant_test_bit() due to non-volatile addr when 'const volatile unsigned long *addr' cast to 'unsigned long *' with subsequent unconditional jump to pause (and not to the test) leading to hang. Compiling with gcc-4.3 or disabling CONFIG_OPTIMIZE_INLINING yields inlined constant_test_bit() and correct jump, thus working around the kernel bug. Other arches than asm-x86 may implement this slightly differently; 2.6.29 mitigates the misoptimization by changing the function prototype (commit c4295fbb6048d85f0b41c5ced5cbf63f6811c46c) but probably fixing the issue itself is better. Signed-off-by: Alexander Chumachenko Signed-off-by: Michael Shigorin Acked-by: Linus Torvalds Signed-off-by: H. Peter Anvin commit 2cc6d2bf3d6195fabcf0febc192c01f99519a8f3 Author: Neil Horman Date: Fri Sep 24 09:55:52 2010 +0000 ipv6: add a missing unregister_pernet_subsys call Clean up a missing exit path in the ipv6 module init routines. In addrconf_init we call ipv6_addr_label_init which calls register_pernet_subsys for the ipv6_addr_label_ops structure. But if module loading fails, or if the ipv6 module is removed, there is no corresponding unregister_pernet_subsys call, which leaves a now-bogus address on the pernet_list, leading to oopses in subsequent registrations. This patch cleans up both the failed load path and the unload path. Tested by myself with good results. Signed-off-by: Neil Horman include/net/addrconf.h | 1 + net/ipv6/addrconf.c | 11 ++++++++--- net/ipv6/addrlabel.c | 5 +++++ 3 files changed, 14 insertions(+), 3 deletions(-) Signed-off-by: David S. Miller commit bc68580d41b131396054a1a04a7df4948555ed97 Author: Vasiliy Kulikov Date: Sun Sep 26 18:56:06 2010 -0700 s390: use free_netdev(netdev) instead of kfree() Freeing netdev without free_netdev() leads to net, tx leaks. I might lead to dereferencing freed pointer. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) @@ struct net_device* dev; @@ -kfree(dev) +free_netdev(dev) Signed-off-by: David S. Miller commit 8d879de89807d82bc4cc3e9d73609b874fa9458c Author: Kulikov Vasiliy Date: Sat Sep 25 23:58:06 2010 +0000 sgiseeq: use free_netdev(netdev) instead of kfree() Freeing netdev without free_netdev() leads to net, tx leaks. I might lead to dereferencing freed pointer. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) @@ struct net_device* dev; @@ -kfree(dev) +free_netdev(dev) Signed-off-by: David S. Miller commit 22138d307329e1968fc698821095b87c2fd5de12 Author: Kulikov Vasiliy Date: Sat Sep 25 23:58:03 2010 +0000 rionet: use free_netdev(netdev) instead of kfree() Freeing netdev without free_netdev() leads to net, tx leaks. I might lead to dereferencing freed pointer. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) @@ struct net_device* dev; @@ -kfree(dev) +free_netdev(dev) Signed-off-by: David S. Miller commit 52933f052186877afd218aef7a1b2dbdb010939f Author: Kulikov Vasiliy Date: Sat Sep 25 23:58:00 2010 +0000 ibm_newemac: use free_netdev(netdev) instead of kfree() Freeing netdev without free_netdev() leads to net, tx leaks. I might lead to dereferencing freed pointer. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) @@ struct net_device* dev; @@ -kfree(dev) +free_netdev(dev) Signed-off-by: David S. Miller commit 62038e4a146b97352d5911e6ede36c58d4187c3e Author: Vincent Stehlé Date: Sun Sep 26 18:50:05 2010 -0700 smsc911x: Add MODULE_ALIAS() This enables auto loading for the smsc911x ethernet driver. Signed-off-by: Vincent Stehlé Signed-off-by: David S. Miller commit 693019e90ca45d881109d32c0c6d29adf03f6447 Author: Tom Herbert Date: Thu Sep 23 11:19:54 2010 +0000 net: reset skb queue mapping when rx'ing over tunnel Reset queue mapping when an skb is reentering the stack via a tunnel. On second pass, the queue mapping from the original device is no longer valid. Signed-off-by: Tom Herbert Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit a3d6713fbd2ccb50898a6f88664da96a7857c039 Author: Karl Hiramoto Date: Thu Sep 23 01:50:54 2010 +0000 br2684: fix scheduling while atomic You can't call atomic_notifier_chain_unregister() while in atomic context. Fix, call un/register_atmdevice_notifier in module __init and __exit. Bug report: http://comments.gmane.org/gmane.linux.network/172603 Reported-by: Mikko Vinni Tested-by: Mikko Vinni Signed-off-by: Karl Hiramoto Signed-off-by: David S. Miller commit c8da96e87d349e9035345293093ecc74792fb96a Author: Ben Hutchings Date: Sun Sep 26 05:55:13 2010 +0100 TOMOYO: Don't abuse sys_getpid(), sys_getppid() System call entry functions sys_*() are never to be called from general kernel code. The fact that they aren't declared in header files should have been a clue. These functions also don't exist on Alpha since it has sys_getxpid() instead. Signed-off-by: Ben Hutchings Acked-by: Tetsuo Handa Signed-off-by: James Morris commit ca9a783575d2affed30ef27a3427a7705527ddac Author: Ondrej Zary Date: Sat Sep 25 10:39:17 2010 +0000 de2104x: fix TP link detection Compex FreedomLine 32 PnP-PCI2 cards have only TP and BNC connectors but the SROM contains AUI port too. When TP loses link, the driver switches to non-existing AUI port (which reports that carrier is always present). Connecting TP back generates LinkPass interrupt but de_media_interrupt() is broken - it only updates the link state of currently connected media, ignoring the fact that LinkPass and LinkFail bits of MacStatus register belong to the TP port only (the chip documentation says that). This patch changes de_media_interrupt() to switch media to TP when link goes up (and media type is not locked) and also to update the link state only when the TP port is used. Also the NonselPortActive (and also SelPortActive) bits of SIAStatus register need to be cleared (by writing 1) after reading or they're useless. Signed-off-by: Ondrej Zary Acked-by: Jeff Garzik Signed-off-by: David S. Miller commit b0255a02351b00ca55f4eb2588d05a5db9dd1a58 Author: Ondrej Zary Date: Fri Sep 24 23:57:02 2010 +0000 de2104x: fix power management At least my 21041 cards come out of suspend with bus mastering disabled so they did not work after resume(no data transferred). After adding pci_set_master(), the driver oopsed immediately on resume - because de_clean_rings() is called on suspend but de_init_rings() call was missing in resume. Also disable link (reset SIA) before sleep (de4x5 does this too). Signed-off-by: Ondrej Zary Acked-by: Jeff Garzik Signed-off-by: David S. Miller commit 9320f7cbbdd5febf013b0e91db29189724057738 Author: Marek Szyprowski Date: Thu Sep 23 16:22:05 2010 +0200 mmc: sdhci-s3c: fix NULL ptr access in sdhci_s3c_remove If not all clocks have been defined in platform data, the driver will cause a null pointer dereference when it is removed. This patch fixes this issue. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Cc: Signed-off-by: Andrew Morton Signed-off-by: Chris Ball commit 06fe577f841f383b2d4f743cfb74fac7f6468353 Author: Marek Szyprowski Date: Mon Sep 20 15:03:42 2010 +0200 mmc: sdhci-s3c: fix incorrect spinlock usage after merge In the commit f522886e202a34a2191dd5d471b3c4d46410a9a0 a merge conflict in the sdhci-s3c driver been fixed. However the fix used incorrect spinlock operation - it caused a race with sdhci interrupt service. The correct way to solve it is to use spin_lock_irqsave/irqrestore() calls. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Andrew Morton Signed-off-by: Chris Ball commit 245feaa61dbdabffafd47b973595e06abb1288f4 Author: Chris Ball Date: Fri Sep 10 12:05:24 2010 -0400 mmc: MAINTAINERS: add myself as MMC maintainer Signed-off-by: Chris Ball Cc: Pierre Ossman Cc: Signed-off-by: Andrew Morton commit 40d24ff9b4309d37999bc0ae91a271f57651d9dd Author: Rahul Ruikar Date: Sun Sep 26 17:00:29 2010 +0530 pcmcia: pd6729: Fix error path In error return path call pci_disable_device() which was enabled earlier. Signed-off-by: Rahul Ruikar Signed-off-by: Dominik Brodowski commit 32163f4b2cef28a5aab8b226ffecfc6379a53786 Author: Al Viro Date: Sat Sep 25 21:07:51 2010 +0100 alpha: fix usp value in multithreaded coredumps rdusp() gives us the right value only for the current thread... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 77edffb652b33a565e099ff0a1687762f03eb46a Author: Al Viro Date: Sat Sep 25 21:07:14 2010 +0100 alpha: fix hae_cache race in RESTORE_ALL We want interrupts disabled on all paths leading to RESTORE_ALL; otherwise, we are risking an IRQ coming between the updates of alpha_mv->hae_cache and *alpha_mv->hae_register and set_hae() within the IRQ getting badly confused. RESTORE_ALL used to play with disabling IRQ itself, but that got removed back in 2002, without making sure we had them disabled on all paths. It's cheaper to make sure we have them disabled than to revert to original variant... Remove the detritus left from that commit back in 2002; we used to need a reload of $0 and $1 since swpipl would change those, but doing that had become pointless when we stopped doing swpipl in there... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 56162badadb91aae93843d8d6558c7d7780e3cb2 Merge: e7553b1 f281fb5 Author: Linus Torvalds Date: Sat Sep 25 09:51:54 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: prevent merges of discard and write requests commit e7553b19da07fffbefe83119f25738e2cc90c426 Merge: 5ec1055 3b23cd2 Author: Linus Torvalds Date: Sat Sep 25 09:51:31 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs ASoC: Fix multi-componentism ASoC: Fix soc-cache buffer overflow bug ALSA: oxygen: fix analog capture on Claro halo cards ALSA: hda - Add Dell Latitude E6400 model quirk ASoC: fix clkdev API usage in sh/migor.c commit 5ec1055aa5632dd7a8283cdb5fa9be3c535eaa06 Author: Larry Woodman Date: Fri Sep 24 12:04:48 2010 -0400 Avoid pgoff overflow in remap_file_pages Thomas Pollet noticed that the remap_file_pages() system call in fremap.c has a potential overflow in the first part of the if statement below, which could cause it to process bogus input parameters. Specifically the pgoff + size parameters could be wrap thereby preventing the system call from failing when it should. Reported-by: Thomas Pollet Signed-off-by: Larry Woodman Signed-off-by: Linus Torvalds commit 3b23cd28751c70a3d9d4f5c9e1d2f6dbbe04f4e8 Merge: b614e38 01fdf18 Author: Takashi Iwai Date: Sat Sep 25 17:57:53 2010 +0200 Merge branch 'fix/hda' into for-linus commit b614e38e78ec1aacf80fd6124cfcc6e45925647c Merge: e68d3b3 0077ca0 Author: Takashi Iwai Date: Sat Sep 25 17:57:49 2010 +0200 Merge branch 'fix/asoc' into for-linus commit e68d3b316ab7b02a074edc4f770e6a746390cb7d Author: Dan Rosenberg Date: Sat Sep 25 11:07:27 2010 -0400 ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow unprivileged users to read uninitialized kernel stack memory, because several fields of the hdsp{m}_config_info structs declared on the stack are not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Cc: Signed-off-by: Takashi Iwai commit 2de5c00ac06c8983ab33ad51a8341584f1cf42c3 Author: Santosh Shilimkar Date: Fri Sep 24 07:21:05 2010 +0100 ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICE On Davinci SRAM is mapped as MT_DEVICE becasue of the section mapping pre-requisite instead of intended MT_MEMORY_NONCACHED Since the section mapping limitation gets fixed with first patch in this series, the MT_MEMORY_NONCACHED can be used now. Signed-off-by: Santosh Shilimkar Acked-by: Kevin Hilman Signed-off-by: Russell King commit e546f21b4b7af012d9f18edad6237339adfeb681 Author: Santosh Shilimkar Date: Fri Sep 24 07:19:49 2010 +0100 ARM: 6408/1: omap: Map only available sram memory Currently we map 1 MB section while setting up SRAM on OMAPs Regardless of the actual memory. The physical OCM RAM available on OMAP SOCs is in order of KBs. This patch maps only available sram and cleans up some un-necessary cpu_is_xxx checks. Mapping un-available or non-accessible(secure) memory on the newer ARM processor is dangerous. Because ARM CPUs can now speculatively prefetch, we should avoid mapping any no-existing or secure memory. Signed-off-by: Santosh Shilimkar Acked-by: Tony Lindgren Signed-off-by: Russell King commit f1a2481c0ad3aebd94d11b317c488deaadc25002 Author: Santosh Shilimkar Date: Fri Sep 24 07:18:22 2010 +0100 ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entries This patch populates the L1 entries for MT_MEMORY and MT_MEMORY_NONCACHED types so that at boot-up, we can map memories outside system memory at page level granularity Previously the mapping was limiting to section level, which creates unnecessary additional mapping for which physical memory may not present. On the newer ARM with speculation, this is dangerous and can result in untraceable aborts. Signed-off-by: Santosh Shilimkar Signed-off-by: Russell King commit f281fb5fe54e15a7ab802945e42f8e24fceb56b2 Author: Adrian Hunter Date: Sat Sep 25 12:42:55 2010 +0200 block: prevent merges of discard and write requests Add logic to prevent two I/O requests being merged if only one of them is a discard. Ditto secure discard. Without this fix, it is possible for write requests to transform into discard requests. For example: Submit bio 1 to discard 8 sectors from sector n Submit bio 2 to write 8 sectors from sector n + 16 Submit bio 3 to write 8 sectors from sector n + 8 Bio 1 becomes request 1. Bio 2 becomes request 2. Bio 3 is merged with request 2, and then subsequently request 2 is merged with request 1 resulting in just one I/O request which discards all 24 sectors. Signed-off-by: Adrian Hunter (Moved the checks above the position checks /Jens) Signed-off-by: Jens Axboe commit f933b87e6f06fcce5988fd5e8ebf3a97858a7155 Merge: 2f27bf8 d420280 Author: Russell King Date: Sat Sep 25 10:27:50 2010 +0100 Merge branch 'fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ycmiao/pxa-linux-2.6 commit e0f9c4f332c99b213d4a0b7cd21dc0781ceb3d86 Author: Ondrej Zary Date: Thu Sep 23 10:59:18 2010 +0000 de2104x: disable autonegotiation on broken hardware At least on older 21041-AA chips (mine is rev. 11), TP duplex autonegotiation causes the card not to work at all (link is up but no packets are transmitted). de4x5 disables autonegotiation completely. But it seems to work on newer (21041-PA rev. 21) so disable it only on rev<20 chips. Signed-off-by: Ondrej Zary Acked-by: Jeff Garzik Signed-off-by: David S. Miller commit f064af1e500a2bf4607706f0f458163bdb2a6ea5 Author: Eric Dumazet Date: Wed Sep 22 12:43:39 2010 +0000 net: fix a lockdep splat We have for each socket : One spinlock (sk_slock.slock) One rwlock (sk_callback_lock) Possible scenarios are : (A) (this is used in net/sunrpc/xprtsock.c) read_lock(&sk->sk_callback_lock) (without blocking BH) spin_lock(&sk->sk_slock.slock); ... read_lock(&sk->sk_callback_lock); ... (B) write_lock_bh(&sk->sk_callback_lock) stuff write_unlock_bh(&sk->sk_callback_lock) (C) spin_lock_bh(&sk->sk_slock) ... write_lock_bh(&sk->sk_callback_lock) stuff write_unlock_bh(&sk->sk_callback_lock) spin_unlock_bh(&sk->sk_slock) This (C) case conflicts with (A) : CPU1 [A] CPU2 [C] read_lock(callback_lock) spin_lock_bh(slock) We have one problematic (C) use case in inet_csk_listen_stop() : local_bh_disable(); bh_lock_sock(child); // spin_lock_bh(&sk->sk_slock) WARN_ON(sock_owned_by_user(child)); ... sock_orphan(child); // write_lock_bh(&sk->sk_callback_lock) lockdep is not happy with this, as reported by Tetsuo Handa It seems only way to deal with this is to use read_lock_bh(callbacklock) everywhere. Thanks to Jarek for pointing a bug in my first attempt and suggesting this solution. Reported-by: Tetsuo Handa Tested-by: Tetsuo Handa Signed-off-by: Eric Dumazet CC: Jarek Poplawski Tested-by: Eric Dumazet Signed-off-by: David S. Miller commit 8ae09259ffe2402e956efd5a36220b6161e9ecb3 Merge: fd194e6 0eae779 Author: Linus Torvalds Date: Fri Sep 24 19:09:20 2010 -0700 Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging * 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: x86/hwmon: pkgtemp has no dependency on PCI MAINTAINERS: Update hwmon entry x86/hwmon: register alternate sibling upon CPU removal x86/hwmon: fix initialization of pkgtemp x86/hwmon: fix initialization of coretemp x86/hwmon: don't leak device attribute file from pkgtemp_probe() and pkgtemp_remove() x86/hwmon: avoid deadlock on CPU removal in pkgtemp x86/hwmon: fix module init for hotplug-but-no-device-found case hwmon: (lis3) Fix Oops with NULL platform data commit fd194e6493be47bd491931d19f563f59b54fd769 Merge: e92b05d ea44e06 Author: Linus Torvalds Date: Fri Sep 24 19:08:39 2010 -0700 Merge branch 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile * 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: arch/tile: remove dead code from intvec_32.S commit d42028060dfe1b9b65a387a849e82fd5c86359fb Author: Joe Perches Date: Sat Sep 11 22:10:49 2010 -0700 ARM: pxa: remove pr_ uses of KERN_ Signed-off-by: Joe Perches Signed-off-by: Eric Miao commit 07a5d146c80b7caa9e754b51f64d3fcbbc74e9c0 Author: Haojian Zhuang Date: Wed Sep 8 09:42:39 2010 -0400 ARM: pxa168fb: clear enable bit when not active While fb isn't active, we should clear CFG_GRA_ENA bit. The existing code can't clear this bit. Signed-off-by: Haojian Zhuang Acked-by: Marek Vasut Signed-off-by: Eric Miao commit cfc6a554d7a364997a43964b4b1290487f890447 Author: Eric Miao Date: Tue Sep 7 15:10:14 2010 +0800 ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configured When CONFIG_PXA3xx is not selected, cpu_is_pxa3xx() doesn't expand to zero, which in some places doesn't result in correct optimization. Signed-off-by: Eric Miao Reported-and-tested-by: Marek Vasut commit 32c4dad8f872fadb0ae3caa15d26e73934982217 Author: Mark F. Brown Date: Thu Aug 26 05:07:29 2010 -0400 ARM: pxa168: fix corrected reset vector Reset vector for pxa168 is 0xffff_0000 not 0x0. This fix allows reboot to work Signed-off-by: Mark F. Brown Signed-off-by: Eric Miao commit cf625368d3ad664c7c9ae89974599bbfe9947511 Author: Marek Vasut Date: Sat Aug 14 06:08:30 2010 +0200 ARM: pxa: Use PIO for PI2C communication on Palm27x Original idea by: Mike Rapoport Signed-off-by: Marek Vasut commit 979a281c34906fd905d6153ad999487b0c56f396 Author: Marek Vasut Date: Mon Aug 9 03:55:09 2010 +0200 ARM: pxa: Fix Vpac270 gpio_power for MMC GPIO 0 is valid, yet this platform doesn't have any power GPIO for MMC. Signed-off-by: Marek Vasut commit ea44e06e79a393fb577272399ef7521a143b6b59 Author: Chris Metcalf Date: Fri Sep 24 17:19:20 2010 -0400 arch/tile: remove dead code from intvec_32.S This "bpt_code" instruction was killed off in our development line a while ago (the actual definition of bpt_code that is used is in kernel/traps.c) but I didn't push it for 2.6.36 because it seemed harmless and I didn't want to try to push more than absolutely necessary. However, we recently fixed a bug in our gcc that had been causing "-gdwarf2" not to be passed to the assembler, and passing this flag causes an erroneous assembler failure in the presence of code in a data section, sometimes. While we'd like to track down the bug in the assembler, we'd also like to make sure 2.6.36 builds with the current toolchain, so I'm removing this dead code as well. Signed-off-by: Chris Metcalf commit e92b05dec8865619ea2608c5c11a54b01467482f Author: Linus Torvalds Date: Fri Sep 24 14:13:57 2010 -0700 fremap: get rid of broken 'end' variable Thomas Pollet points out that the 'end' variable is broken. It was computed based on start/size before they were page-aligned, and as such doesn't actually match any of the other actions we take. The overflow test on end was also redundant, since we had already tested it with the properly aligned version. So just get rid of it entirely. The one remaining use for that broken variable can just use 'start+size' like all the other cases already did. Reported-by: Thomas Pollet Signed-off-by: Linus Torvalds commit d1f3e68efb4c98fa229b39ff09a8984ef16cafa4 Merge: cb9cae0 5dad6c3 Author: Linus Torvalds Date: Fri Sep 24 14:08:15 2010 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: o2dlm: force free mles during dlm exit ocfs2: Sync inode flags with ext2. ocfs2: Move 'wanted' into parens of ocfs2_resmap_resv_bits. ocfs2: Use cpu_to_le16 for e_leaf_clusters in ocfs2_bg_discontig_add_extent. ocfs2: update ctime when changing the file's permission by setfacl ocfs2/net: fix uninitialized ret in o2net_send_message_vec() Ocfs2: Handle empty list in lockres_seq_start() for dlmdebug.c Ocfs2: Re-access the journal after ocfs2_insert_extent() in dxdir codes. ocfs2: Fix lockdep warning in reflink. ocfs2/lockdep: Move ip_xattr_sem out of ocfs2_xattr_get_nolock. commit cb9cae0395d70fc4539f6904c11d3a14c0001006 Merge: 06706b5 2dab394 Author: Linus Torvalds Date: Fri Sep 24 13:55:29 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: update Kconfig help text for CONFIG_USB_SUSPEND usb: musb: gadget: restart request on clearing endpoint halt usb: musb: host: Issue a memory barrier before starting DMA usb: musb: gadget: fix dma length in txstate usb: musb: gadget: complete request only if data is transfered over usb: musb: gadget: fix DMA length for OUT transfer usb: musb: gadget: enable autoclear for OUT transfer in both DMA 0 and DMA 1 usb: musb: gadget: fix bulk IN infinit hangs in double buffer case usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style USB: fix bug in initialization of interface minor numbers commit 06706b5847318294b91b49a0b4f85d281d33adc8 Merge: cbff1e9 d3654cd Author: Linus Torvalds Date: Fri Sep 24 13:55:12 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: ti-st: remove st_get_plat_device commit cbff1e91bfb8afc6dbd84fec3e81855b926cceaf Merge: acdc0d5 201ba4c Author: Linus Torvalds Date: Fri Sep 24 13:55:01 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: vgaarb: trivial fix drm: radeon cleanup fixes... drm: fix trivial coding errors drm: ttm sparse fixes. drm/nouveau: fix panels using straps-based mode detection drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer. drm/radeon: don't allow device to be opened if powered down commit acdc0d5ef9dd74534fe8df77a2056fa1d911abe5 Author: Al Viro Date: Fri Sep 24 06:25:34 2010 +0100 m32r: fix breakage from "m32r: use generic ptrace_resume code" Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit bb9c861ee1b94c97cd98c783a2b4c1cf53ff1712 Author: Al Viro Date: Fri Sep 24 06:24:53 2010 +0100 m32r: hole in shifting pc back It's a userland pointer; worse, an untrustable one since ptrace has just provided a chance to modify it. X-Roothole-Covering-Cabal: TINRCC Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a05c4e1d669d09faa90ce7b22646ad1a4b0de3ff Author: Al Viro Date: Fri Sep 24 06:23:57 2010 +0100 m32r: don't block signals if sigframe setup has failed Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a748102430f4dbbfca3ff81ac12db6e4f1243677 Author: Al Viro Date: Fri Sep 24 06:22:30 2010 +0100 make m32r handle multiple pending signals Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a7f8388e2c167c73b6abb3b749157aafd08f90ee Author: Al Viro Date: Fri Sep 24 06:20:35 2010 +0100 m32r: fix rt_sigsuspend() do_signal() should know about saved_mask for it to work... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 0eae7799000cdf0c2ed596c39bfb71030809fc71 Author: Jan Beulich Date: Mon Sep 13 10:24:47 2010 +0000 x86/hwmon: pkgtemp has no dependency on PCI Other than coretemp, from which this code was apparently derived, there is no PCI specific code in this driver. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit 885374e37bd782acd70a1a0c6b14b3eb2bb3a99c Author: Guenter Roeck Date: Fri Sep 24 08:43:44 2010 -0700 MAINTAINERS: Update hwmon entry Signed-off-by: Guenter Roeck commit e40cc4bdfd4b89813f072f72bd9c7055814d3f0f Author: Jan Beulich Date: Mon Sep 13 10:23:05 2010 +0000 x86/hwmon: register alternate sibling upon CPU removal Just like pkgtemp registers another core of the same package when one gets removed, coretemp should register another hyperthread (if available) in that situation. As pointed out in the patch fixing the respective code in pkgtemp, the list protectng mutex must be dropped before calling coretemp_device_add(), and due to the restructured loop (including an explicit return) the "safe" variant of the list iterator isn't needed anymore. Signed-off-by: Jan Beulich Cc: Rudolf Marek Signed-off-by: Guenter Roeck commit f6aeccdb96fc0555e939dd507702922f07dcbcbb Author: Jan Beulich Date: Mon Sep 13 10:18:54 2010 +0000 x86/hwmon: fix initialization of pkgtemp Feature availability should also be checked in the hotplug code path. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit a46590533ad7b0f3f640732081d7e1658145c0ba Author: Jan Beulich Date: Thu Sep 23 22:21:34 2010 -0700 x86/hwmon: fix initialization of coretemp Using cpuid_eax() to determine feature availability on other than the current CPU is invalid. And feature availability should also be checked in the hotplug code path. Signed-off-by: Jan Beulich Cc: Rudolf Marek Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit d172132f358552eabd7a7410e478ffeead445243 Author: Jan Beulich Date: Mon Sep 13 10:14:43 2010 +0000 x86/hwmon: don't leak device attribute file from pkgtemp_probe() and pkgtemp_remove() While apparently inherited from coretemp source, this particular error handling cleanup and exit path wasn't copied properly (or perhaps got discarded intermediately and not re-added properly later). Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck (added device file removal in pkgtemp_remove) commit d9bca4358286584cc22f4261ee3a60cad01aa4d4 Author: Jan Beulich Date: Mon Sep 13 10:11:05 2010 +0000 x86/hwmon: avoid deadlock on CPU removal in pkgtemp pkgtemp_device_remove(), holding the list protecting mutex, calls pkgtemp_device_add(), which itself wants to acquire the same mutex. Holding the mutex over the entire loop body in pkgtemp_device_remove() isn't really necessary, as long as the loop gets exited after processing the matched CPU. Once exiting the loop after removing an eventual match, there's no need for using the "safe" list iterator anymore. Signed-off-by: Jan Beulich Cc: Fenghua Yu Signed-off-by: Guenter Roeck commit 89a3fd35ba0318a7208e2c8d8ca6189f567d4a93 Author: Jan Beulich Date: Mon Sep 13 10:05:51 2010 +0000 x86/hwmon: fix module init for hotplug-but-no-device-found case In commit 0dca94baeab4a1a514841b0a4c8e3a51dfb4d5ae the call to platform_driver_unregister() was made conditional upon !HOTPLUG_CPU, but the return value from coretemp_init() was left to indicate an error. This isn't correct, as the negative return value indicates to the module loader that initialization failed, which isn't intended here and results in dangling pointers. Signed-off-by: Jan Beulich Cc: Chen Gong Signed-off-by: Guenter Roeck commit f7c77a3dc4683659b6f0d1b6cbc82b6253d095e0 Author: Takashi Iwai Date: Thu Sep 23 10:01:11 2010 -0700 hwmon: (lis3) Fix Oops with NULL platform data The recent addition of threaded irq handler causes a NULL dereference when used with hp_accel driver, which has NULL pdata. Acked-by: Samu Onkalo Cc: Signed-off-by: Takashi Iwai Signed-off-by: Guenter Roeck commit 2dab3948f5eeffa320ad92207ef77c997518867b Author: Alan Stern Date: Fri Sep 24 11:41:46 2010 -0400 USB: update Kconfig help text for CONFIG_USB_SUSPEND This patch (as1429) updates the Kconfig help text for CONFIG_USB_SUSPEND. The power/level file is now deprecated; we should tell people to use power/control instead. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit a666e3e6098a9f56310e4ec2705f1dad124a34b5 Author: Sergei Shtylyov Date: Sat Sep 11 13:23:12 2010 -0500 usb: musb: gadget: restart request on clearing endpoint halt Commit 46034dca515bc4ddca0399ae58106d1f5f0d809f (USB: musb_gadget_ep0: stop abusing musb_gadget_set_halt()) forgot to restart a queued request after clearing the endpoint halt feature. This results in a couple of USB resets while enumerating the file-backed storage gadget due to CSW packet not being sent for the MODE SENSE(10) command. Signed-off-by: Sergei Shtylyov Cc: stable@kernel.org Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 4c647338267e14c93892f6f125f17ea2419eea51 Author: Santosh Shilimkar Date: Mon Sep 20 10:32:07 2010 +0300 usb: musb: host: Issue a memory barrier before starting DMA This patch fixes the issue which was observed while transfering a large file ( > 20MB) over USB (OMAP MUSB controller acts as USB host) to an attached USB thumb drive. It was found that CDB field of CBW packet was set to 0x0. This was due to missing a barrier before DMA engine starts transfer. This buffer is allocated using dma_alloc_coherent which gives non-cacheble but bufferable memory and hence needed a write memory barrier to flush the write buffer. More info on this thread is here: http://www.spinics.net/lists/linux-omap/msg33987.html Signed-off-by: Santosh Shilimkar Signed-off-by: Maulik Mankad Cc: Russell King Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 66af83ddf7b5a4ea94e79cbeadaa0aeed4def5f7 Author: Ming Lei Date: Mon Sep 20 10:32:06 2010 +0300 usb: musb: gadget: fix dma length in txstate DMA length should not go beyond the availabe space of request buffer, so fix it. Also set max_len of cppi dma channel as max size of int type, so make musb dma handling happier. Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit bb27bc2c1133372b54d00f3077ea4acbbf459045 Author: Ming Lei Date: Mon Sep 20 10:32:05 2010 +0300 usb: musb: gadget: complete request only if data is transfered over Complete the current request only if the data transfer is over. Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 1018b4e44f4f191c6e3c631c4eee35d0a112d32b Author: Ming Lei Date: Mon Sep 20 10:32:04 2010 +0300 usb: musb: gadget: fix DMA length for OUT transfer DMA length should not go beyond the availabe space of request buffer, so fix it. Signed-off-by: Ming Lei Acked-by: Anand Gadiyar Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 490e5fbe8ccb198fb719ae49eaa0c7071273e016 Author: Ming Lei Date: Mon Sep 20 10:32:03 2010 +0300 usb: musb: gadget: enable autoclear for OUT transfer in both DMA 0 and DMA 1 This patch fixes one bugs of OUT transfer in double buffer case: -the current code only enable autoclear for dma mode 1, and not for dma mode 0 Without this patch, test #5 of usbtest can't be passed if we configure musb as g_zero and use fifo mode 3 to enable double buffer mode. With this patch and the following patch(fix dma length), on my beagle B5, test#5(queued bulk out) may go beyond 18Mbyte/s(seems dma mode 0 is quicker in double buffer case) if musb is configured as g_zero and fifo mode 3 is taken, follows the test command: #./testusb -D DEV_NAME -c 1024 -t 5 -s 32768 -g 8 [1] Also I have tested this patch can't make g_ether broken. [1],source of testusb : tools/usb/testusb.c under linux kernel; Signed-off-by: Ming Lei Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit eeb1b2a4a9112bcd05d0ce53b99bbd5404abe060 Author: Ming Lei Date: Mon Sep 20 10:32:02 2010 +0300 usb: musb: gadget: fix bulk IN infinit hangs in double buffer case This patch fixes one infinite hang of bulk IN transfer in double buffer case, the hang can be observed easily by test #6 of usbtest if musb is configured as g_zero and fifo mode 3 is taken to enable double fifo. In fact, the patch only removes the check for non-empty fifo before loading data from new request into fifo since the check is not correct: -in double buffer case, fifo may accommodate more than one packet, even though it has contained one packet already and is non-empty -since last DMA is completed before calling musb_g_tx, it is sure that fifo may accommodate at least one packet Without applying the patch, new requst enqueued from .complte may not have a chance to be loaded into fifo, then will never be completed and cause infinite hangs. With the patch, on my beagle B5, test#6(queued bulk in) can be passed and test result may go beyond 33Mbyte/s if musb is configured as g_zero and fifo mode 3 is taken, follows the test command: #testusb -D DEV_NAME -c 1024 -t 6 -s 32768 -g 8 [1] [1], -source of testusb : tools/usb/testusb.c under linux kernel; Signed-off-by: Ming Lei Acked-by: Anand Gadiyar Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit bd2e74d657fc7d514881cc2117e323790b257914 Author: Ming Lei Date: Mon Sep 20 10:32:01 2010 +0300 usb: musb: gadget: fix kernel panic if using out ep with FIFO_TXRX style For shared fifo hw endpoint(with FIFO_TXRX style), only ep_in field of musb_hw_ep is intialized in musb_g_init_endpoints, and ep_out is not initialized, but musb_g_rx and rxstate may access ep_out field of musb_hw_ep by the method below: musb_ep = &musb->endpoints[epnum].ep_out which can cause the kernel panic[1] below, this patch fixes the issue by getting 'musb_ep' from '&musb->endpoints[epnum].ep_in' for shared fifo endpoint. [1], kernel panic [root@OMAP3EVM /]# musb_interrupt 1583: ** IRQ peripheral usb0008 tx0000 rx4000 musb_stage0_irq 460: <== Power=f0, DevCtl=99, int_usb=0x8 musb_g_rx 772: <== (null), rxcsr 4007 ffffffe8 musb_g_rx 786: iso overrun on ffffffe8 Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = c0004000 [00000008] *pgd=00000000 Internal error: Oops: 17 [#1] PREEMPT last sysfs file: /sys/devices/platform/musb_hdrc/usb1/usb_device/usbdev1.1/dev Modules linked in: g_zero CPU: 0 Tainted: G W (2.6.35-rc6-gkh-wl+ #92) PC is at musb_g_rx+0xfc/0x2ec LR is at vprintk+0x3f4/0x458 pc : [] lr : [] psr: 20000193 sp : c760bd78 ip : c03c9d70 fp : c760bdbc r10: 00000000 r9 : fa0ab1e0 r8 : 0000000e r7 : c7e80158 r6 : ffffffe8 r5 : 00000001 r4 : 00004003 r3 : 00010003 r2 : c760bcd8 r1 : c03cd030 r0 : 0000002e Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel Control: 10c5387d Table: 8778c019 DAC: 00000017 Process kmemleak (pid: 421, stack limit = 0xc760a2e8) Stack: (0xc760bd78 to 0xc760c000) bd60: ffffffe8 c04b1b58 bd80: ffffffe8 c7c01ac0 00000000 c7e80d24 c0084238 00000001 00000001 c7e80158 bda0: 0000000e 00000008 00000099 000000f0 c760be04 c760bdc0 c02bcd68 c02c06b4 bdc0: 00000099 00000008 00004000 c760bdd8 c03cc4f8 00000000 00000002 c7e80158 bde0: c7d2e300 60000193 c760a000 0000005c 00000000 00000000 c760be24 c760be08 be00: c02bcecc c02bc1ac c7d2e300 c7d2e300 0000005c c760a000 c760be54 c760be28 be20: c00ad698 c02bce6c 00000000 c7d2e300 c067c258 0000005c c067c294 00000001 be40: c760a000 00000000 c760be74 c760be58 c00af984 c00ad5fc 0000005c 00000000 be60: 00000000 00000002 c760be8c c760be78 c0039080 c00af8d0 ffffffff fa200000 be80: c760beec c760be90 c0039b6c c003900c 00000001 00000000 c7d1e240 00000000 bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff 00000000 c068bae8 bee0: c760bf24 c760bef0 c00ff7d0 c0064ec4 00000001 00000000 c00ff700 00000000 bf00: c0087f00 00000000 60000013 c0d76a70 c0e23795 00000001 c760bf4c c760bf28 bf20: c00ffdd8 c00ff70c c068bb08 c068bae8 60000013 c0100938 c068bb30 00000000 bf40: c760bf84 c760bf50 c010014c c00ffd84 00000001 00000000 c010000c 00012c00 bf60: c7c33f04 00012c00 c7c33f04 00000000 c0100938 00000000 c760bf9c c760bf88 bf80: c01009a8 c0100018 c760bfa8 c7c33f04 c760bff4 c760bfa0 c0088000 c0100944 bfa0: c760bf98 00000000 00000000 00000001 dead4ead ffffffff ffffffff c08ba2bc bfc0: 00000000 c049e7fa 00000000 c0087f70 c760bfd0 c760bfd0 c7c33f04 c0087f70 bfe0: c006f5e8 00000013 00000000 c760bff8 c006f5e8 c0087f7c 7f0004ff df2000ff Backtrace: [] (musb_g_rx+0x0/0x2ec) from [] (musb_interrupt+0xbc8/0xcc0) [] (musb_interrupt+0x0/0xcc0) from [] (generic_interrupt+0x6c/0x84) [] (generic_interrupt+0x0/0x84) from [] (handle_IRQ_event+0xa8/0x1ec) r7:c760a000 r6:0000005c r5:c7d2e300 r4:c7d2e300 [] (handle_IRQ_event+0x0/0x1ec) from [] (handle_level_irq+0xc0/0x13c) [] (handle_level_irq+0x0/0x13c) from [] (asm_do_IRQ+0x80/0xa0) r7:00000002 r6:00000000 r5:00000000 r4:0000005c [] (asm_do_IRQ+0x0/0xa0) from [] (__irq_svc+0x4c/0xb4) Exception stack(0xc760be90 to 0xc760bed8) be80: 00000001 00000000 c7d1e240 00000000 bea0: 00000000 c068bae8 00000000 60000013 00000001 00000000 00000000 c760beec bec0: c0064ecc c760bed8 c00ff7d0 c003a0a8 60000013 ffffffff r5:fa200000 r4:ffffffff [] (sub_preempt_count+0x0/0x100) from [] (find_and_get_object+0xd0/0x110) r5:c068bae8 r4:00000000 [] (find_and_get_object+0x0/0x110) from [] (scan_block+0x60/0x104) r8:00000001 r7:c0e23795 r6:c0d76a70 r5:60000013 r4:00000000 [] (scan_block+0x0/0x104) from [] (kmemleak_scan+0x140/0x484) [] (kmemleak_scan+0x0/0x484) from [] (kmemleak_scan_thread+0x70/0xcc) r8:00000000 r7:c0100938 r6:00000000 r5:c7c33f04 r4:00012c00 [] (kmemleak_scan_thread+0x0/0xcc) from [] (kthread+0x90/0x98) r5:c7c33f04 r4:c760bfa8 [] (kthread+0x0/0x98) from [] (do_exit+0x0/0x684) r7:00000013 r6:c006f5e8 r5:c0087f70 r4:c7c33f04 Code: e3002312 e58d6000 e2833e16 eb0422d5 (e5963020) ---[ end trace f3d5e96f75c297b7 ]--- Signed-off-by: Ming Lei Reviewed-by: Sergei Shtylyov Cc: David Brownell Cc: Anand Gadiyar Cc: Mike Frysinger Cc: Sergei Shtylyov Cc: stable Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 0026e00523a85b90a92a93ddf6660939ecef3e54 Author: Alan Stern Date: Tue Sep 21 15:01:53 2010 -0400 USB: fix bug in initialization of interface minor numbers Recent changes in the usbhid layer exposed a bug in usbcore. If CONFIG_USB_DYNAMIC_MINORS is enabled then an interface may be assigned a minor number of 0. However interfaces that aren't registered as USB class devices also have their minor number set to 0, during initialization. As a result usb_find_interface() may return the wrong interface, leading to a crash. This patch (as1418) fixes the problem by initializing every interface's minor number to -1. It also cleans up the usb_register_dev() function, which besides being somewhat awkwardly written, does not unwind completely on all its error paths. Signed-off-by: Alan Stern Tested-by: Philip J. Turmel Tested-by: Gabriel Craciunescu Tested-by: Alex Riesen Tested-by: Matthias Bayer CC: Jiri Kosina Cc: stable Signed-off-by: Greg Kroah-Hartman commit d3654cd29e676cd3a2622aec926b0b56fa444714 Author: Pavan Savoy Date: Thu Aug 19 14:08:51 2010 -0400 Staging: ti-st: remove st_get_plat_device In order to support multiple ST platform devices, a new symbol 'st_get_plat_device' earlier needed to be exported by the arch/XX/brd-XX.c file which intends to add the ST platform device. On removing this dependency, now inside ST driver maintain the array of ST platform devices that would be registered. As of now let id=0, as and when we end up having such platforms where mutliple ST devices can exist, id would come from protocol drivers (BT, FM and GPS) as to on which platform device they want to register to. Signed-off-by: Pavan Savoy Acked-by: Randy Dunlap Cc: Anca Emanuel Signed-off-by: Greg Kroah-Hartman commit 63e6be6d98e1a2bcdca86872b67052e51ab6afa1 Author: Robert Richter Date: Wed Sep 15 18:20:34 2010 +0200 perf, x86: Catch spurious interrupts after disabling counters Some cpus still deliver spurious interrupts after disabling a counter. This caused 'undelivered NMI' messages. This patch fixes this. Introduced by: 4177c42: perf, x86: Try to handle unknown nmis with an enabled PMU Reported-by: Ingo Molnar Signed-off-by: Robert Richter Cc: Don Zickus Cc: gorcunov@gmail.com Cc: fweisbec@gmail.com Cc: ying.huang@intel.com Cc: ming.m.lin@intel.com Cc: yinghai@kernel.org Cc: andi@firstfloor.org Cc: eranian@google.com Cc: Peter Zijlstra LKML-Reference: <20100915162034.GO13563@erda.amd.com> Signed-off-by: Ingo Molnar commit 7329cf0201f48695862e334828a108aa7175e955 Merge: 74b3c44 04e0463 Author: Ingo Molnar Date: Fri Sep 24 11:19:53 2010 +0200 Merge branch 'amd-iommu/2.6.36' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/linux-2.6-iommu into x86/urgent commit 01fdf1801e349302fce5d9865470a7100a2d9b74 Author: Takashi Iwai Date: Fri Sep 24 09:09:42 2010 +0200 ALSA: hda - Fix auto-parse of SPDIF input of Realtek codecs The SPDIF in audio widget must be searched through the list as the widget that contains the given pin as the connection source. The current code was implemented in a reverse way. Signed-off-by: Takashi Iwai commit a850ea30374ebed32a0724742601861853fde869 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:06 2010 +0900 hugetlb, rmap: add BUG_ON(!PageLocked) in hugetlb_add_anon_rmap() Confirming page lock is held in hugetlb_add_anon_rmap() may be useful to detect possible future problems. Signed-off-by: Naoya Horiguchi Acked-by: Rik van Riel Acked-by: Andrea Arcangeli Signed-off-by: Linus Torvalds commit 56c9cfb13c9b6516017eea4e8cbe22ea02e07ee6 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:04 2010 +0900 hugetlb, rmap: fix confusing page locking in hugetlb_cow() The "if (!trylock_page)" block in the avoidcopy path of hugetlb_cow() looks confusing and is buggy. Originally this trylock_page() was intended to make sure that old_page is locked even when old_page != pagecache_page, because then only pagecache_page is locked. This patch fixes it by moving page locking into hugetlb_fault(). Signed-off-by: Naoya Horiguchi Acked-by: Rik van Riel Signed-off-by: Linus Torvalds commit cd67f0d2a9a6b5b9f79f4343dc8805757d9ebae2 Author: Naoya Horiguchi Date: Fri Sep 10 13:23:04 2010 +0900 hugetlb, rmap: use hugepage_add_new_anon_rmap() in hugetlb_cow() Obviously, setting anon_vma for COWed hugepage should be done by hugepage_add_new_anon_rmap() to scan vmas faster. This patch fixes it. Signed-off-by: Naoya Horiguchi Acked-by: Andrea Arcangeli Reviewed-by: Rik van Riel Signed-off-by: Linus Torvalds commit 433abed6c6f76ca079a9564f2a1a51fd28ebe0ca Author: Naoya Horiguchi Date: Fri Sep 10 13:23:03 2010 +0900 hugetlb, rmap: always use anon_vma root pointer This patch applies Andrea's fix given by the following patch into hugepage rmapping code: commit 288468c334e98aacbb7e2fb8bde6bc1adcd55e05 Author: Andrea Arcangeli Date: Mon Aug 9 17:19:09 2010 -0700 This patch uses anon_vma->root and avoids unnecessary overwriting when anon_vma is already set up. Signed-off-by: Naoya Horiguchi Acked-by: Andrea Arcangeli Reviewed-by: Rik van Riel Signed-off-by: Linus Torvalds commit 201ba4c43214c6c386cff66b33efb612b6260ba2 Author: Daniel J Blueman Date: Wed Sep 22 18:05:35 2010 +0100 vgaarb: trivial fix Correct function being needlessly visible outside compilation unit when the only users are internal. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit bcf835e52e0974b2e2e056b190dd66372b28cfce Merge: 91e71c1 ca242ac Author: Linus Torvalds Date: Thu Sep 23 17:13:17 2010 -0700 Merge branch 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Fix reboot on Intel hosts KVM: fix irqfd assign/deassign race commit 4417d7f60218d838158f1f85eab5e9ca8d1aa92e Author: Daniel J Blueman Date: Wed Sep 22 17:57:19 2010 +0100 drm: radeon cleanup fixes... Fix string interpreted as trigraph and typo. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit d3147e86d71e74c93d361988d9441575da71345e Author: Daniel J Blueman Date: Fri Sep 24 10:10:23 2010 +1000 drm: fix trivial coding errors Correct function storage class, and correct assignment type. Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit 0e57a3cc71884ef38e0568b63e004e2c782ea6d2 Author: Daniel J Blueman Date: Wed Sep 22 17:45:45 2010 +0100 drm: ttm sparse fixes. Correct allocation flags type and function prototype for ANSI C compliance. [airlied: whitespace fixed] Signed-off-by: Daniel J Blueman Reviewed-by: Alex Deucher Signed-off-by: Dave Airlie commit a5d60827a6bf9e7345f9e50423c1673ec4e14568 Author: Ben Skeggs Date: Thu Sep 23 16:44:01 2010 +1000 drm/nouveau: fix panels using straps-based mode detection nouveau_bios_fp_mode() zeroes the mode struct before filling in relevant entries. This nukes the mode id initialised by drm_mode_create(), and causes warnings from idr when we try to remove the mode. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie commit 5dad6c39d156fbbde0b0ef170d9173feffdeb546 Author: Srinivas Eeda Date: Tue Sep 21 16:27:26 2010 -0700 o2dlm: force free mles during dlm exit While umounting, a block mle doesn't get freed if dlm is shutdown after master request is received but before assert master. This results in unclean shutdown of dlm domain. This patch frees all mles that lie around after other nodes were notified about exiting the dlm and marking dlm state as leaving. Only block mles are expected to be around, so we log ERROR for other mles but still free them. Signed-off-by: Srinivas Eeda Signed-off-by: Joel Becker commit 0000b862027d624ac564609b87c1aa4d14dd1e46 Author: Tao Ma Date: Sun Sep 19 13:42:29 2010 +0800 ocfs2: Sync inode flags with ext2. We sync our inode flags with ext2 and define them by hex values. But actually in commit 3669567(4 years ago), all these values are moved to include/linux/fs.h. So we'd better also use them as what ext2 did. So sync our inode flags with ext2 by using FS_*. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 4a452de4fdfe4dbb27e491904d8bfaf1262bdff4 Author: Tao Ma Date: Sun Sep 19 13:42:28 2010 +0800 ocfs2: Move 'wanted' into parens of ocfs2_resmap_resv_bits. The first time I read the function ocfs2_resmap_resv_bits, I consider about what 'wanted' will be used and consider about the comments. Then I find it is only used if the reservation is empty. ;) So we'd better move it to the parens so that it make the code more readable, what's more, ocfs2_resmap_resv_bits is used so frequently and we should save some cpus. Acked-by: Mark Fasheh Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 47dea423799d98c53793237ab386a94976f305d5 Author: Tao Ma Date: Mon Sep 13 15:13:50 2010 +0800 ocfs2: Use cpu_to_le16 for e_leaf_clusters in ocfs2_bg_discontig_add_extent. e_leaf_clusters is a le16, so use cpu_to_le16 instead of cpu_to_le32. What's more, we change 'clusters' to unsigned int to signify that the size of 'clusters' isn't important here. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 12828061cdacfb1db3eb03fd71952d5ebc555bbb Author: Tao Ma Date: Mon Sep 13 14:00:23 2010 +0800 ocfs2: update ctime when changing the file's permission by setfacl In commit 30e2bab, ext3 fixed it. So change it accordingly in ocfs2. Steps to reproduce: # touch aaa # stat -c %Z aaa 1283760364 # setfacl -m 'u::x,g::x,o::x' aaa # stat -c %Z aaa 1283760364 Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 91e71c12c506e15028c252a5a097723f41c518dd Merge: ed3473b fc6e756 Author: Linus Torvalds Date: Thu Sep 23 13:30:13 2010 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86: thinkpad-acpi: avoid keymap pitfall Change MSI LAPTOP driver maintainer to Lee, Chun-Yi commit fc6e756894b703952fd277a1f98a5d93e7ba847a Author: Henrique de Moraes Holschuh Date: Fri Sep 17 21:53:41 2010 -0300 thinkpad-acpi: avoid keymap pitfall Change the code so that it will use the correct size for keymap entries. Do it in a way that makes it harder to screw it up in the future. Reported-by: Jaime Velasco Juan Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Matthew Garrett commit 58e226c6d44b250641e229b306030da5c84e4341 Author: Lee, Chun-Yi Date: Fri Sep 10 08:04:19 2010 +0000 Change MSI LAPTOP driver maintainer to Lee, Chun-Yi Change MSI LAPTOP driver maintainer from Lennart Poettering to Lee, Chun-Yi. MSI is a Taiwan OEM company, Lee, Chun-Yi can more easy to contact with MSI and maintain msi-laptop driver. Thank's for Lennart Poettering's contribute, Lee, Chun-Yi will base on his article to continue maintain the msi-laptop driver. Signed-off-by: Lee, Chun-Yi Signed-off-by: Matthew Garrett commit ed3473b18f85b591c1e8afec831e9e06120142b7 Author: Mark Salter Date: Thu Sep 23 18:04:33 2010 +0100 MN10300: Arch doesn't support HAVE_ARCH_TRACEHOOK Remove specification of HAVE_ARCH_TRACEHOOK for MN10300 as the arch does not support it at this time. Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit a6ef9c8f1635ccd175be9eb5d36c376ffb8fbc51 Author: Mark Salter Date: Thu Sep 23 18:04:28 2010 +0100 MN10300: Fix SIGRTMAX SIGRTMAX should be _NSIG not _NSIG-1. Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit cf9a2f3afc75d41a61cbc91e725b9ce0746c400a Author: Chris Wilson Date: Thu Sep 23 16:17:33 2010 +0100 drm/i915/sdvo: Handle unsupported GET_SUPPORTED_ENHANCEMENTS gracefully In the event that the external chipset doesn't implement the GET_SUPPORTED_ENHANCEMENTS commands, gracefully treat it as having no enhancments rather than bailing. Reported-and-tested-by: Woody Suwalski Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18342 Signed-off-by: Chris Wilson commit 123d5c0197d8333c3f5cb9572a0c8299dc611233 Author: Chris Wilson Date: Thu Sep 23 16:15:21 2010 +0100 drm/i915/sdvo: Cleanup connector on error path We weren't unlinking the freed connector from the drm lists, and so hit some use-after-free if we failed to initialise the connector. Reported-and-tested-by: Woody Suwalski Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18342 Signed-off-by: Chris Wilson commit fd429a0842c61b60e02a7e63430a609957821c67 Author: Mark Salter Date: Thu Sep 23 16:40:22 2010 +0100 MN10300: Fix endianess of ext2 bitops The MN10300 arch ext2 bitops assume a big-endian kernel, but the MN10300 arch only runs in little-endian mode. Reported-by: Akira Takeuchi Signed-off-by: Mark Salter Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 57aebd7739c8dbbf403876ee1e9673fafc83d856 Merge: 561f818 46b30ea Author: Linus Torvalds Date: Thu Sep 23 08:06:55 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu: fix pcpu_last_unit_cpu commit ca242ac9960dc61530e25a2c190e4e13fd5f1ecb Author: Avi Kivity Date: Tue Sep 21 19:59:43 2010 +0200 KVM: Fix reboot on Intel hosts When we reboot, we disable vmx extensions or otherwise INIT gets blocked. If a task on another cpu hits a vmx instruction, it will fault if vmx is disabled. We trap that to avoid a nasty oops and spin until the reboot completes. Problem is, we sleep with interrupts disabled. This blocks smp_send_stop() from running, and the reboot process halts. Fix by enabling interrupts before spinning. KVM-Stable-Tag. Signed-off-by: Avi Kivity Signed-off-by: Marcelo Tosatti commit 6bbfb2653177a00f70e57e53625502d43804fed0 Author: Michael S. Tsirkin Date: Sun Sep 19 19:02:31 2010 +0200 KVM: fix irqfd assign/deassign race I think I see the following (theoretical) race: During irqfd assign, we drop irqfds lock before we schedule inject work. Therefore, deassign running on another CPU could cause shutdown and flush to run before inject, causing user after free in inject. A simple fix it to schedule inject under the lock. Signed-off-by: Michael S. Tsirkin Acked-by: Gregory Haskins Signed-off-by: Marcelo Tosatti commit 04e0463e088b41060c08c255eb0d3278a504f094 Author: Joerg Roedel Date: Thu Sep 23 16:12:48 2010 +0200 x86/amd-iommu: Fix rounding-bug in __unmap_single In the __unmap_single function the dma_addr is rounded down to a page boundary before the dma pages are unmapped. The address is later also used to flush the TLB entries for that mapping. But without the offset into the dma page the amount of pages to flush might be miscalculated in the TLB flushing path. This patch fixes this bug by using the original address to flush the TLB. Cc: stable@kernel.org Signed-off-by: Joerg Roedel commit 4c894f47bb49284008073d351c0ddaac8860864e Author: Joerg Roedel Date: Thu Sep 23 15:15:19 2010 +0200 x86/amd-iommu: Work around S3 BIOS bug This patch adds a workaround for an IOMMU BIOS problem to the AMD IOMMU driver. The result of the bug is that the IOMMU does not execute commands anymore when the system comes out of the S3 state resulting in system failure. The bug in the BIOS is that is does not restore certain hardware specific registers correctly. This workaround reads out the contents of these registers at boot time and restores them on resume from S3. The workaround is limited to the specific IOMMU chipset where this problem occurs. Cc: stable@kernel.org Signed-off-by: Joerg Roedel commit e9bf51971157e367aabfc111a8219db010f69cd4 Author: Joerg Roedel Date: Mon Sep 20 14:33:07 2010 +0200 x86/amd-iommu: Set iommu configuration flags in enable-loop This patch moves the setting of the configuration and feature flags out out the acpi table parsing path and moves it into the iommu-enable path. This is needed to reliably fix resume-from-s3. Cc: stable@kernel.org Signed-off-by: Joerg Roedel commit 2f27bf834e1d0a06e83d7458b535891c552271aa Author: Nicolas Pitre Date: Mon Sep 20 04:10:43 2010 +0100 ARM: 6401/1: plug a race in the alignment trap handler When the policy for user space is to ignore misaligned accesses from user space, the processor then performs a documented rotation on the accessed data. This is the result of the access being trapped, and the kernel disabling the alignment trap before returning to user space again. In kernel space we always want misaligned accesses to be fixed up. This is enforced by always re-enabling the alignment trap on every entry into kernel space from user space. No such re-enabling is performed when an exception occurs while already in kernel space as the alignment trap is always supposed to be enabled in that case. There is however a small race window when a misaligned access in user space is trapped and the alignment trap disabled, but the CPU didn't return to user space just yet. Any exception would be entered from kernel space at that point and the kernel would then execute with the alignment trap disabled. Thanks to Maxime Bizon for providing a test module that made this issue reproducible. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King commit 1d5b4c0fa9ff79a4f01e5efc1caefd16b190a3dc Author: Peter Korsgaard Date: Wed Sep 22 21:29:59 2010 +0100 ARM: 6406/1: at91sam9g45: fix i2c bus speed Use a correct udelay value to get bus speed around 100KHz. The udelay value was most likely copied from the older devices, but the 9g45 is signicantly faster (400MHz, DDR, ..), so a udelay of 2 gives a bus speed of around 190KHz, which is too fast for some devices. A udelay value of 5 gives a bus speed of around 90KHz here. Signed-off-by: Peter Korsgaard Signed-off-by: Nicolas Ferre Signed-off-by: Russell King commit 94bf27586631d32ed08dd49eeaa77222b7874cf3 Merge: d93c333 f539dfe Author: Russell King Date: Thu Sep 23 11:52:04 2010 +0100 Merge branch 'for-rmk' of git://git.kernel.org/pub/scm/linux/kernel/git/nico/orion commit 9b74f7348f214b1f99819f0d0da4a1cbabb1e740 Author: Chris Wilson Date: Wed Sep 22 19:10:44 2010 +0100 drm/i915: Fix 945GM regression in e259befd A minor typo caused a single fence register to be incorrectly programmed, resulting in occassional tiling corruption. Reported-and-tested-by: Hans de Bruin Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18962 Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 605c82bab5abe0816e5e32716875c245f89f39da Author: Bruce Allan Date: Wed Sep 22 17:17:01 2010 +0000 e1000e: 82579 do not gate auto config of PHY by hardware during nominal use For non-managed versions of 82579, set the bit that prevents the hardware from automatically configuring the PHY after resets only when the driver performs a reset, clear the bit after resets. This is so the hardware can configure the PHY automatically when the part is reset in a manner that is not controlled by the driver (e.g. in a virtual environment via PCI FLR) otherwise the PHY will be mis-configured causing issues such as failing to link at 1000Mbps. For managed versions of 82579, keep the previous behavior since the manageability firmware will handle the PHY configuration. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit a1ce647378c0262fe72757f989e961b2de6460a5 Author: Bruce Allan Date: Wed Sep 22 17:16:40 2010 +0000 e1000e: 82579 jumbo frame workaround causing CRC errors The subject workaround was causing CRC errors due to writing the wrong register with updates of the RCTL register. It was also found that the workaround function which modifies the RCTL register was being called in the middle of a read-modify-write operation of the RCTL register, so the function call has been moved appropriately. Lastly, jumbo frames must not be allowed when CRC stripping is disabled by a module parameter because the workaround requires the CRC be stripped. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 831bd2e6a6c09588fdde453ecb858f050ac1b942 Author: Bruce Allan Date: Wed Sep 22 17:16:18 2010 +0000 e1000e: 82579 unaccounted missed packets On 82579, there is a hardware bug that can cause received packets to not get transferred from the PHY to the MAC due to K1 (a power saving feature of the PHY-MAC interconnect similar to ASPM L1). Since the MAC controls the accounting of missed packets, these will go unnoticed. Workaround the issue by setting the K1 beacon duration according to the link speed. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 5f3eed6fe0e36e4b56c8dd9160241a868ee0de2a Author: Bruce Allan Date: Wed Sep 22 17:15:54 2010 +0000 e1000e: 82566DC fails to get link Two recent patches to cleanup the reset[1] and initial PHY configuration[2] code paths for ICH/PCH devices inadvertently left out a 10msec delay and device ID check respectively which are necessary for the 82566DC (device id 0x104b) to be configured properly, otherwise it will not get link. [1] commit e98cac447cc1cc418dff1d610a5c79c4f2bdec7f [2] commit 3f0c16e84438d657d29446f85fe375794a93f159 CC: stable@kernel.org Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 87fb7410cd8d4396dee0155526568645adba3b99 Author: Bruce Allan Date: Wed Sep 22 17:15:33 2010 +0000 e1000e: 82579 SMBus address and LEDs incorrect after device reset Since the hardware is prevented from performing automatic PHY configuration (the driver does it instead), the OEM_WRITE_ENABLE bit in the EXTCNF_CTRL register will not get cleared preventing the SMBus address and the LED configuration to be written to the PHY registers. On 82579, do not check the OEM_WRITE_ENABLE bit. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 8395ae8303255b31a8625035fc98391c88b0c257 Author: Bruce Allan Date: Wed Sep 22 17:15:08 2010 +0000 e1000e: 82577/8/9 issues with device in Sx When going to Sx, disable gigabit in PHY (e1000_oem_bits_config_ich8lan) in addition to the MAC before configuring PHY wakeup otherwise the PHY configuration writes might be missed. Also write the LED configuration and SMBus address to the PHY registers (e1000_oem_bits_config_ich8lan and e1000_write_smbus_addr, respectively). The reset is no longer needed since re-auto-negotiation is forced in e1000_oem_bits_config_ich8lan and leaving it in causes issues with auto-negotiating the link. Signed-off-by: Bruce Allan Tested-by: Jeff Pieper Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 94e2238969e89f5112297ad2a00103089dde7e8f Author: Ulrich Weber Date: Wed Sep 22 06:45:11 2010 +0000 xfrm4: strip ECN bits from tos field otherwise ECT(1) bit will get interpreted as RTO_ONLINK and routing will fail with XfrmOutBundleGenError. Signed-off-by: Ulrich Weber Signed-off-by: David S. Miller commit 258af47479980d8238a04568b94a4e55aa1cb537 Author: Steven Rostedt Date: Wed Sep 22 22:22:25 2010 -0400 tracing/x86: Don't use mcount in kvmclock.c The guest can use the paravirt clock in kvmclock.c which is used by sched_clock(), which in turn is used by the tracing mechanism for timestamps, which leads to infinite recursion. Disable mcount/tracing for kvmclock.o. Cc: stable@kernel.org Cc: Jeremy Fitzhardinge Cc: Avi Kivity Signed-off-by: Steven Rostedt commit 9ecd4e1689208afe9b059a5ce1333acb2f42c4d2 Author: Jeremy Fitzhardinge Date: Wed Sep 22 17:07:27 2010 -0700 tracing/x86: Don't use mcount in pvclock.c When using a paravirt clock, pvclock.c can be used by sched_clock(), which in turn is used by the tracing mechanism for timestamps, which leads to infinite recursion. Disable mcount/tracing for pvclock.o. Cc: stable@kernel.org Signed-off-by: Jeremy Fitzhardinge LKML-Reference: <4C9A9A3F.4040201@goop.org> Signed-off-by: Steven Rostedt commit 561f8182dbf24b1be9207038aa5f82e34be4bad1 Author: Yinghai Lu Date: Wed Sep 22 13:05:15 2010 -0700 ipmi: fix hardcoded ipmi device exit path warning When modprobe.conf has options ipmi_si type="kcs" ports=0xCA2 regspacings="4" ipmi_si can be loaded properly, but when try to unload it get: Sep 20 15:00:27 xx abrt: Kerneloops: Reported 1 kernel oopses to Abrt Sep 20 15:00:27 xx abrtd: Directory 'kerneloops-1285020027-1' creation detected Sep 20 15:00:27 xx abrtd: New crash /var/spool/abrt/kerneloops-1285020027-1, processing Sep 20 15:01:09 xx kernel: ------------[ cut here ]------------ Sep 20 15:01:09 xx kernel: WARNING: at drivers/base/driver.c:262 driver_unregister+0x8a/0xa0() Sep 20 15:01:09 xx kernel: Hardware name: Sun Fire x4800 Sep 20 15:01:09 xx kernel: Unexpected driver unregister! Sep 20 15:01:09 xx kernel: Modules linked in: ipmi_si(-) ipmi_msghandler ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat bridge stp llc autofs4 sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf xt_physdev be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb3i iw_cxgb3 cxgb3 mdio ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod vhost_net macvtap macvlan tun kvm_intel kvm uinput sg ses enclosure ahci libahci pcspkr i2c_i801 i2c_core iTCO_wdt iTCO_vendor_support igb dca i7core_edac edac_core ext3 jbd mbcache sd_mod crc_t10dif megaraid_sas [last unloaded: ipmi_devintf] Sep 20 15:01:09 xx kernel: Pid: 10625, comm: modprobe Tainted: G W 2.6.36-rc5-tip+ #6 Sep 20 15:01:09 xx kernel: Call Trace: Sep 20 15:01:09 xx kernel: [] warn_slowpath_common+0x7f/0xc0 Sep 20 15:01:09 xx kernel: [] warn_slowpath_fmt+0x46/0x50 Sep 20 15:01:09 xx kernel: [] driver_unregister+0x8a/0xa0 Sep 20 15:01:09 xx kernel: [] pnp_unregister_driver+0x12/0x20 Sep 20 15:01:09 xx kernel: [] cleanup_ipmi_si+0x3c/0xa7 [ipmi_si] Sep 20 15:01:09 xx kernel: [] sys_delete_module+0x1a0/0x270 Sep 20 15:01:09 xx kernel: [] ? do_page_fault+0x150/0x320 Sep 20 15:01:09 xx kernel: [] system_call_fastpath+0x16/0x1b Sep 20 15:01:09 xx kernel: ---[ end trace 0d1967161adcee0d ]--- We need to check if ipmi_pnp_driver is loaded before we try to unload it. Signed-off-by: Yinghai Lu Cc: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f501ed524b26ba1b739b7f7feb0a0e1496878769 Author: Vladimir Zapolskiy Date: Wed Sep 22 13:05:13 2010 -0700 rtc: s3c: balance state changes of wakeup flag This change resolves a problem about unbalanced calls of enable_irq_wakeup() and disable_irq_wakeup() for alarm interrupt. Bug reproduction: root@eb600:~# echo 0 > /sys/class/rtc/rtc0/wakealarm WARNING: at kernel/irq/manage.c:361 set_irq_wake+0x7c/0xe4() Unbalanced IRQ 46 wake disable Modules linked in: [] (unwind_backtrace+0x0/0xd8) from [] (warn_slowpath_common+0x44/0x5c) [] (warn_slowpath_common+0x44/0x5c) from [] (warn_slowpath_fmt+0x24/0x30) [] (warn_slowpath_fmt+0x24/0x30) from [] (set_irq_wake+0x7c/0xe4) [] (set_irq_wake+0x7c/0xe4) from [] (s3c_rtc_setalarm+0xa8/0xb8) [] (s3c_rtc_setalarm+0xa8/0xb8) from [] (rtc_set_alarm+0x60/0x74) [] (rtc_set_alarm+0x60/0x74) from [] (rtc_sysfs_set_wakealarm+0xc8/0xd8) [] (rtc_sysfs_set_wakealarm+0xc8/0xd8) from [] (dev_attr_store+0x20/0x24) [] (dev_attr_store+0x20/0x24) from [] (sysfs_write_file+0x104/0x13c) [] (sysfs_write_file+0x104/0x13c) from [] (vfs_write+0xb0/0x158) [] (vfs_write+0xb0/0x158) from [] (sys_write+0x3c/0x68) [] (sys_write+0x3c/0x68) from [] (ret_fast_syscall+0x0/0x28) Signed-off-by: Vladimir Zapolskiy Cc: Alessandro Zummo Cc: Ben Dooks Cc: Atul Dahiya Cc: Taekgyun Ko Cc: Kukjin Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2aeadc30de45a72648f271603203ab392b80f607 Author: Andrea Arcangeli Date: Wed Sep 22 13:05:12 2010 -0700 mmap: call unlink_anon_vmas() in __split_vma() in case of error If __split_vma fails because of an out of memory condition the anon_vma_chain isn't teardown and freed potentially leading to rmap walks accessing freed vma information plus there's a memleak. Signed-off-by: Andrea Arcangeli Acked-by: Johannes Weiner Acked-by: Rik van Riel Acked-by: Hugh Dickins Cc: Marcelo Tosatti Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a247c3a97a0216b18a46243eda26081f1928ec37 Author: Andrea Arcangeli Date: Wed Sep 22 13:05:12 2010 -0700 rmap: fix walk during fork The below bug in fork led to the rmap walk finding the parent huge-pmd twice instead of just once, because the anon_vma_chain objects of the child vma still point to the vma->vm_mm of the parent. The patch fixes it by making the rmap walk accurate during fork. It's not a big deal normally but it worth being accurate considering the cost is the same. Signed-off-by: Andrea Arcangeli Acked-by: Johannes Weiner Acked-by: Rik van Riel Acked-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df08cdc7ef606509debe7677c439be0ca48790e4 Author: Andrew Morton Date: Wed Sep 22 13:05:11 2010 -0700 drivers/pci/intel-iommu.c: fix build with older gcc's drivers/pci/intel-iommu.c: In function `__iommu_calculate_agaw': drivers/pci/intel-iommu.c:437: sorry, unimplemented: inlining failed in call to 'width_to_agaw': function body not available drivers/pci/intel-iommu.c:445: sorry, unimplemented: called from here Move the offending function (and its siblings) to top-of-file, remove the forward declaration. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=17441 Reported-by: Martin Mokrejs Cc: David Woodhouse Cc: Jesse Barnes Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e85bfd3aa7a34fa963bb268a676b41694e6dcf96 Author: David Rientjes Date: Wed Sep 22 13:05:10 2010 -0700 oom: filter unkillable tasks from tasklist dump /proc/sys/vm/oom_dump_tasks is enabled by default, so it's necessary to limit as much information as possible that it should emit. The tasklist dump should be filtered to only those tasks that are eligible for oom kill. This is already done for memcg ooms, but this patch extends it to both cpuset and mempolicy ooms as well as init. In addition to suppressing irrelevant information, this also reduces confusion since users currently don't know which tasks in the tasklist aren't eligible for kill (such as those attached to cpusets or bound to mempolicies with a disjoint set of mems or nodes, respectively) since that information is not shown. Signed-off-by: David Rientjes Reviewed-by: KOSAKI Motohiro Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fd02db9de73faebc51240619c7c7f99bee9f65c7 Author: Dan Rosenberg Date: Wed Sep 22 13:05:09 2010 -0700 drivers/video/sis/sis_main.c: prevent reading uninitialized stack memory The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Cc: Thomas Winischhofer Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb1dcc0ff4b57873210100fc9d70defa81af43d4 Author: Richard Weinberger Date: Wed Sep 22 13:05:07 2010 -0700 uml: fix compile warning This fixes: incompatible pointer type: => 89 arch/um/kernel/exec.c: warning: passing argument 2 of 'execve1' from incompatible pointer type: => 69, 85 arch/um/kernel/exec.c: warning: passing argument 3 of 'execve1' from incompatible pointer type: => 69, 85 which was introduced by d7627467b7a8d ("Make do_execve() take a const filename pointer") Signed-off-by: Richard Weinberger Cc: David Howells Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1c2499ae87f828eabddf6483b0dfc11da1100c07 Author: KOSAKI Motohiro Date: Wed Sep 22 13:05:06 2010 -0700 /proc/pid/smaps: fix dirty pages accounting Currently, /proc//smaps has wrong dirty pages accounting. Shared_Dirty and Private_Dirty output only pte dirty pages and ignore PG_dirty page flag. It is difference against documentation, but also inconsistent against Referenced field. (Referenced checks both pte and page flags) This patch fixes it. Test program: large-array.c --------------------------------------------------- #include #include #include #include char array[1*1024*1024*1024L]; int main(void) { memset(array, 1, sizeof(array)); pause(); return 0; } --------------------------------------------------- Test case: 1. run ./large-array 2. cat /proc/`pidof large-array`/smaps 3. swapoff -a 4. cat /proc/`pidof large-array`/smaps again Test result: 00601000-40601000 rw-p 00000000 00:00 0 Size: 1048576 kB Rss: 1048576 kB Pss: 1048576 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 218992 kB <-- showed pages as clean incorrectly Private_Dirty: 829584 kB Referenced: 388364 kB Swap: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB 00601000-40601000 rw-p 00000000 00:00 0 Size: 1048576 kB Rss: 1048576 kB Pss: 1048576 kB Shared_Clean: 0 kB Shared_Dirty: 0 kB Private_Clean: 0 kB Private_Dirty: 1048576 kB <-- fixed Referenced: 388480 kB Swap: 0 kB KernelPageSize: 4 kB MMUPageSize: 4 kB Signed-off-by: KOSAKI Motohiro Acked-by: Hugh Dickins Cc: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 142092e577255e33a4ab74c6baad04c9fb887927 Author: Jarek Poplawski Date: Wed Sep 22 13:05:05 2010 -0700 fbcon: fix lockdep warning from fbcon_deinit() Fix the lockdep warning: [ 13.657164] INFO: trying to register non-static key. [ 13.657169] the code is fine but needs lockdep annotation. [ 13.657171] turning off the locking correctness validator. [ 13.657177] Pid: 622, comm: modprobe Not tainted 2.6.36-rc3c #8 [ 13.657180] Call Trace: [ 13.657194] [] ? printk+0x18/0x20 [ 13.657202] [] register_lock_class+0x336/0x350 [ 13.657208] [] __lock_acquire+0x449/0x1180 [ 13.657215] [] lock_acquire+0x67/0x80 [ 13.657222] [] ? __cancel_work_timer+0x51/0x230 [ 13.657227] [] __cancel_work_timer+0x83/0x230 [ 13.657231] [] ? __cancel_work_timer+0x51/0x230 [ 13.657236] [] ? mark_held_locks+0x62/0x80 [ 13.657243] [] ? kfree+0x7f/0xe0 [ 13.657248] [] ? trace_hardirqs_on_caller+0x11c/0x160 [ 13.657253] [] ? trace_hardirqs_on+0xb/0x10 [ 13.657259] [] ? fbcon_deinit+0x16d/0x1e0 [ 13.657263] [] ? fbcon_deinit+0x16d/0x1e0 [ 13.657268] [] cancel_work_sync+0xa/0x10 [ 13.657272] [] fbcon_deinit+0xe4/0x1e0 ... The warning is caused by trying to cancel an uninitialized work from fbcon_exit(). Fix it by adding a check for queue.func, similarly to other places in this code. Signed-off-by: Jarek Poplawski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a5757c2a474a15f87e5baa9a4caacc31cde2bae6 Author: Luke Macken Date: Wed Sep 22 13:05:04 2010 -0700 efifb: support the EFI framebuffer on more Apple hardware Enable the EFI framebuffer on 14 more Macs, including the iMac11,1 iMac10,1 iMac8,1 Macmini3,1 Macmini4,1 MacBook5,1 MacBook6,1 MacBook7,1 MacBookPro2,2 MacBookPro5,2 MacBookPro5,3 MacBookPro6,1 MacBookPro6,2 and MacBookPro7,1 Information gathered from various user submissions. https://bugzilla.redhat.com/show_bug.cgi?id=528232 http://ubuntuforums.org/showthread.php?t=1557326 [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Luke Macken Signed-off-by: Peter Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 85a00d9bbfb4704fbf368944b1cb9fed8f1598c5 Author: Peter Jones Date: Wed Sep 22 13:05:04 2010 -0700 efifb: check that the base address is plausible on pci systems Some Apple machines have identical DMI data but different memory configurations for the video. Given that, check that the address in our table is actually within the range of a PCI BAR on a VGA device in the machine. This also fixes up the return value from set_system(), which has always been wrong, but never resulted in bad behavior since there's only ever been one matching entry in the dmi table. The patch 1) stops people's machines from crashing when we get their display wrong, which seems to be unfortunately inevitable, 2) allows us to support identical dmi data with differing video memory configurations This also adds me as the efifb maintainer, since I've effectively been acting as such for quite some time. Signed-off-by: Peter Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a0c42bac79731276c9b2f28d54f9e658fcf843a2 Author: Jan Kara Date: Wed Sep 22 13:05:03 2010 -0700 aio: do not return ERESTARTSYS as a result of AIO OCFS2 can return ERESTARTSYS from its write function when the process is signalled while waiting for a cluster lock (and the filesystem is mounted with intr mount option). Generally, it seems reasonable to allow filesystems to return this error code from its IO functions. As we must not leak ERESTARTSYS (and similar error codes) to userspace as a result of an AIO operation, we have to properly convert it to EINTR inside AIO code (restarting the syscall isn't really an option because other AIO could have been already submitted by the same io_submit syscall). Signed-off-by: Jan Kara Reviewed-by: Jeff Moyer Cc: Christoph Hellwig Cc: Zach Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1908362ae0b97374eb8328fbb471576332f9fb1 Author: Minchan Kim Date: Wed Sep 22 13:05:01 2010 -0700 vmscan: check all_unreclaimable in direct reclaim path M. Vefa Bicakci reported 2.6.35 kernel hang up when hibernation on his 32bit 3GB mem machine. (https://bugzilla.kernel.org/show_bug.cgi?id=16771). Also he bisected the regression to commit bb21c7ce18eff8e6e7877ca1d06c6db719376e3c Author: KOSAKI Motohiro Date: Fri Jun 4 14:15:05 2010 -0700 vmscan: fix do_try_to_free_pages() return value when priority==0 reclaim failure At first impression, this seemed very strange because the above commit only chenged function return value and hibernate_preallocate_memory() ignore return value of shrink_all_memory(). But it's related. Now, page allocation from hibernation code may enter infinite loop if the system has highmem. The reasons are that vmscan don't care enough OOM case when oom_killer_disabled. The problem sequence is following as. 1. hibernation 2. oom_disable 3. alloc_pages 4. do_try_to_free_pages if (scanning_global_lru(sc) && !all_unreclaimable) return 1; If kswapd is not freozen, it would set zone->all_unreclaimable to 1 and then shrink_zones maybe return true(ie, all_unreclaimable is true). So at last, alloc_pages could go to _nopage_. If it is, it should have no problem. This patch adds all_unreclaimable check to protect in direct reclaim path, too. It can care of hibernation OOM case and help bailout all_unreclaimable case slightly. Signed-off-by: KOSAKI Motohiro Signed-off-by: Minchan Kim Reported-by: M. Vefa Bicakci Reported-by: Reviewed-by: Johannes Weiner Tested-by: Acked-by: Rafael J. Wysocki Acked-by: Rik van Riel Acked-by: KAMEZAWA Hiroyuki Cc: Balbir Singh Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit eba93fcc34d6c4387ce8fbb53bb7b685f91f3343 Author: Axel Lin Date: Wed Sep 22 13:04:59 2010 -0700 drivers/rtc/rtc-ab3100.c: add missing platform_set_drvdata() in ab3100_rtc_probe() Otherwise, calling platform_get_drvdata() in ab3100_rtc_remove() returns NULL. Signed-off-by: Axel Lin Acked-by:Wan ZongShun Acked-by: Linus Walleij Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f5665518c20c01e9045314872878f5788cb3fff2 Author: Hans-Christian Egtvedt Date: Wed Sep 22 13:04:58 2010 -0700 MAINTAINERS: change AVR32 and AT32AP maintainer Alter the maintainer of the AVR32 architecture and the AVR32/AT32AP machine support to me. Haavard is moving on to new challenges, and we've found it better to transfer the maintainer part to me. I will have good contact with Haavard anyway. Signed-off-by: Hans-Christian Egtvedt Acked-by: Haavard Skinnemoen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d544b7a40ad3423676b8876aad64fc5f87296b2d Author: Dmitry Torokhov Date: Wed Sep 22 13:04:57 2010 -0700 vmware balloon: rename module In an effort to minimize customer confusion we want to unify naming convention for VMware-provided kernel modules. This change renames the balloon driver from vmware_ballon to vmw_balloon. We expect to follow this naming convention (vmw_) for all modules that are part of mainline kernel and/or being distributed by VMware, with the sole exception of vmxnet3 driver (since the name of mainline driver happens to match with the name used in VMware Tools). Signed-off-by: Dmitry Torokhov Acked-by: Bhavesh Davda Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 710224fa2750cf449c02dd115548acebfdd2c86a Author: FUJITA Tomonori Date: Wed Sep 22 13:04:55 2010 -0700 arm: fix "arm: fix pci_set_consistent_dma_mask for dmabounce devices" This fixes the regression caused by the commit 6fee48cd330c68 ("dma-mapping: arm: use generic pci_set_dma_mask and pci_set_consistent_dma_mask"). ARM needs to clip the dma coherent mask for dmabounce devices. This restores the old trick. Note that strictly speaking, the DMA API doesn't allow architectures to do such but I'm not sure it's worth adding the new API to set the dma mask that allows architectures to clip it. Reported-by: Krzysztof Halasa Signed-off-by: FUJITA Tomonori Acked-by: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c227e69028473c7c7994a9b0a2cc0034f3f7e0fe Author: Arnd Bergmann Date: Wed Sep 22 13:04:54 2010 -0700 /proc/vmcore: fix seeking Commit 73296bc611 ("procfs: Use generic_file_llseek in /proc/vmcore") broke seeking on /proc/vmcore. This changes it back to use default_llseek in order to restore the original behaviour. The problem with generic_file_llseek is that it only allows seeks up to inode->i_sb->s_maxbytes, which is zero on procfs and some other virtual file systems. We should merge generic_file_llseek and default_llseek some day and clean this up in a proper way, but for 2.6.35/36, reverting vmcore is the safer solution. Signed-off-by: Arnd Bergmann Cc: Frederic Weisbecker Reported-by: CAI Qian Tested-by: CAI Qian Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a9e31765e7d528858e1b0c202b823cf4df7577ca Author: Yinghai Lu Date: Wed Sep 22 13:04:53 2010 -0700 ipmi: fix acpi probe print After d9e1b6c45059ccf ("ipmi: fix ACPI detection with regspacing") we get [ 11.026326] ipmi_si: probing via ACPI [ 11.030019] ipmi_si 00:09: (null) regsize 1 spacing 1 irq 0 [ 11.035594] ipmi_si: Adding ACPI-specified kcs state machine on an old system with only one range for ipmi kcs range. Try to fix it by adding another res pointer. Signed-off-by: Yinghai Lu Signed-off-by: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f19e8aa11afa24036c6273428da51949b5acf30c Author: David Rientjes Date: Wed Sep 22 13:04:52 2010 -0700 oom: always return a badness score of non-zero for eligible tasks A task's badness score is roughly a proportion of its rss and swap compared to the system's capacity. The scale ranges from 0 to 1000 with the highest score chosen for kill. Thus, this scale operates on a resolution of 0.1% of RAM + swap. Admin tasks are also given a 3% bonus, so the badness score of an admin task using 3% of memory, for example, would still be 0. It's possible that an exceptionally large number of tasks will combine to exhaust all resources but never have a single task that uses more than 0.1% of RAM and swap (or 3.0% for admin tasks). This patch ensures that the badness score of any eligible task is never 0 so the machine doesn't unnecessarily panic because it cannot find a task to kill. Signed-off-by: David Rientjes Cc: Dave Hansen Cc: Nitin Gupta Cc: Pekka Enberg Cc: Minchan Kim Cc: KAMEZAWA Hiroyuki Cc: KOSAKI Motohiro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 767b68e96993e29e3480d7ecdd9c4b84667c5762 Author: Dan Rosenberg Date: Wed Sep 22 14:32:56 2010 -0400 Prevent freeing uninitialized pointer in compat_do_readv_writev In 32-bit compatibility mode, the error handling for compat_do_readv_writev() may free an uninitialized pointer, potentially leading to all sorts of ugly memory corruption. This is reliably triggerable by unprivileged users by invoking the readv()/writev() syscalls with an invalid iovec pointer. The below patch fixes this to emulate the non-compat version. Introduced by commit b83733639a49 ("compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev") Signed-off-by: Dan Rosenberg Cc: stable@kernel.org (2.6.35) Cc: Al Viro Signed-off-by: Linus Torvalds commit 3f5a2a713aad28480d86b0add00c68484b54febc Author: Luca Tettamanti Date: Wed Sep 22 10:42:31 2010 +0000 atl1: zero out CMB and SBM in atl1_free_ring_resources They are allocated in atl1_setup_ring_resources, zero out the pointers in atl1_free_ring_resources (like the other resources). Signed-off-by: Luca Tettamanti Acked-by: Chris Snook Signed-off-by: David S. Miller commit ec5a32f67c603b11d68eb283d94eb89a4f6cfce1 Author: Luca Tettamanti Date: Wed Sep 22 10:41:58 2010 +0000 atl1: fix resume adapter->cmb.cmb is initialized when the device is opened and freed when it's closed. Accessing it unconditionally during resume results either in a crash (NULL pointer dereference, when the interface has not been opened yet) or data corruption (when the interface has been used and brought down adapter->cmb.cmb points to a deallocated memory area). Cc: stable@kernel.org Signed-off-by: Luca Tettamanti Acked-by: Chris Snook Signed-off-by: David S. Miller commit 56b49f4b8f6728b91d10c556c116175051b77b60 Author: Ollie Wild Date: Wed Sep 22 05:54:54 2010 +0000 net: Move "struct net" declaration inside the __KERNEL__ macro guard This patch reduces namespace pollution by moving the "struct net" declaration out of the userspace-facing portion of linux/netlink.h. It has no impact on the kernel. (This came up because we have several C++ applications which use "net" as a namespace name.) Signed-off-by: Ollie Wild Signed-off-by: David S. Miller commit cbdd769ab9de26764bde0520a91536caa1587e13 Author: Jiri Olsa Date: Tue Sep 21 21:17:34 2010 +0000 netfilter: nf_conntrack_defrag: check socket type before touching nodefrag flag we need to check proper socket type within ipv4_conntrack_defrag function before referencing the nodefrag flag. For example the tun driver receive path produces skbs with AF_UNSPEC socket type, and so current code is causing unwanted fragmented packets going out. Signed-off-by: Jiri Olsa Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit d6120b8afacec587f5feb37781bc751bc5d68a10 Author: Patrick McHardy Date: Tue Sep 21 21:17:33 2010 +0000 netfilter: nf_nat_snmp: fix checksum calculation (v4) Fix checksum calculation in nf_nat_snmp_basic. Based on patches by Clark Wang and Stephen Hemminger . https://bugzilla.kernel.org/show_bug.cgi?id=17622 Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 15cdeadaa5d76009e20c7792aed69f5a73808f97 Author: Eric Dumazet Date: Tue Sep 21 21:17:32 2010 +0000 netfilter: fix a race in nf_ct_ext_create() As soon as rcu_read_unlock() is called, there is no guarantee current thread can safely derefence t pointer, rcu protected. Fix is to copy t->alloc_size in a temporary variable. Signed-off-by: Eric Dumazet Reviewed-by: Paul E. McKenney Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit b46ffb854554ff939701bdd492b81558da5706fc Author: Changli Gao Date: Tue Sep 21 21:17:31 2010 +0000 netfilter: fix ipt_REJECT TCP RST routing for indev == outdev ip_route_me_harder can't create the route cache when the outdev is the same with the indev for the skbs whichout a valid protocol set. __mkroute_input functions has this check: 1998 if (skb->protocol != htons(ETH_P_IP)) { 1999 /* Not IP (i.e. ARP). Do not create route, if it is 2000 * invalid for proxy arp. DNAT routes are always valid. 2001 * 2002 * Proxy arp feature have been extended to allow, ARP 2003 * replies back to the same interface, to support 2004 * Private VLAN switch technologies. See arp.c. 2005 */ 2006 if (out_dev == in_dev && 2007 IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) { 2008 err = -EINVAL; 2009 goto cleanup; 2010 } 2011 } This patch gives the new skb a valid protocol to bypass this check. In order to make ipt_REJECT work with bridges, you also need to enable ip_forward. This patch also fixes a regression. When we used skb_copy_expand(), we didn't have this issue stated above, as the protocol was properly set. Signed-off-by: Changli Gao Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 7874896a26624214bd7c05eeba7c8ab01548b1b5 Author: Simon Horman Date: Tue Sep 21 21:17:30 2010 +0000 netfilter: nf_ct_sip: default to NF_ACCEPT in sip_help_tcp() I initially noticed this because of the compiler warning below, but it does seem to be a valid concern in the case where ct_sip_get_header() returns 0 in the first iteration of the while loop. net/netfilter/nf_conntrack_sip.c: In function 'sip_help_tcp': net/netfilter/nf_conntrack_sip.c:1379: warning: 'ret' may be used uninitialized in this function Signed-off-by: Simon Horman [Patrick: changed NF_DROP to NF_ACCEPT] Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit d485d500cf6b13a33bc7a6c09091deea7ea603ca Author: Eric Dumazet Date: Tue Sep 21 21:17:29 2010 +0000 netfilter: tproxy: nf_tproxy_assign_sock() can handle tw sockets transparent field of a socket is either inet_twsk(sk)->tw_transparent for timewait sockets, or inet_sk(sk)->transparent for other sockets (TCP/UDP). Signed-off-by: Eric Dumazet Acked-by: David S. Miller Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit c79bd89282136a4516e842fa542d6abf902ddeac Merge: 9a81c16 c278525 Author: Linus Torvalds Date: Wed Sep 22 12:09:46 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: Prevent no-handler signal syscall restart recursion. sparc: Don't mask signal when we can't setup signal frame. sparc64: Fix race in signal instruction flushing. sparc64: Support RAW perf events. commit 0077ca0b5c986477e33451b797b6e7dc92a8bbc0 Author: Mark Brown Date: Wed Sep 22 18:47:40 2010 +0100 ASoC: Fix multi-componentism Spot the build testing. Signed-off-by: Mark Brown commit 9a81c16b527528ad307843be5571111aa8d35a80 Author: Al Viro Date: Mon Sep 20 21:48:57 2010 +0100 powerpc: fix double syscall restarts Make sigreturn zero regs->trap, make do_signal() do the same on all paths. As it is, signal interrupting e.g. read() from fd 512 (== ERESTARTSYS) with another signal getting unblocked when the first handler finishes will lead to restart one insn earlier than it ought to. Same for multiple signals with in-kernel handlers interrupting that sucker at the same time. Same for multiple signals of any kind interrupting that sucker on 64bit... Signed-off-by: Al Viro Acked-by: Paul Mackerras Signed-off-by: Linus Torvalds commit b68e9d4581cbb211be3e174d3445b4917aacbcf6 Merge: 62f1b49 692ebd1 Author: Linus Torvalds Date: Wed Sep 22 09:12:37 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: bdi: Fix warnings in __mark_inode_dirty for /dev/zero and friends char: Mark /dev/zero and /dev/kmem as not capable of writeback bdi: Initialize noop_backing_dev_info properly cfq-iosched: fix a kernel OOPs when usb key is inserted block: fix blk_rq_map_kern bio direction flag cciss: freeing uninitialized data on error path commit 5786aee8bf6d747ea59595601a19e78ad33d6929 Author: Michael S. Tsirkin Date: Wed Sep 22 12:31:53 2010 +0200 vhost: fix log ctx signalling The log eventfd signalling got put in dead code. We didn't notice because qemu currently does polling instead of eventfd select. Signed-off-by: Michael S. Tsirkin commit d47372e852391d0c6553dfbc7c4c56b89b527e13 Author: Dimitris Papastamos Date: Tue Sep 21 15:03:26 2010 +0100 ASoC: Fix soc-cache buffer overflow bug Make sure we stay within the cache boundaries when updating the register cache. Signed-off-by: Dimitris Papastamos Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit 0873a5ae747847ee55a63db409dff3476e45bcd9 Author: Erik J. Staab Date: Wed Sep 22 11:07:41 2010 +0200 ALSA: oxygen: fix analog capture on Claro halo cards On the HT-Omega Claro halo card, the ADC data must be captured from the second I2S input. Using the default first input, which isn't connected to anything, would result in silence. Signed-off-by: Erik J. Staab Signed-off-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai commit 692ebd17c2905313fff3c504c249c6a0faad16ec Author: Jan Kara Date: Tue Sep 21 11:51:01 2010 +0200 bdi: Fix warnings in __mark_inode_dirty for /dev/zero and friends Inodes of devices such as /dev/zero can get dirty for example via utime(2) syscall or due to atime update. Backing device of such inodes (zero_bdi, etc.) is however unable to handle dirty inodes and thus __mark_inode_dirty complains. In fact, inode should be rather dirtied against backing device of the filesystem holding it. This is generally a good rule except for filesystems such as 'bdev' or 'mtd_inodefs'. Inodes in these pseudofilesystems are referenced from ordinary filesystem inodes and carry mapping with real data of the device. Thus for these inodes we have to use inode->i_mapping->backing_dev_info as we did so far. We distinguish these filesystems by checking whether sb->s_bdi points to a non-trivial backing device or not. Example: Assume we have an ext3 filesystem on /dev/sda1 mounted on /. There's a device inode A described by a path "/dev/sdb" on this filesystem. This inode will be dirtied against backing device "8:0" after this patch. bdev filesystem contains block device inode B coupled with our inode A. When someone modifies a page of /dev/sdb, it's B that gets dirtied and the dirtying happens against the backing device "8:16". Thus both inodes get filed to a correct bdi list. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 371d217ee1ff8b418b8f73fb2a34990f951ec2d4 Author: Jan Kara Date: Tue Sep 21 11:49:01 2010 +0200 char: Mark /dev/zero and /dev/kmem as not capable of writeback These devices don't do any writeback but their device inodes still can get dirty so mark bdi appropriately so that bdi code does the right thing and files inodes to lists of bdi carrying the device inodes. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit 976e48f8a5b02fc33f3e5cad87fb3fcea041a49c Author: Jan Kara Date: Tue Sep 21 11:48:55 2010 +0200 bdi: Initialize noop_backing_dev_info properly Properly initialize this backing dev info so that writeback code does not barf when getting to it e.g. via sb->s_bdi. Cc: stable@kernel.org Signed-off-by: Jan Kara Signed-off-by: Jens Axboe commit c27852597829128a9c9d96d79ec454a83c6b0da5 Author: David S. Miller Date: Tue Sep 21 22:30:13 2010 -0700 sparc: Prevent no-handler signal syscall restart recursion. Explicitly clear the "in-syscall" bit when we have no signal handler and back up the program counters to back up the system call. Reported-by: Al Viro Signed-off-by: David S. Miller commit 392c21802ee3aa85cee0e703105f797a8a7b9416 Author: David S. Miller Date: Tue Sep 21 21:41:12 2010 -0700 sparc: Don't mask signal when we can't setup signal frame. Don't invoke the signal handler tracehook in that situation either. Reported-by: Al Viro Signed-off-by: David S. Miller commit 0fbecd400dd0a82d465b3086f209681e8c54cb0f Author: Francisco Jerez Date: Tue Sep 21 02:15:15 2010 +0200 drm/ttm: Clear the ghost cpu_writers flag on ttm_buffer_object_transfer. It makes sense for a BO to move after a process has requested exclusive RW access on it (e.g. because the BO used to be located in unmappable VRAM and we intercepted the CPU access from the fault handler). If we let the ghost object inherit cpu_writers from the original object, ttm_bo_release_list() will raise a kernel BUG when the ghost object is destroyed. This can be reproduced with the nouveau driver on nv5x. Reported-by: Marcin Slusarz Reviewed-by: Jerome Glisse Tested-by: Marcin Slusarz Signed-off-by: Francisco Jerez Signed-off-by: Dave Airlie commit 5222454cf941b09205d502242dd1e44fd62aa551 Author: Dave Airlie Date: Wed Sep 22 12:31:46 2010 +1000 drm/radeon: don't allow device to be opened if powered down If the switcheroo has switched the device off, don't let X open it. Signed-off-by: Dave Airlie commit 62f1b494d82272819570d715eb6633887a9fde20 Merge: 8b15575 5c64eb2 Author: Linus Torvalds Date: Tue Sep 21 18:21:05 2010 -0700 Merge branch 'for-linus/i2c/2636-rc5' of git://git.fluff.org/bjdooks/linux * 'for-linus/i2c/2636-rc5' of git://git.fluff.org/bjdooks/linux: i2c-omap: Make sure i2c bus is free before setting it to idle commit 8b15575cae7a93a784c3005c42b069edd9ba64dd Author: Sage Weil Date: Tue Sep 21 14:35:37 2010 -0700 fs: {lock,unlock}_flocks() stubs to prepare for BKL removal The lock structs are currently protected by the BKL, but are accessed by code in fs/locks.c and misc file system and DLM code. These stubs will allow all users to switch to the new interface before the implementation is changed to a spinlock. Acked-by: Arnd Bergmann Signed-off-by: Sage Weil Signed-off-by: Linus Torvalds commit 5c64eb26ed5c5550fbabd345e573af3fc6a7f775 Author: Mathias Nyman Date: Thu Aug 26 07:36:44 2010 +0000 i2c-omap: Make sure i2c bus is free before setting it to idle If the i2c bus receives an interrupt with both BB (bus busy) and ARDY (register access ready) statuses set during the tranfer of the last message the bus was put to idle while still busy. This caused bus to timeout. Signed-off-by: Mathias Nyman Acked-by: Tony Lindgren Signed-off-by: Ben Dooks commit 3d13008e7345fa7a79d8f6438150dc15d6ba6e9d Author: Eric Dumazet Date: Tue Sep 21 08:47:45 2010 +0000 ip: fix truesize mismatch in ip fragmentation Special care should be taken when slow path is hit in ip_fragment() : When walking through frags, we transfert truesize ownership from skb to frags. Then if we hit a slow_path condition, we must undo this or risk uncharging frags->truesize twice, and in the end, having negative socket sk_wmem_alloc counter, or even freeing socket sooner than expected. Many thanks to Nick Bowler, who provided a very clean bug report and test program. Thanks to Jarek for reviewing my first patch and providing a V2 While Nick bisection pointed to commit 2b85a34e911 (net: No more expensive sock_hold()/sock_put() on each tx), underlying bug is older (2.6.12-rc5) A side effect is to extend work done in commit b2722b1c3a893e (ip_fragment: also adjust skb->truesize for packets not owned by a socket) to ipv6 as well. Reported-and-bisected-by: Nick Bowler Tested-by: Nick Bowler Signed-off-by: Eric Dumazet CC: Jarek Poplawski CC: Patrick McHardy Signed-off-by: David S. Miller commit eecfd57f6429d9d8e10be186566ef99fced55163 Author: Adam Jackson Date: Wed Aug 25 21:17:34 2010 +0100 intel-iommu: Use symbolic values instead of magic numbers in Lenovo w/a Commit 9eecabcb9a924f1e11ba670365fd4babe423045c ("intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space") uses a bunch of magic numbers. Provide #defines for those to make it look slightly saner. Signed-off-by: Adam Jackson Signed-off-by: David Woodhouse commit 9eecabcb9a924f1e11ba670365fd4babe423045c Author: David Woodhouse Date: Tue Sep 21 22:28:23 2010 +0100 intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space Yet another BIOS bug; Lenovo this time (X201). Red Hat bug #593516. Signed-off-by: David Woodhouse commit 1ce1e41c1b61a992077bd1c45c6c3fd6a8b10c02 Merge: 87ac6fa f6c3f16 Author: Linus Torvalds Date: Tue Sep 21 13:22:10 2010 -0700 Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: sched: Fix nohz balance kick sched: Fix user time incorrectly accounted as system time on 32-bit commit 87ac6fa26e0e7ea49e1c8030e962effc05e1c5eb Merge: 19746ca 068e35e Author: Linus Torvalds Date: Tue Sep 21 13:21:42 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: hw breakpoints: Fix pid namespace bug x86: Fix instruction breakpoint encoding oprofile: Add Support for Intel CPU Family 6 / Model 22 (Intel Celeron 540) kprobes: Fix Kconfig dependency commit 7e96dc7045bff8758804b047c0dfb6868f182500 Author: Eric Dumazet Date: Tue Sep 21 13:04:04 2010 -0700 netxen: dont set skb->truesize skb->truesize is set in core network. Dont change it unless dealing with fragments. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 8df8fd27123054b02007361bd5483775db84b4a8 Author: Eric Dumazet Date: Mon Sep 20 02:28:59 2010 +0000 qlcnic: dont set skb->truesize skb->truesize is set in core network. Dont change it unless dealing with fragments. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 2d813760d75150db437e40d340ae0e06ddd54a34 Merge: a4d2580 df6d023 Author: David S. Miller Date: Tue Sep 21 12:26:07 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 19746cad00a00a7a2e3eb0640d317d6e7c2e8cc0 Merge: 0ffe37d be4f104 Author: Linus Torvalds Date: Tue Sep 21 11:20:10 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: select CRYPTO ceph: check mapping to determine if FILE_CACHE cap is used ceph: only send one flushsnap per cap_snap per mds session ceph: fix cap_snap and realm split ceph: stop sending FLUSHSNAPs when we hit a dirty capsnap ceph: correctly set 'follows' in flushsnap messages ceph: fix dn offset during readdir_prepopulate ceph: fix file offset wrapping at 4GB on 32-bit archs ceph: fix reconnect encoding for old servers ceph: fix pagelist kunmap tail ceph: fix null pointer deref on anon root dentry release commit 0ffe37de76a57ba38d960e370c2f8f1d799c94a1 Merge: 4e24db5 db8c076 Author: Linus Torvalds Date: Tue Sep 21 11:00:30 2010 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915: Hold a reference to the object whilst unbinding the eviction list drm/i915,agp/intel: Add second set of PCI-IDs for B43 drm/i915: Fix Sandybridge fence registers drm/i915/crt: Downgrade warnings for hotplug failures drm/i915: Ensure that the crtcinfo is populated during mode_fixup() commit 4e24db5b1a8fe0b0afab875ad2facdfaedce7b07 Merge: b30a3f6 9b6efcd Author: Linus Torvalds Date: Tue Sep 21 11:00:09 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus * git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6-for-linus: lguest: update comments to reflect LHCALL_LOAD_GDT_ENTRY. virtio: console: Prevent userspace from submitting NULL buffers virtio: console: Fix poll blocking even though there is data to read commit 74b3c444a963ba55aef89b33a1bcaada9a4c206f Author: Yinghai Lu Date: Sun Aug 29 18:13:10 2010 -0700 x86, setup: Fix earlyprintk=serial,0x3f8,115200 earlyprintk can take and I/O port, so we need to handle this case in the setup code too, otherwise 0x3f8 will be treated as a baud rate. Signed-off-by: Yinghai Lu LKML-Reference: <4C7B05A6.4010801@kernel.org> Signed-off-by: H. Peter Anvin commit 83d9f65bdae6f6b34d75282c6618d3f50846849a Author: Yinghai Lu Date: Sun Aug 29 18:12:24 2010 -0700 x86, setup: Fix earlyprintk=serial,ttyS0,115200 Torsten reported that there is garbage output, after commit 8fee13a48e4879fba57725f6d9513df4bfa8e9f3 (x86, setup: enable early console output from the decompressor) It turns out we missed the offset for that case. Reported-by: Torsten Kaiser Signed-off-by: Yinghai Lu LKML-Reference: <4C7B0578.8090807@kernel.org> Signed-off-by: H. Peter Anvin commit f6c3f1686e7ec1dd8725a9a3dcb857dfd0c7a5bf Author: Suresh Siddha Date: Mon Sep 13 11:02:21 2010 -0700 sched: Fix nohz balance kick There's a situation where the nohz balancer will try to wake itself: cpu-x is idle which is also ilb_cpu got a scheduler tick during idle and the nohz_kick_needed() in trigger_load_balance() checks for rq_x->nr_running which might not be zero (because of someone waking a task on this rq etc) and this leads to the situation of the cpu-x sending a kick to itself. And this can cause a lockup. Avoid this by not marking ourself eligible for kicking. Signed-off-by: Suresh Siddha Signed-off-by: Peter Zijlstra LKML-Reference: <1284400941.2684.19.camel@sbsiddha-MOBL3.sc.intel.com> Signed-off-by: Ingo Molnar commit 180be2a0420a0d680285e9352c0db85016b9ed2a Author: Vivek Goyal Date: Tue Sep 14 08:47:11 2010 +0200 cfq-iosched: fix a kernel OOPs when usb key is inserted Mike reported a kernel crash when a usb key hotplug is performed while all kernel thrads are not in a root cgroup and are running in one of the child cgroups of blkio controller. BUG: unable to handle kernel NULL pointer dereference at 0000002c IP: [] cfq_get_queue+0x232/0x412 *pde = 00000000 Oops: 0000 [#1] PREEMPT last sysfs file: /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/host3/scsi_host/host3/uevent [..] Pid: 30039, comm: scsi_scan_3 Not tainted 2.6.35.2-fg.roam #1 Volvi2 /Aspire 4315 EIP: 0060:[] EFLAGS: 00010086 CPU: 0 EIP is at cfq_get_queue+0x232/0x412 EAX: f705f9c0 EBX: e977abac ECX: 00000000 EDX: 00000000 ESI: f00da400 EDI: f00da4ec EBP: e977a800 ESP: dff8fd00 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process scsi_scan_3 (pid: 30039, ti=dff8e000 task=f6b6c9a0 task.ti=dff8e000) Stack: 00000000 00000000 00000001 01ff0000 f00da508 00000000 f00da524 f00da540 <0> e7994940 dd631750 f705f9c0 e977a820 e977ac44 f00da4d0 00000001 f6b6c9a0 <0> 00000010 00008010 0000000b 00000000 00000001 e977a800 dd76fac0 00000246 Call Trace: [] ? cfq_set_request+0x228/0x34c [] ? cfq_set_request+0x0/0x34c [] ? elv_set_request+0xf/0x1c [] ? get_request+0x1ad/0x22f [] ? get_request_wait+0x1f/0x11a [] ? kvasprintf+0x33/0x3b [] ? scsi_execute+0x1d/0x103 [] ? scsi_execute_req+0x58/0x83 [] ? scsi_probe_and_add_lun+0x188/0x7c2 [] ? attribute_container_add_device+0x15/0xfa [] ? kobject_get+0xf/0x13 [] ? get_device+0x10/0x14 [] ? scsi_alloc_target+0x217/0x24d [] ? __scsi_scan_target+0x95/0x480 [] ? dequeue_entity+0x14/0x1fe [] ? update_curr+0x165/0x1ab [] ? update_curr+0x165/0x1ab [] ? scsi_scan_channel+0x4a/0x76 [] ? scsi_scan_host_selected+0x77/0xad [] ? do_scan_async+0x0/0x11a [] ? do_scsi_scan_host+0x51/0x56 [] ? do_scan_async+0x0/0x11a [] ? do_scan_async+0xe/0x11a [] ? do_scan_async+0x0/0x11a [] ? kthread+0x5e/0x63 [] ? kthread+0x0/0x63 [] ? kernel_thread_helper+0x6/0x10 Code: 44 24 1c 54 83 44 24 18 54 83 fa 03 75 94 8b 06 c7 86 64 02 00 00 01 00 00 00 83 e0 03 09 f0 89 06 8b 44 24 28 8b 90 58 01 00 00 <8b> 42 2c 85 c0 75 03 8b 42 08 8d 54 24 48 52 8d 4c 24 50 51 68 EIP: [] cfq_get_queue+0x232/0x412 SS:ESP 0068:dff8fd00 CR2: 000000000000002c ---[ end trace 9a88306573f69b12 ]--- The problem here is that we don't have bdi->dev information available when thread does some IO. Hence when dev_name() tries to access bdi->dev, it crashes. This problem does not happen if kernel threads are in root group as root group is statically allocated at device initialization time and we don't hit this piece of code. Fix it by delaying the filling of major and minor number information of device in blk_group. Initially a blk_group is created with 0 as device information and this information is filled later once some more IO comes in from same group. Reported-by: Mike Kazantsev Signed-off-by: Vivek Goyal Signed-off-by: Jens Axboe commit a45dc2d2b8d1afa57c91dcfac224e50ffcd3f805 Author: Benny Halevy Date: Mon Sep 13 21:32:19 2010 +0200 block: fix blk_rq_map_kern bio direction flag This bug was introduced in 7b6d91daee5cac6402186ff224c3af39d79f4a0e "block: unify flags for struct bio and struct request" Cc: Boaz Harrosh Signed-off-by: Benny Halevy Signed-off-by: Jens Axboe commit b0722cb1ac84863f57471d2b254457c100319300 Author: Dan Carpenter Date: Mon Sep 13 14:09:33 2010 +0200 cciss: freeing uninitialized data on error path The "h->scatter_list" is allocated inside a for loop. If any of those allocations fail, then the rest of the list is uninitialized data. When we free it we should start from the top and free backwards so that we don't call kfree() on uninitialized pointers. Also if the allocation for "h->scatter_list" fails then we would get an Oops here. I should have noticed this when I send: 4ee69851c "cciss: handle allocation failure." but I didn't. Sorry about that. Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe commit db8c076b9206ea35b1f7299708d5510b17674db2 Merge: af62610 b30a3f6 Author: Chris Wilson Date: Tue Sep 21 09:14:55 2010 +0100 Merge remote branch 'linus' into drm-intel-fixes commit 0f9f1ee9d1412d45a22bfd69dfd4d4324b506e9e Author: Luke Yelavich Date: Tue Sep 21 17:05:46 2010 +1000 ALSA: hda - Add Dell Latitude E6400 model quirk BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/643891 Set the Dell Latitude E6400 (1028:0233) SSID to use AD1984_DELL_DESKTOP Cc: stable@kernel.org Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai commit 05c5e7698bdc54b3079a3517d86077f49ebcc788 Author: David S. Miller Date: Mon Sep 20 23:24:52 2010 -0700 sparc64: Fix race in signal instruction flushing. If another cpu does a very wide munmap() on the signal frame area, it can tear down the page table hierarchy from underneath us. Borrow an idea from the 64-bit fault path's get_user_insn(), and disable cross call interrupts during the page table traversal to lock them in place while we operate. Reported-by: Al Viro Signed-off-by: David S. Miller commit 46b30ea9bc3698bc1d1e6fd726c9601d46fa0a91 Author: Tejun Heo Date: Tue Sep 21 07:57:19 2010 +0200 percpu: fix pcpu_last_unit_cpu pcpu_first/last_unit_cpu are used to track which cpu has the first and last units assigned. This in turn is used to determine the span of a chunk for man/unmap cache flushes and whether an address belongs to the first chunk or not in per_cpu_ptr_to_phys(). When the number of possible CPUs isn't power of two, a chunk may contain unassigned units towards the end of a chunk. The logic to determine pcpu_last_unit_cpu was incorrect when there was an unused unit at the end of a chunk. It failed to ignore the unused unit and assigned the unused marker NR_CPUS to pcpu_last_unit_cpu. This was discovered through kdump failure which was caused by malfunctioning per_cpu_ptr_to_phys() on a kvm setup with 50 possible CPUs by CAI Qian. Signed-off-by: Tejun Heo Reported-by: CAI Qian Cc: stable@kernel.org commit 9b6efcd2e2275e13403700913b7a1da92cf11ad2 Author: Rusty Russell Date: Tue Sep 21 10:54:01 2010 -0600 lguest: update comments to reflect LHCALL_LOAD_GDT_ENTRY. We used to have a hypercall which reloaded the entire GDT, then we switched to one which loaded a single entry (to match the IDT code). Some comments were not updated, so fix them. Signed-off-by: Rusty Russell Reported by: Eviatar Khen commit 65745422a898741ee0e7068ef06624ab06e8aefa Author: Amit Shah Date: Tue Sep 14 13:26:16 2010 +0530 virtio: console: Prevent userspace from submitting NULL buffers A userspace could submit a buffer with 0 length to be written to the host. Prevent such a situation. This was not needed previously, but recent changes in the way write() works exposed this condition to trigger a virtqueue event to the host, causing a NULL buffer to be sent across. Signed-off-by: Amit Shah Signed-off-by: Rusty Russell CC: stable@kernel.org commit 6df7aadcd9290807c464675098b5dd2dc9da5075 Author: Hans de Goede Date: Thu Sep 16 14:43:08 2010 +0530 virtio: console: Fix poll blocking even though there is data to read I found this while working on a Linux agent for spice, the symptom I was seeing was select blocking on the spice vdagent virtio serial port even though there were messages queued up there. virtio_console's port_fops_poll checks port->inbuf != NULL to determine if read won't block. However if an application reads enough bytes from inbuf through port_fops_read, to empty the current port->inbuf, port->inbuf will be NULL even though there may be buffers left in the virtqueue. This causes poll() to block even though there is data to be read, this patch fixes this by using will_read_block(port) instead of the port->inbuf != NULL check. Signed-off-By: Hans de Goede Signed-off-by: Amit Shah Signed-off-by: Rusty Russell Cc: stable@kernel.org commit a4d258036ed9b2a1811c3670c6099203a0f284a0 Author: Tom Marshall Date: Mon Sep 20 15:42:05 2010 -0700 tcp: Fix race in tcp_poll If a RST comes in immediately after checking sk->sk_err, tcp_poll will return POLLIN but not POLLOUT. Fix this by checking sk->sk_err at the end of tcp_poll. Additionally, ensure the correct order of operations on SMP machines with memory barriers. Signed-off-by: Tom Marshall Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 9828e6e6e3f19efcb476c567b9999891d051f52f Author: David S. Miller Date: Mon Sep 20 15:40:35 2010 -0700 rose: Fix signedness issues wrt. digi count. Just use explicit casts, since we really can't change the types of structures exported to userspace which have been around for 15 years or so. Reported-by: Dan Rosenberg Signed-off-by: David S. Miller commit af6261031317f646d22f994c0b467521e47aa49f Author: Chris Wilson Date: Mon Sep 20 10:31:40 2010 +0100 drm/i915: Hold a reference to the object whilst unbinding the eviction list During heavy aperture thrashing we may be forced to wait upon several active objects during eviction. The active list may be the last reference to these objects and so the action of waiting upon one of them may cause another to be freed (and itself unbound). To prevent the object disappearing underneath us, we need to acquire and hold a reference whilst unbinding. This should fix the reported page refcount OOPS: kernel BUG at drivers/gpu/drm/i915/i915_gem.c:1444! ... RIP: 0010:[] [] i915_gem_object_put_pages+0x25/0xf5 [i915] Call Trace: [] i915_gem_object_unbind+0xc5/0x1a7 [i915] [] i915_gem_evict_something+0x3bd/0x409 [i915] [] ? drm_gem_object_lookup+0x27/0x57 [drm] [] i915_gem_object_bind_to_gtt+0x1d3/0x279 [i915] [] i915_gem_object_pin+0xa3/0x146 [i915] [] ? drm_gem_object_lookup+0x4c/0x57 [drm] [] i915_gem_do_execbuffer+0x50d/0xe32 [i915] Reported-by: Shawn Starr Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18902 Signed-off-by: Chris Wilson commit 3779298b81cd9a2531cec93e3beefc1acdb01382 Merge: 8444cf7 ee05d69 Author: David S. Miller Date: Mon Sep 20 11:13:34 2010 -0700 Merge branch 'vhost-net' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost commit 8444cf712c5f71845cba9dc30d8f530ff0d5ff83 Author: Thomas Egerer Date: Mon Sep 20 11:11:38 2010 -0700 xfrm: Allow different selector family in temporary state The family parameter xfrm_state_find is used to find a state matching a certain policy. This value is set to the template's family (encap_family) right before xfrm_state_find is called. The family parameter is however also used to construct a temporary state in xfrm_state_find itself which is wrong for inter-family scenarios because it produces a selector for the wrong family. Since this selector is included in the xfrm_user_acquire structure, user space programs misinterpret IPv6 addresses as IPv4 and vice versa. This patch splits up the original init_tempsel function into a part that initializes the selector respectively the props and id of the temporary state, to allow for differing ip address families whithin the state. Signed-off-by: Thomas Egerer Signed-off-by: Steffen Klassert Signed-off-by: David S. Miller commit df6d02300f7c2fbd0fbe626d819c8e5237d72c62 Author: Johannes Berg Date: Fri Sep 17 00:38:25 2010 +0200 wext: fix potential private ioctl memory content leak When a driver doesn't fill the entire buffer, old heap contents may remain, and if it also doesn't update the length properly, this old heap content will be copied back to userspace. It is very unlikely that this happens in any of the drivers using private ioctls since it would show up as junk being reported by iwpriv, but it seems better to be safe here, so use kzalloc. Reported-by: Jeff Mahoney Cc: stable@kernel.org Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 842c74bffcdb1d305ccd9e61e417cceae86b9963 Author: Eric Dumazet Date: Mon Sep 20 10:06:12 2010 -0700 ip_gre: CONFIG_IPV6_MODULE support ipv6 can be a module, we should test CONFIG_IPV6 and CONFIG_IPV6_MODULE to enable ipv6 bits in ip_gre. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit f539dfedbd169e5ed47912bb517c75976ab556f3 Author: Simon Guinot Date: Sun Sep 19 15:30:59 2010 +0200 leds: leds-ns2: fix locking This patch replace all the lock functions with the irq safe variant. The ns2_led_{set,get}_mode() functions must be safe in all context. For example, the trigger timer call led_set_brightness() in a softirq context. Signed-off-by: Simon Guinot Signed-off-by: Nicolas Pitre commit c4a90588fa07ea47df7a67fd6cb03d6bc0f99634 Author: Eric Miao Date: Tue Sep 14 16:14:15 2010 +0800 ARM: dove: fix __io() definition to use bus based offset Signed-off-by: Eric Miao Acked-by: Saeed Bishara Signed-off-by: Nicolas Pitre commit 863636828f1fcd9fdc15e24d620aa53cf18b432f Author: Simon Guinot Date: Fri Sep 17 23:33:51 2010 +0200 dmaengine: fix interrupt clearing for mv_xor When using simultaneously the two DMA channels on a same engine, some transfers are never completed. For example, an endless lock can occur while writing heavily on a RAID5 array (with async-tx offload support enabled). Note that this issue can also be reproduced by using the DMA test client. On a same engine, the interrupt cause register is shared between two DMA channels. This patch make sure that the cause bit is only cleared for the requested channel. Signed-off-by: Simon Guinot Tested-by: Luc Saillard Acked-by: Saeed Bishara Signed-off-by: Nicolas Pitre commit e4ff1c39ee1122198e8355069da59297038e55bb Author: Arnaud Patard Date: Sun Aug 22 22:49:46 2010 +0200 ARM: kirkwood: Unbreak PCIe I/O port The support for the 2 pcie port of the 6282 has broken i/o port by switching *_IO_PHYS_BASE and *_IO_BUS_BASE. In fact, the patches reintroduced the same bug solved by commit 35f029e2514be209eb0e88c7d927f3bcc42a5cc2. So, I'm adding back *_IO_BUS_BASE in resource declaration and fix definition of KIRKWOOD_PCIE1_IO_BUS_BASE. With this change, the xgi card on my t5325 is working again. Signed-off-by: Arnaud Patard Acked-by: Saeed Bishara Signed-off-by: Nicolas Pitre Cc: stable@kernel.org commit d93c333dc867d04111c9dcebdbcaa9ae8b2d5c2d Author: Russell King Date: Sun Sep 19 16:16:58 2010 +0100 ARM: Fix build error when using KCONFIG_CONFIG Jonathan Cameron reports that when using the environment variable KCONFIG_CONFIG, he encounters this error: make[2]: *** No rule to make target `.config', needed by `arch/arm/boot/compressed/vmlinux.lds' Reported-by: Jonathan Cameron Signed-off-by: Russell King commit cbfa5184cc5f58627f08c7fad225424f565b439d Author: Guennadi Liakhovetski Date: Fri Sep 17 12:30:11 2010 +0200 ASoC: fix clkdev API usage in sh/migor.c The clkdev API doesn't use .name and .id members of struct clk for clock lookup. Instead clocks should be added to a lookup list. Without this patch audio om the Migo-R board fails silently. Signed-off-by: Guennadi Liakhovetski Acked-by: Liam Girdwood Signed-off-by: Mark Brown commit d907387c42e9e39261629890e45a08ef4c3ed3fe Author: Catalin Marinas Date: Mon Sep 13 16:01:24 2010 +0100 ARM: 6383/1: Implement phys_mem_access_prot() to avoid attributes aliasing ARMv7 onwards requires that there are no aliases to the same physical location using different memory types (i.e. Normal vs Strongly Ordered). Access to SO mappings when the unaligned accesses are handled in hardware is also Unpredictable (pgprot_noncached() mappings in user space). The /dev/mem driver requires uncached mappings with O_SYNC. The patch implements the phys_mem_access_prot() function which generates Strongly Ordered memory attributes if !pfn_valid() (independent of O_SYNC) and Normal Noncacheable (writecombine) if O_SYNC. Signed-off-by: Catalin Marinas Signed-off-by: Russell King commit 79e27dc0677b969e2d53b76fa0fa58467cce946a Author: Peter Korsgaard Date: Sat Sep 18 19:55:10 2010 +0100 ARM: 6400/1: at91: fix arch_gettimeoffset fallout 5cfc8ee0bb51 (ARM: convert arm to arch_gettimeoffset()) marked all of at91 AND at91x40 as needing ARCH_USES_GETTIMEOFFSET, and hence no high res timer support / accurate clock_gettime() - But only at91x40 needs it. Cc: stable@kernel.org Signed-off-by: Peter Korsgaard Acked-by: John Stultz Acked-by: Jean-Christophe PLAGNIOL-VILLARD Signed-off-by: Russell King commit 50aff040363d31f87e94f38f1710973d99489951 Author: Wu Fengguang Date: Sat Aug 21 14:40:20 2010 +0800 ocfs2/net: fix uninitialized ret in o2net_send_message_vec() mmotm/fs/ocfs2/cluster/tcp.c: In function ‘o2net_send_message_vec’: mmotm/fs/ocfs2/cluster/tcp.c:980:6: warning: ‘ret’ may be used uninitialized in this function It seems a real bug introduced by commit 9af0b38ff3 (ocfs2/net: Use wait_event() in o2net_send_message_vec()). cc: Sunil Mushran Signed-off-by: Wu Fengguang Signed-off-by: Joel Becker commit 7cdffc86528ec9c55c83c649b6d64cadeb558136 Author: Dominik Brodowski Date: Sat Sep 18 10:19:13 2010 +0200 pcmcia: preserve configuration information if request_io fails partly If pcmcia_request_io() only fails partly -- for the second of two requested resources -- preserve the configuration settings for the first one. Signed-off-by: Dominik Brodowski commit 04746ff1289f75af26af279eb4b0b3e231677ee4 Author: Eric Dumazet Date: Fri Sep 17 22:58:08 2010 -0700 qlcnic: dont assume NET_IP_ALIGN is 2 qlcnic driver allocates rx skbs and gives to hardware too bytes of extra storage, allowing for corruption of kernel data. NET_IP_ALIGN being 0 on some platforms (including x86), drivers should not assume it's 2. rds_ring->skb_size = rds_ring->dma_size + NET_IP_ALIGN; ... skb = dev_alloc_skb(rds_ring->skb_size); skb_reserve(skb, 2); pci_map_single(pdev, skb->data, rds_ring->dma_size, PCI_DMA_FROMDEVICE); (and rds_ring->skb_size == rds_ring->dma_size) -> bug Because of extra alignment (1500 + 32) -> four extra bytes are available before the struct skb_shared_info, so corruption is not noticed. Note: this driver could use netdev_alloc_skb_ip_align() Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 7acc7c683a747689aaaaad4fce1683fc3f85e552 Author: Wey-Yi Guy Date: Wed Sep 8 08:30:20 2010 -0700 iwlwifi: do not perferm force reset while doing scan When uCode error condition detected, driver try to perform either rf reset or firmware reload in order bring device back to working condition. If rf reset is required and scan is in process, there is no need to issue rf reset since scan already reset the rf. If firmware reload is required and scan is in process, skip the reload request. There is a possibility firmware reload during scan cause problem. [ 485.804046] WARNING: at net/mac80211/main.c:310 ieee80211_restart_hw+0x28/0x62() [ 485.804049] Hardware name: Latitude E6400 [ 485.804052] ieee80211_restart_hw called with hardware scan in progress [ 485.804054] Modules linked in: iwlagn iwlcore bnep sco rfcomm l2cap crc16 bluetooth [last unloaded: iwlcore] [ 485.804069] Pid: 812, comm: kworker/u:3 Tainted: G W 2.6.36-rc3-wl+ #74 [ 485.804072] Call Trace: [ 485.804079] [] warn_slowpath_common+0x60/0x75 [ 485.804084] [] warn_slowpath_fmt+0x26/0x2a [ 485.804089] [] ieee80211_restart_hw+0x28/0x62 [ 485.804102] [] iwl_bg_restart+0x113/0x150 [iwlagn] [ 485.804108] [] process_one_work+0x181/0x25c [ 485.804119] [] ? iwl_bg_restart+0x0/0x150 [iwlagn] [ 485.804124] [] worker_thread+0xf9/0x1f2 [ 485.804128] [] ? worker_thread+0x0/0x1f2 [ 485.804133] [] kthread+0x64/0x69 [ 485.804137] [] ? kthread+0x0/0x69 [ 485.804141] [] kernel_thread_helper+0x6/0x10 [ 485.804145] ---[ end trace 3d4ebdc02d524bbb ]--- [ 485.804148] WG> 1 [ 485.804153] Pid: 812, comm: kworker/u:3 Tainted: G W 2.6.36-rc3-wl+ #74 [ 485.804156] Call Trace: [ 485.804161] [] ? ieee80211_restart_hw+0x5c/0x62 [ 485.804172] [] iwl_bg_restart+0x118/0x150 [iwlagn] [ 485.804177] [] process_one_work+0x181/0x25c [ 485.804188] [] ? iwl_bg_restart+0x0/0x150 [iwlagn] [ 485.804192] [] worker_thread+0xf9/0x1f2 [ 485.804197] [] ? worker_thread+0x0/0x1f2 [ 485.804201] [] kthread+0x64/0x69 [ 485.804205] [] ? kthread+0x0/0x69 [ 485.804209] [] kernel_thread_helper+0x6/0x10 Signed-off-by: Wey-Yi Guy commit be4f104dfd3b5e3ae262bff607965cfc38027dec Author: Sage Weil Date: Fri Sep 17 12:30:31 2010 -0700 ceph: select CRYPTO We select CRYPTO_AES, but not CRYPTO. Signed-off-by: Sage Weil commit a43fb73101eaf6db0b33d22c152b338ab8b3edbb Author: Sage Weil Date: Fri Sep 17 09:54:08 2010 -0700 ceph: check mapping to determine if FILE_CACHE cap is used See if the i_data mapping has any pages to determine if the FILE_CACHE capability is currently in use, instead of assuming it is any time the rdcache_gen value is set (i.e., issued -> used). This allows the MDS RECALL_STATE process work for inodes that have cached pages. Signed-off-by: Sage Weil commit 14eff1812679c76564b775aa95cdd378965f6cfb Author: Daniel Walker Date: Fri Sep 17 16:42:10 2010 +0100 ARM: 6398/1: add proc info for ARM11MPCore/Cortex-A9 from ARM Setting of these bits can cause issues on other SMP SoC's not produced by ARM. Acked-by: Catalin Marinas Signed-off-by: Daniel Walker Signed-off-by: Russell King commit e835124c2be289515b918f2688ced4249e2de566 Author: Sage Weil Date: Fri Sep 17 08:03:08 2010 -0700 ceph: only send one flushsnap per cap_snap per mds session Sending multiple flushsnap messages is problematic because we ignore the response if the tid doesn't match, and the server may only respond to each one once. It's also a waste. So, skip cap_snaps that are already on the flushing list, unless the caller tells us to resend (because we are reconnecting). Signed-off-by: Sage Weil commit b2b163bb82b12bae2504a5b31399c37d099ad3cc Author: Russell King Date: Fri Sep 17 14:56:16 2010 +0100 ARM: prevent multiple syscall restarts Al Viro reports that calling "sys_sigsuspend(-ERESTARTNOHAND, 0, 0)" with two signals coming and being handled in kernel space results in the syscall restart being done twice. Avoid this by clearing the 'why' flag when we call the signal handling code to prevent further syscall restarts after the first. Acked-by: Al Viro Signed-off-by: Russell King commit 1a8e41cd672f894bbd74874eac601e6cedf838fb Author: Catalin Marinas Date: Thu Sep 16 17:57:17 2010 +0100 ARM: 6395/1: VExpress: Set bit 22 in the PL310 (cache controller) AuxCtlr register Clearing bit 22 in the PL310 Auxiliary Control register (shared attribute override enable) has the side effect of transforming Normal Shared Non-cacheable reads into Cacheable no-allocate reads. Coherent DMA buffers in Linux always have a Cacheable alias via the kernel linear mapping and the processor can speculatively load cache lines into the PL310 controller. With bit 22 cleared, Non-cacheable reads would unexpectedly hit such cache lines leading to buffer corruption. Cc: Nicolas Pitre Cc: Signed-off-by: Catalin Marinas Signed-off-by: Russell King commit a672e99b129e286df2e2697a1b603d82321117f3 Author: Will Deacon Date: Tue Sep 14 09:53:02 2010 +0100 ARM: 6389/1: errata: incorrect hazard handling in the SCU may lead to data corruption On the r2p0, r2p1 and r2p2 versions of the Cortex-A9, data corruption can occur if a shared cache line is replaced on one CPU as another CPU is accessing it. This workaround sets two bits in the diagnostic register of the Cortex-A9, reducing the linefill issuing capabilities of the processor and avoiding the erroneous behaviour. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit 9f05027c7cb3cfe56a31892bd83391138d41a667 Author: Will Deacon Date: Tue Sep 14 09:51:43 2010 +0100 ARM: 6388/1: errata: DMB operation may be faulty On versions of the Cortex-A9 up to and including r2p2, under rare circumstances, a DMB instruction between 2 write operations may not ensure the correct visibility ordering of the 2 writes. This workaround sets a bit in the diagnostic register of the Cortex-A9, causing the DMB instruction to behave like a DSB, which functions correctly on the affected cores. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit 6491848d1ab246f6d243ddef25085fc1d836ff2c Author: Will Deacon Date: Tue Sep 14 09:50:03 2010 +0100 ARM: 6387/1: errata: check primary part ID in proc-v7.S Kconfig doesn't have any knowledge of specific v7 cores, so it is possible to select errata workarounds that may cause inadvertent behaviour when executed on a core other than those targetted by the fix. This patch improves the variant and revision checking in proc-v7.S so that the primary part number is also considered when applying errata workarounds. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit 63f469324f999a28e67b90eb27a5fe0e379b7064 Author: Linus Walleij Date: Mon Sep 13 13:44:47 2010 +0100 ARM: 6377/1: supply _cansleep gpio function to U300 We have to use _cansleep gpio accessors in the MMCI driver so as to avoid slowpath warnings, now U300 has MMCI but doesn't have these functions in place to siply wrap the existing non-sleeping functions into sleepable variants. Signed-off-by: Linus Walleij Signed-off-by: Russell King commit a0719f52d90aed5b82ecf2f3ed14bc4ced3d1a8a Author: Linus Walleij Date: Mon Sep 13 13:40:04 2010 +0100 ARM: 6376/1: plat-nomadik: MTU: Change prescaler limit and comment updates The prescaler 16 is now used only when the timer runs at 32 MHz or more. Some comment updates as well. Acked-by: Alessandro Rubini Signed-off-by: Jonas Aaberg Signed-off-by: Linus Walleij Signed-off-by: Russell King commit 99f76891a33d130776da3b01935d978b1e75fe68 Author: Linus Walleij Date: Mon Sep 13 13:38:55 2010 +0100 ARM: 6375/1: plat-nomadik: MTU timer trivial bug fix timer0 to 3 are all on mtu block 0, so don't calculate the clock event rate based upon mtu block 1's clock speed. Acked-by: Alessandro Rubini Signed-off-by: Jonas Aaberg Signed-off-by: Linus Walleij Signed-off-by: Russell King commit 41a51428916ab04587bacee2dda61c4a0c4fc02f Author: Chris Wilson Date: Fri Sep 17 08:22:30 2010 +0100 drm/i915,agp/intel: Add second set of PCI-IDs for B43 There is a second revision of B43 (a desktop gen4 part) floating around, functionally equivalent to the original B43, so simply add the new PCI-IDs. Bugzilla: https://bugs.freedesktop.org/show_bugs.cgi?id=30221 Signed-off-by: Chris Wilson Cc: stable@kernel.org commit e259befd9013e212648c3bd4f6f1fbf92d0dd51d Author: Chris Wilson Date: Fri Sep 17 00:32:02 2010 +0100 drm/i915: Fix Sandybridge fence registers With 5 places to update when adding handling for fence registers, it is easy to overlook one or two. Correct that oversight, but fence management should be improved before a new set of registers is added. Bugzilla: https://bugs.freedesktop.org/show_bug?id=30199 Original patch by: Yuanhan Liu Signed-off-by: Chris Wilson Cc: stable@kernel.org commit 79077319d7c7844d5d836e52099a7a1bcadf9b04 Author: Chris Wilson Date: Sun Sep 12 19:58:04 2010 +0100 drm/i915/crt: Downgrade warnings for hotplug failures These are not fatal errors, so do not alarm the user by filling the logs with *** ERROR ***. Especially as we know that g4x CRT detection is a little sticky. On the one hand the errors are valid since they are warning us of a stall -- we poll the register whilst holding the mode lock so not even the mouse will update. On the other hand, those stalls were already present yet nobody complained. Reported-by: Andi Kleen Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=18332 Signed-off-by: Chris Wilson commit 068e35eee9ef98eb4cab55181977e24995d273be Author: Matt Helsley Date: Mon Sep 13 13:01:18 2010 -0700 hw breakpoints: Fix pid namespace bug Hardware breakpoints can't be registered within pid namespaces because tsk->pid is passed rather than the pid in the current namespace. (See https://bugzilla.kernel.org/show_bug.cgi?id=17281 ) This is a quick fix demonstrating the problem but is not the best method of solving the problem since passing pids internally is not the best way to avoid pid namespace bugs. Subsequent patches will show a better solution. Much thanks to Frederic Weisbecker for doing the bulk of the work finding this bug. Reported-by: Robin Green Signed-off-by: Matt Helsley Signed-off-by: Peter Zijlstra Cc: Prasad Cc: Arnaldo Carvalho de Melo Cc: Steven Rostedt Cc: Will Deacon Cc: Mahesh Salgaonkar Cc: 2.6.33-2.6.35 LKML-Reference: Signed-off-by: Ingo Molnar Signed-off-by: Frederic Weisbecker commit 89e45aac42d40426c97e6901811309bf49c4993f Author: Frederic Weisbecker Date: Fri Sep 17 03:24:13 2010 +0200 x86: Fix instruction breakpoint encoding Lengths and types of breakpoints are encoded in a half byte into CPU registers. However when we extract these values and store them, we add a high half byte part to them: 0x40 to the length and 0x80 to the type. When that gets reloaded to the CPU registers, the high part is masked. While making the instruction breakpoints available for perf, I zapped that high part on instruction breakpoint encoding and that broke the arch -> generic translation used by ptrace instruction breakpoints. Writing dr7 to set an inst breakpoint was then failing. There is no apparent reason for these high parts so we could get rid of them altogether. That's an invasive change though so let's do that later and for now fix the problem by restoring that inst breakpoint high part encoding in this sole patch. Reported-by: Kelvie Wong Signed-off-by: Frederic Weisbecker Cc: Prasad Cc: Mahesh Salgaonkar Cc: Will Deacon commit ae00d4f37f4df56821331deb1028748110dd6dc9 Author: Sage Weil Date: Thu Sep 16 16:26:51 2010 -0700 ceph: fix cap_snap and realm split The cap_snap creation/queueing relies on both the current i_head_snapc _and_ the i_snap_realm pointers being correct, so that the new cap_snap can properly reference the old context and the new i_head_snapc can be updated to reference the new snaprealm's context. To fix this, we: - move inodes completely to the new (split) realm so that i_snap_realm is correct, and - generate the new snapc's _before_ queueing the cap_snaps in ceph_update_snap_trace(). Signed-off-by: Sage Weil commit 0d2b54904d8db26663117ab82697cae5cdf56f72 Merge: 05ed160 c33f543 Author: Ingo Molnar Date: Thu Sep 16 16:36:19 2010 +0200 Merge branch 'urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile into perf/urgent commit c33f543d320843e1732534c3931da4bbd18e6c14 Author: Patrick Simmons Date: Wed Sep 8 10:34:28 2010 -0400 oprofile: Add Support for Intel CPU Family 6 / Model 22 (Intel Celeron 540) This patch adds CPU type detection for the Intel Celeron 540, which is part of the Core 2 family according to Wikipedia; the family and ID pair is absent from the Volume 3B table referenced in the source code comments. I have tested this patch on an Intel Celeron 540 machine reporting itself as Family 6 Model 22, and OProfile runs on the machine without issue. Spec: http://download.intel.com/design/mobile/SPECUPDT/317667.pdf Signed-off-by: Patrick Simmons Acked-by: Andi Kleen Acked-by: Arnd Bergmann Cc: stable@kernel.org Signed-off-by: Robert Richter commit e75e863dd5c7d96b91ebbd241da5328fc38a78cc Author: Stanislaw Gruszka Date: Tue Sep 14 16:35:14 2010 +0200 sched: Fix user time incorrectly accounted as system time on 32-bit We have 32-bit variable overflow possibility when multiply in task_times() and thread_group_times() functions. When the overflow happens then the scaled utime value becomes erroneously small and the scaled stime becomes i erroneously big. Reported here: https://bugzilla.redhat.com/show_bug.cgi?id=633037 https://bugzilla.kernel.org/show_bug.cgi?id=16559 Reported-by: Michael Chapman Reported-by: Ciriaco Garcia de Celis Signed-off-by: Stanislaw Gruszka Signed-off-by: Peter Zijlstra Cc: Hidetoshi Seto Cc: # 2.6.32.19+ (partially) and 2.6.33+ LKML-Reference: <20100914143513.GB8415@redhat.com> Signed-off-by: Ingo Molnar commit cfc0bf6640dfd0f43bf8bfec5a475284809baa4d Author: Sage Weil Date: Tue Sep 14 15:50:59 2010 -0700 ceph: stop sending FLUSHSNAPs when we hit a dirty capsnap Stop sending FLUSHSNAP messages when we hit a capsnap that has dirty_pages or is still writing. We'll send the newer capsnaps only after the older ones complete. Signed-off-by: Sage Weil commit 8bef9239ee1a42eb37d3f83bacf6a75f019c028d Author: Sage Weil Date: Tue Sep 14 15:45:44 2010 -0700 ceph: correctly set 'follows' in flushsnap messages The 'follows' should match the seq for the snap context for the given snap cap, which is the context under which we have been dirtying and writing data and metadata. The snapshot that _contains_ those updates thus _follows_ that context's seq #. Signed-off-by: Sage Weil commit ee05d6939ed17b55e9c2466af32c208e0d547eb8 Author: Michael S. Tsirkin Date: Tue Sep 14 15:15:52 2010 +0200 vhost-net: fix range checking in mrg bufs case In mergeable buffer case, we use headcount, log_num and seg as indexes in same-size arrays, and we know that headcount <= seg and log_num equals either 0 or seg. Therefore, the right thing to do is range-check seg, not headcount as we do now: these will be different if guest chains s/g descriptors (this does not happen now, but we can not trust the guest). Long term, we should add BUG_ON checks to verify two other indexes are what we think they should be. Reported-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 05ed160e89baf7f5fb3432d527fec467d2493626 Author: Masami Hiramatsu Date: Mon Sep 13 19:25:41 2010 +0900 kprobes: Fix Kconfig dependency Fix Kconfig dependency among Kprobes, optprobe and kallsyms. Kprobes uses kallsyms_lookup for finding target function and checking instruction boundary, thus CONFIG_KPROBES should select CONFIG_KALLSYMS. Optprobe is an optional feature which is supported on x86 arch, and it also uses kallsyms_lookup for checking instructions in the target function. Since KALLSYMS_ALL just adds symbols of kernel variables, it doesn't need to select KALLSYMS_ALL. Signed-off-by: Masami Hiramatsu Acked-by: Randy Dunlap , Cc: Ananth N Mavinakayanahalli Cc: Felipe Contreras Cc: Randy Dunlap Cc: Ananth N Mavinakayanahalli Cc: Anil S Keshavamurthy Cc: David S. Miller Cc: akpm LKML-Reference: <20100913102541.20260.85700.stgit@ltc236.sdl.hitachi.co.jp> Signed-off-by: Ingo Molnar commit 467c525109d5d542d7d416b0c11bdd54610fe2f4 Author: Sage Weil Date: Mon Sep 13 11:39:20 2010 -0700 ceph: fix dn offset during readdir_prepopulate When adding the readdir results to the cache, ceph_set_dentry_offset was clobbered our just-set offset. This can cause the readdir result offsets to get out of sync with the server. Add an argument to the helper so that it does not. This bug was introduced by 1cd3935bedccf592d44343890251452a6dd74fc4. Signed-off-by: Sage Weil commit b343ae51c116dffaef07a8596661774c12212b66 Author: David S. Miller Date: Sun Sep 12 17:20:24 2010 -0700 sparc64: Support RAW perf events. Encoding is "(encoding << 16) | pic_mask" Signed-off-by: David S. Miller commit 9277bf4b4f94655eef177d0daffa90a47c51eb62 Merge: 8974935 49553c2 Author: Chris Wilson Date: Mon Sep 13 01:02:18 2010 +0100 Merge remote branch 'linus' into drm-intel-fixes commit 897493504addc5609f04a2c4f73c37ab972c29b2 Author: Chris Wilson Date: Sun Sep 12 18:25:19 2010 +0100 drm/i915: Ensure that the crtcinfo is populated during mode_fixup() This should fix the mysterious mode setting failures reported during boot up and after resume, generally for i8xx class machines. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=16478 Reported-and-tested-by: Xavier Chantry Buzilla: https://bugs.freedesktop.org/show_bug.cgi?id=29413 Tested-by: Daniel Vetter Signed-off-by: Chris Wilson Cc: stable@kernel.org commit a77d9f7dce7600058d56f0670ed29d77abffcde2 Author: Sage Weil Date: Sat Sep 11 10:55:25 2010 -0700 ceph: fix file offset wrapping at 4GB on 32-bit archs Cast the value before shifting so that we don't run out of bits with a 32-bit unsigned long. This fixes wrapping of high file offsets into the low 4GB of a file on disk, and the subsequent data corruption for large files. Signed-off-by: Sage Weil commit 3612abbd5df6baa9ca3e0777c6c8646e202d3f66 Author: Sage Weil Date: Tue Sep 7 15:59:27 2010 -0700 ceph: fix reconnect encoding for old servers Fix the reconnect encoding to encode the cap record when the MDS does not have the FLOCK capability (i.e., pre v0.22). Signed-off-by: Sage Weil commit 3d4401d9d0aef5c40706350685ddea3df6708496 Author: Yehuda Sadeh Date: Fri Sep 3 12:57:11 2010 -0700 ceph: fix pagelist kunmap tail A wrong parameter was passed to the kunmap. Signed-off-by: Yehuda Sadeh Signed-off-by: Sage Weil commit ca04d9c3ec721e474f00992efc1b1afb625507f5 Author: Sage Weil Date: Thu Aug 26 16:12:01 2010 -0700 ceph: fix null pointer deref on anon root dentry release When we release a root dentry, particularly after a splice, the parent (actually our) inode was evaluating to NULL and was getting dereferenced by ceph_snap(). This is reproduced by something as simple as mount -t ceph monhost:/a/b mnt mount -t ceph monhost:/a mnt2 ls mnt2 A splice_dentry() would kill the old 'b' inode's root dentry, and we'd crash while releasing it. Fix by checking for both the ROOT and NULL cases explicitly. We only need to invalidate the parent dir when we have a correct parent to invalidate. Signed-off-by: Sage Weil commit 228ac6357718df2d5c8d70210fa51b2225aab5ee Author: Tristan Ye Date: Fri Sep 10 10:16:33 2010 +0800 Ocfs2: Handle empty list in lockres_seq_start() for dlmdebug.c This patch tries to handle the case in which list 'dlm->tracking_list' is empty, to avoid accessing an invalid pointer. It fixes the following oops: http://oss.oracle.com/bugzilla/show_bug.cgi?id=1287 Signed-off-by: Tristan Ye Signed-off-by: Joel Becker commit 0f4da216b8c3c35c90ecd18e1899c6f125957c2b Author: Tristan Ye Date: Wed Sep 8 17:12:38 2010 +0800 Ocfs2: Re-access the journal after ocfs2_insert_extent() in dxdir codes. In ocfs2_dx_dir_rebalance(), we need to rejournal_acess the blocks after calling ocfs2_insert_extent() since growing an extent tree may trigger ocfs2_extend_trans(), which makes previous journal_access meaningless. Signed-off-by: Tristan Ye Signed-off-by: Joel Becker commit 07eaac9438b13ec0b863111698b91ccec8f3b8d4 Author: Tao Ma Date: Tue Sep 7 13:30:06 2010 +0800 ocfs2: Fix lockdep warning in reflink. This patch change mutex_lock to a new subclass and add a new inode lock subclass for the target inode which caused this lockdep warning. ============================================= [ INFO: possible recursive locking detected ] 2.6.35+ #5 --------------------------------------------- reflink/11086 is trying to acquire lock: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] but task is already holding lock: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x5d3/0x1229 [ocfs2] other info that might help us debug this: 6 locks held by reflink/11086: #0: (&sb->s_type->i_mutex_key#15/1){+.+.+.}, at: [] lookup_create+0x26/0x97 #1: (&sb->s_type->i_mutex_key#15){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x4d3/0x1229 [ocfs2] #2: (Meta){+++++.}, at: [] ocfs2_reflink_ioctl+0x5d3/0x1229 [ocfs2] #3: (&oi->ip_xattr_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x68b/0x1229 [ocfs2] #4: (&oi->ip_alloc_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x69a/0x1229 [ocfs2] #5: (&sb->s_type->i_mutex_key#15/2){+.+...}, at: [] ocfs2_reflink_ioctl+0x882/0x1229 [ocfs2] stack backtrace: Pid: 11086, comm: reflink Not tainted 2.6.35+ #5 Call Trace: [] validate_chain+0x56e/0xd68 [] ? mark_held_locks+0x49/0x69 [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] __ocfs2_cluster_lock+0x975/0xa0d [ocfs2] [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? ocfs2_wait_for_recovery+0x15/0x8a [ocfs2] [] ocfs2_inode_lock_full_nested+0x1ac/0xdc5 [ocfs2] [] ? ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? trace_hardirqs_on_caller+0x10b/0x12f [] ? debug_mutex_free_waiter+0x4f/0x53 [] ocfs2_reflink_ioctl+0x898/0x1229 [ocfs2] [] ? ocfs2_file_lock_res_init+0x66/0x78 [ocfs2] [] ? might_fault+0x40/0x8d [] ocfs2_ioctl+0x61a/0x656 [ocfs2] [] ? mntput_no_expire+0x1d/0xb0 [] ? path_put+0x2c/0x31 [] vfs_ioctl+0x2a/0x9d [] do_vfs_ioctl+0x45d/0x4ae [] ? _raw_spin_unlock+0x26/0x2a [] ? sysret_check+0x27/0x62 [] sys_ioctl+0x57/0x7a [] system_call_fastpath+0x16/0x1b Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 5e64b0d9e86ffff8b299556341d85319117539e9 Author: Tao Ma Date: Tue Sep 7 13:30:05 2010 +0800 ocfs2/lockdep: Move ip_xattr_sem out of ocfs2_xattr_get_nolock. As the name shows, we shouldn't have any lock in ocfs2_xattr_get_nolock. so lift ip_xattr_sem to the caller. This should be safe for us since the only 2 callers are: 1. ocfs2_xattr_get which will lock the resources. 2. ocfs2_mknod which don't need this locking. And this also resolves the following lockdep warning. ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.35+ #5 ------------------------------------------------------- reflink/30027 is trying to acquire lock: (&oi->ip_alloc_sem){+.+.+.}, at: [] ocfs2_reflink_ioctl+0x69a/0x1226 [ocfs2] but task is already holding lock: (&oi->ip_xattr_sem){++++..}, at: [] ocfs2_reflink_ioctl+0x68b/0x1226 [ocfs2] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (&oi->ip_xattr_sem){++++..}: [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] down_read+0x34/0x47 [] ocfs2_xattr_get_nolock+0xa0/0x4e6 [ocfs2] [] ocfs2_get_acl_nolock+0x5c/0x132 [ocfs2] [] ocfs2_init_acl+0x60/0x243 [ocfs2] [] ocfs2_mknod+0xae8/0xfea [ocfs2] [] ocfs2_create+0x9d/0x105 [ocfs2] [] vfs_create+0x9b/0xf4 [] do_last+0x2fd/0x5be [] do_filp_open+0x1fb/0x572 [] do_sys_open+0x5a/0xe7 [] sys_open+0x1b/0x1d [] system_call_fastpath+0x16/0x1b -> #2 (jbd2_handle){+.+...}: [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] start_this_handle+0x4a3/0x4bc [jbd2] [] jbd2__journal_start+0xba/0xee [jbd2] [] jbd2_journal_start+0xe/0x10 [jbd2] [] ocfs2_start_trans+0xb7/0x19b [ocfs2] [] ocfs2_mknod+0x73e/0xfea [ocfs2] [] ocfs2_create+0x9d/0x105 [ocfs2] [] vfs_create+0x9b/0xf4 [] do_last+0x2fd/0x5be [] do_filp_open+0x1fb/0x572 [] do_sys_open+0x5a/0xe7 [] sys_open+0x1b/0x1d [] system_call_fastpath+0x16/0x1b -> #1 (&journal->j_trans_barrier){.+.+..}: [] __lock_acquire+0x79a/0x7f1 [] lock_release_non_nested+0x1e5/0x24b [] lock_release+0x158/0x17a [] __mutex_unlock_slowpath+0xbf/0x11b [] mutex_unlock+0x9/0xb [] ocfs2_free_ac_resource+0x31/0x67 [ocfs2] [] ocfs2_free_alloc_context+0x11/0x1d [ocfs2] [] ocfs2_write_begin_nolock+0x141e/0x159b [ocfs2] [] ocfs2_write_begin+0x11e/0x1e7 [ocfs2] [] generic_file_buffered_write+0x10c/0x210 [] ocfs2_file_aio_write+0x4cc/0x6d3 [ocfs2] [] do_sync_write+0xc2/0x106 [] vfs_write+0xae/0x131 [] sys_write+0x47/0x6f [] system_call_fastpath+0x16/0x1b -> #0 (&oi->ip_alloc_sem){+.+.+.}: [] validate_chain+0x727/0xd68 [] __lock_acquire+0x79a/0x7f1 [] lock_acquire+0xc6/0xed [] down_write+0x31/0x52 [] ocfs2_reflink_ioctl+0x69a/0x1226 [ocfs2] [] ocfs2_ioctl+0x61a/0x656 [ocfs2] [] vfs_ioctl+0x2a/0x9d [] do_vfs_ioctl+0x45d/0x4ae [] sys_ioctl+0x57/0x7a [] system_call_fastpath+0x16/0x1b Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 0e52247a2ed1f211f0c4f682dc999610a368903f Author: Cam Macdonell Date: Tue Sep 7 17:25:20 2010 -0700 PCI: fix pci_resource_alignment prototype This fixes the prototype for both pci_resource_alignment() and pci_sriov_resource_alignment(). Patch started as debugging effort from Cam Macdonell. Cc: Cam Macdonell Cc: Avi Kivity [chrisw: add iov bits] Signed-off-by: Chris Wright Signed-off-by: Jesse Barnes