commit cd07202cc8262e1669edff0d97715f3dd9260917 Author: Linus Torvalds Date: Thu Oct 14 16:26:43 2010 -0700 Linux 2.6.36-rc8 commit 3aa0ce825ade0cf5506e32ccf51d01fc8d22a9cf Author: Linus Torvalds Date: Thu Oct 14 14:32:06 2010 -0700 Un-inline the core-dump helper functions Tony Luck reports that the addition of the access_ok() check in commit 0eead9ab41da ("Don't dump task struct in a.out core-dumps") broke the ia64 compile due to missing the necessary header file includes. Rather than add yet another include () to make everything happy, just uninline the silly core dump helper functions and move the bodies to fs/exec.c where they make a lot more sense. dump_seek() in particular was too big to be an inline function anyway, and none of them are in any way performance-critical. And we really don't need to mess up our include file headers more than they already are. Reported-and-tested-by: Tony Luck Signed-off-by: Linus Torvalds commit ae42d8d44195a614c78a636683fe65ed31744cbd Merge: 0eead9a 71085ce Author: Linus Torvalds Date: Thu Oct 14 11:19:44 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ehea: Fix a checksum issue on the receive path net: allow FEC driver to use fixed PHY support tg3: restore rx_dropped accounting b44: fix carrier detection on bind net: clear heap allocations for privileged ethtool actions NET: wimax, fix use after free ATM: iphase, remove sleep-inside-atomic ATM: mpc, fix use after free ATM: solos-pci, remove use after free net/fec: carrier off initially to avoid root mount failure r8169: use device model DMA API r8169: allocate with GFP_KERNEL flag when able to sleep commit 0eead9ab41da33644ae2c97c57ad03da636a0422 Author: Linus Torvalds Date: Thu Oct 14 10:57:40 2010 -0700 Don't dump task struct in a.out core-dumps akiphie points out that a.out core-dumps have that odd task struct dumping that was never used and was never really a good idea (it goes back into the mists of history, probably the original core-dumping code). Just remove it. Also do the access_ok() check on dump_write(). It probably doesn't matter (since normal filesystems all seem to do it anyway), but he points out that it's normally done by the VFS layer, so ... [ I suspect that we should possibly do "vfs_write()" instead of calling ->write directly. That also does the whole fsnotify and write statistics thing, which may or may not be a good idea. ] And just to be anal, do this all for the x86-64 32-bit a.out emulation code too, even though it's not enabled (and won't currently even compile) Reported-by: akiphie Signed-off-by: Linus Torvalds commit 53eeb64e808971207350386121f4bab12fa2f45f Merge: 8c35bf3 c50a898 Author: Linus Torvalds Date: Wed Oct 13 16:51:59 2010 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx: ioat2: fix performance regression commit 8c35bf368c4e533d07610810e4c3b84c34c8e201 Merge: fec896e b1e86db Author: Linus Torvalds Date: Wed Oct 13 16:51:29 2010 -0700 Merge branch 'for-2.6.36' of git://linux-nfs.org/~bfields/linux * 'for-2.6.36' of git://linux-nfs.org/~bfields/linux: nfsd: fix BUG at fs/nfsd/nfsfh.h:199 on unlink commit fec896e21b65278a67b3a98073eef23351a74a4a Merge: d94bc4f d013432 Author: Linus Torvalds Date: Wed Oct 13 16:50:23 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: ring-buffer: Fix typo of time extends per page perf, MIPS: Support cross compiling of tools/perf for MIPS perf: Fix incorrect copy_from_user() usage commit d94bc4fc24ed6263746934ace161ab916818d38a Merge: 7081319 06c1088 Author: Linus Torvalds Date: Wed Oct 13 16:35:33 2010 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: ARM: relax ioremap prohibition (309caa9) for -final and -stable ARM: 6440/1: ep93xx: DMA: fix channel_disable cpuimx27: fix i2c bus selection cpuimx27: fix compile when ULPI is selected ARM: 6435/1: Fix HWCAP_TLS flag for ARM11MPCore/Cortex-A9 ARM: 6436/1: AT91: Fix power-saving in idle-mode on 926T processors ARM: fix section mismatch warnings in Versatile Express ARM: 6412/1: kprobes-decode: add support for MOVW instruction ARM: 6419/1: mmu: Fix MT_MEMORY and MT_MEMORY_NONCACHED pte flags ARM: 6416/1: errata: faulty hazard checking in the Store Buffer may lead to data corruption commit 70813196581fc636cb8a49e9bba9e04bda76206e Merge: a56f31a 0fa035e Author: Linus Torvalds Date: Wed Oct 13 16:35:05 2010 -0700 Merge branch 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 * 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6: omap: iommu-load cam register before flushing the entry commit a56f31a0c6a08faeca5f0c5e64c6a0113c43181b Merge: 509d448 a8c051f Author: Linus Torvalds Date: Wed Oct 13 16:34:46 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: Silent spurious error message drm/radeon/kms: fix bad cast/shift in evergreen.c drm/radeon/kms: make TV/DFP table info less verbose drm/radeon/kms: leave certain CP int bits enabled drm/radeon/kms: avoid corner case issue with unmappable vram V2 commit 509d4486bd86f17b17f5134d02bc3586569f9678 Merge: 0acc1b2 73cf624 Author: Linus Torvalds Date: Wed Oct 13 16:34:23 2010 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, numa: For each node, register the memory blocks actually used x86, AMD, MCE thresholding: Fix the MCi_MISCj iteration order x86, mce, therm_throt.c: Fix missing curly braces in error handling logic commit c50a898fd4e736623ee175920db056194e0bb483 Author: Dan Williams Date: Wed Oct 13 15:43:10 2010 -0700 ioat2: fix performance regression Commit 0793448 "DMAENGINE: generic channel status v2" changed the interface for how dma channel progress is retrieved. It inadvertently exported an internal helper function ioat_tx_status() instead of ioat_dma_tx_status(). The latter polls the hardware to get the latest completion state, while the helper just evaluates the current state without touching hardware. The effect is that we end up waiting for completion timeouts or descriptor allocation errors before the completion state is updated. iperf (before fix): [SUM] 0.0-41.3 sec 364 MBytes 73.9 Mbits/sec iperf (after fix): [SUM] 0.0- 4.5 sec 499 MBytes 940 Mbits/sec This is a regression starting with 2.6.35. Cc: Cc: Dave Jiang Cc: Jesse Brandeburg Cc: Linus Walleij Cc: Maciej Sosnowski Reported-by: Richard Scobie Signed-off-by: Dan Williams commit 71085ce8285dc5f3011694f6ba7259201135c6d6 Author: Breno Leitao Date: Thu Oct 7 13:17:33 2010 +0000 ehea: Fix a checksum issue on the receive path Currently we set all skbs with CHECKSUM_UNNECESSARY, even those whose protocol we don't know. This patch just add the CHECKSUM_COMPLETE tag for non TCP/UDP packets. Reported-by: Eric Dumazet Signed-off-by: Breno Leitao Signed-off-by: Jay Vosburgh Signed-off-by: David S. Miller commit b1e86db1de2e8bc2be9fb94fae3451c2a776e8c1 Author: J. Bruce Fields Date: Wed Oct 13 14:46:17 2010 -0400 nfsd: fix BUG at fs/nfsd/nfsfh.h:199 on unlink As of commit 43a9aa64a2f4330a9cb59aaf5c5636566bce067c "NFSD: Fill in WCC data for REMOVE, RMDIR, MKNOD, and MKDIR", we sometimes call fh_unlock on a filehandle that isn't fully initialized. We should fix up the callers, but as a quick fix it is also sufficient just to remove this assertion. Reported-by: Marius Tolzmann Cc: Chuck Lever Signed-off-by: J. Bruce Fields commit 6fcc040f02d281c7e9563127358a77ce2bbfe284 Author: Greg Ungerer Date: Mon Oct 11 21:03:05 2010 +0000 net: allow FEC driver to use fixed PHY support At least one board using the FEC driver does not have a conventional PHY attached to it, it is directly connected to a somewhat simple ethernet switch (the board is the SnapGear/LITE, and the attached 4-port ethernet switch is a RealTek RTL8305). This switch does not present the usual register interface of a PHY, it presents nothing. So a PHY scan will find nothing - it finds ID's of 0 for each PHY on the attached MII bus. After the FEC driver was changed to use phylib for supporting PHYs it no longer works on this particular board/switch setup. Add code support to use a fixed phy if no PHY is found on the MII bus. This is based on the way the cpmac.c driver solved this same problem. Signed-off-by: Greg Ungerer Signed-off-by: David S. Miller commit 06c10884486a63a1e4ff657aaa51e848e64b9dc3 Author: Russell King Date: Wed Oct 13 00:15:25 2010 +0100 ARM: relax ioremap prohibition (309caa9) for -final and -stable ... but produce a big warning about the problem as encouragement for people to fix their drivers. Signed-off-by: Russell King commit 841f48a849e0dc14fe6f3d2bd31e831ac6a76546 Merge: 10d48b3 4793ca40 Author: Russell King Date: Tue Oct 12 22:43:26 2010 +0100 Merge branch 'for-rmk' of git://git.pengutronix.de/git/imx/linux-2.6 commit 10d48b3934940c178635413b5128c33bc17abe1d Author: Mika Westerberg Date: Tue Oct 12 10:37:59 2010 +0100 ARM: 6440/1: ep93xx: DMA: fix channel_disable When channel_disable() is called, it disables per channel interrupts and waits until channels state becomes STATE_STALL, and then disables the channel. Now, if the DMA transfer is disabled while the channel is in STATE_NEXT we will not wait anything and disable the channel immediately. This seems to cause weird data corruption for example in audio transfers. Fix is to wait while we are in STATE_NEXT or STATE_ON and only then disable the channel. Signed-off-by: Mika Westerberg Acked-by: Ryan Mallon Signed-off-by: Russell King commit 0acc1b2afb6ded060b7d6b1b5e6ac8a00ec47547 Merge: 7c53477 47008cd Author: Linus Torvalds Date: Tue Oct 12 09:16:01 2010 -0700 Merge branch 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.36' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Move TSC reset out of vmcb_init KVM: x86: Fix SVM VMCB reset commit d01343244abdedd18303d0323b518ed9cdcb1988 Author: Steven Rostedt Date: Tue Oct 12 12:06:43 2010 -0400 ring-buffer: Fix typo of time extends per page Time stamps for the ring buffer are created by the difference between two events. Each page of the ring buffer holds a full 64 bit timestamp. Each event has a 27 bit delta stamp from the last event. The unit of time is nanoseconds, so 27 bits can hold ~134 milliseconds. If two events happen more than 134 milliseconds apart, a time extend is inserted to add more bits for the delta. The time extend has 59 bits, which is good for ~18 years. Currently the time extend is committed separately from the event. If an event is discarded before it is committed, due to filtering, the time extend still exists. If all events are being filtered, then after ~134 milliseconds a new time extend will be added to the buffer. This can only happen till the end of the page. Since each page holds a full timestamp, there is no reason to add a time extend to the beginning of a page. Time extends can only fill a page that has actual data at the beginning, so there is no fear that time extends will fill more than a page without any data. When reading an event, a loop is made to skip over time extends since they are only used to maintain the time stamp and are never given to the caller. As a paranoid check to prevent the loop running forever, with the knowledge that time extends may only fill a page, a check is made that tests the iteration of the loop, and if the iteration is more than the number of time extends that can fit in a page a warning is printed and the ring buffer is disabled (all of ftrace is also disabled with it). There is another event type that is called a TIMESTAMP which can hold 64 bits of data in the theoretical case that two events happen 18 years apart. This code has not been implemented, but the name of this event exists, as well as the structure for it. The size of a TIMESTAMP is 16 bytes, where as a time extend is only 8 bytes. The macro used to calculate how many time extends can fit on a page used the TIMESTAMP size instead of the time extend size cutting the amount in half. The following test case can easily trigger the warning since we only need to have half the page filled with time extends to trigger the warning: # cd /sys/kernel/debug/tracing/ # echo function > current_tracer # echo 'common_pid < 0' > events/ftrace/function/filter # echo > trace # echo 1 > trace_marker # sleep 120 # cat trace Enabling the function tracer and then setting the filter to only trace functions where the process id is negative (no events), then clearing the trace buffer to ensure that we have nothing in the buffer, then write to trace_marker to add an event to the beginning of a page, sleep for 2 minutes (only 35 seconds is probably needed, but this guarantees the bug), and then finally reading the trace which will trigger the bug. This patch fixes the typo and prevents the false positive of that warning. Reported-by: Hans J. Koch Tested-by: Hans J. Koch Cc: Thomas Gleixner Cc: Stable Kernel Signed-off-by: Steven Rostedt commit c1e028ef40b8d6943b767028ba17d4f2ba020edb Author: Deng-Cheng Zhu Date: Tue Oct 12 19:33:33 2010 +0800 perf, MIPS: Support cross compiling of tools/perf for MIPS Changes: v4: Fix the cosmetic issue of redundant dot-ops v3: Change rmb() to use SYNC v2: Include mips unistd.h and define rmb()/cpu_relax() in tools/perf/perf.h Signed-off-by: Deng-Cheng Zhu Acked-by: Ralf Baechle Cc: David Daney Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit a8c051f0c8d2f81c665e820f765aaddf86161640 Author: Jean Delvare Date: Fri Oct 8 14:34:49 2010 +0200 drm/radeon/kms: Silent spurious error message I see the following error message in my kernel log from time to time: radeon 0000:07:00.0: ffff88007c334000 reserve failed for wait radeon 0000:07:00.0: ffff88007c334000 reserve failed for wait After investigation, it turns out that there's nothing to be afraid of and everything works as intended. So remove the spurious log message. Signed-off-by: Jean Delvare Reviewed-by: Jerome Glisse Signed-off-by: Dave Airlie commit d31dba58480c3cdd458f449261d72ecd15287792 Author: Alex Deucher Date: Mon Oct 11 12:41:32 2010 -0400 drm/radeon/kms: fix bad cast/shift in evergreen.c Missing parens. fixes: https://bugs.freedesktop.org/show_bug.cgi?id=30718 Reported-by: Dave Gilbert Signed-off-by: Alex Deucher Reviewed-by: Matt Turner Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 40f76d81fb45c1399f93500afa2aed9f84f7dee6 Author: Alex Deucher Date: Thu Oct 7 22:38:42 2010 -0400 drm/radeon/kms: make TV/DFP table info less verbose Make TV standard and DFP table revisions debug only. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 3555e53b5b4915bc58d08ece6cb2bfa97dda1f9e Author: Alex Deucher Date: Fri Oct 8 12:09:12 2010 -0400 drm/radeon/kms: leave certain CP int bits enabled These bits are used for internal communication and should be left enabled. This may fix s/r issues on some systems. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit c919b371cb734f42b1130e706ecee262f8d9261d Author: Jerome Glisse Date: Tue Aug 10 17:41:31 2010 -0400 drm/radeon/kms: avoid corner case issue with unmappable vram V2 We should not allocate any object into unmappable vram if we have no means to access them which on all GPU means having the CP running and on newer GPU having the blit utility working. This patch limit the vram allocation to visible vram until we have acceleration up and running. Note that it's more than unlikely that we run into any issue related to that as when acceleration is not woring userspace should allocate any object in vram beside front buffer which should fit in visible vram. V2 use real_vram_size as mc_vram_size could be bigger than the actual amount of vram [airlied: fixup r700_cp_stop case] Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie commit ad0cf3478de8677f720ee06393b3147819568d6a Author: John Blackwood Date: Tue Sep 28 18:03:11 2010 -0400 perf: Fix incorrect copy_from_user() usage perf events: repair incorrect use of copy_from_user This makes the perf_event_period() return 0 instead of -EFAULT on success. Signed-off-by: John Blackwood Signed-off-by: Joe Korty Acked-by: Peter Zijlstra LKML-Reference: <20100928220311.GA18145@tsunami.ccur.com> Signed-off-by: Ingo Molnar commit 7c5347733dcc4ba0bac0baf86d99fae0561f33b7 Author: Eric Paris Date: Mon Oct 11 18:13:31 2010 -0400 fanotify: disable fanotify syscalls This patch disables the fanotify syscalls by just not building them and letting the cond_syscall() statements in kernel/sys_ni.c redirect them to sys_ni_syscall(). It was pointed out by Tvrtko Ursulin that the fanotify interface did not include an explicit prioritization between groups. This is necessary for fanotify to be usable for hierarchical storage management software, as they must get first access to the file, before inotify-like notifiers see the file. This feature can be added in an ABI compatible way in the next release (by using a number of bits in the flags field to carry the info) but it was suggested by Alan that maybe we should just hold off and do it in the next cycle, likely with an (new) explicit argument to the syscall. I don't like this approach best as I know people are already starting to use the current interface, but Alan is all wise and noone on list backed me up with just using what we have. I feel this is needlessly ripping the rug out from under people at the last minute, but if others think it needs to be a new argument it might be the best way forward. Three choices: Go with what we got (and implement the new feature next cycle). Add a new field right now (and implement the new feature next cycle). Wait till next cycle to release the ABI (and implement the new feature next cycle). This is number 3. Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds commit b0057c51db66c5f0f38059f242c57d61c4741d89 Author: Eric Dumazet Date: Sun Oct 10 19:55:52 2010 +0000 tg3: restore rx_dropped accounting commit 511d22247be7 (tg3: 64 bit stats on all arches), overlooked the rx_dropped accounting. We use a full "struct rtnl_link_stats64" to hold rx_dropped value, but forgot to report it in tg3_get_stats64(). Use an "unsigned long" instead to shrink "struct tg3" by 176 bytes, and report this value to stats readers. Increment rx_dropped counter for oversized frames. Signed-off-by: Eric Dumazet CC: Michael Chan CC: Matt Carlson Acked-by: Matt Carlson Signed-off-by: David S. Miller commit bcf64aa379fcadd074449cbf0c049da70071b06f Author: Paul Fertser Date: Mon Oct 11 15:45:35 2010 -0700 b44: fix carrier detection on bind For carrier detection to work properly when binding the driver with a cable unplugged, netif_carrier_off() should be called after register_netdev(), not before. Signed-off-by: Paul Fertser Signed-off-by: David S. Miller commit 73cf624d029d776a33d0a80c695485b3f9b36231 Author: Yinghai Lu Date: Sun Oct 10 19:52:15 2010 -0700 x86, numa: For each node, register the memory blocks actually used Russ reported SGI UV is broken recently. He said: | The SRAT table shows that memory range is spread over two nodes. | | SRAT: Node 0 PXM 0 100000000-800000000 | SRAT: Node 1 PXM 1 800000000-1000000000 | SRAT: Node 0 PXM 0 1000000000-1080000000 | |Previously, the kernel early_node_map[] would show three entries |with the proper node. | |[ 0.000000] 0: 0x00100000 -> 0x00800000 |[ 0.000000] 1: 0x00800000 -> 0x01000000 |[ 0.000000] 0: 0x01000000 -> 0x01080000 | |The problem is recent community kernel early_node_map[] shows |only two entries with the node 0 entry overlapping the node 1 |entry. | | 0: 0x00100000 -> 0x01080000 | 1: 0x00800000 -> 0x01000000 After looking at the changelog, Found out that it has been broken for a while by following commit |commit 8716273caef7f55f39fe4fc6c69c5f9f197f41f1 |Author: David Rientjes |Date: Fri Sep 25 15:20:04 2009 -0700 | | x86: Export srat physical topology Before that commit, register_active_regions() is called for every SRAT memory entry right away. Use nodememblk_range[] instead of nodes[] in order to make sure we capture the actual memory blocks registered with each node. nodes[] contains an extended range which spans all memory regions associated with a node, but that does not mean that all the memory in between are included. Reported-by: Russ Anderson Tested-by: Russ Anderson Signed-off-by: Yinghai Lu LKML-Reference: <4CB27BDF.5000800@kernel.org> Acked-by: David Rientjes Cc: 2.6.33 .34 .35 .36 Signed-off-by: H. Peter Anvin commit b00916b189d13a615ff05c9242201135992fcda3 Author: Kees Cook Date: Mon Oct 11 12:23:25 2010 -0700 net: clear heap allocations for privileged ethtool actions Several other ethtool functions leave heap uncleared (potentially) by drivers. Some interfaces appear safe (eeprom, etc), in that the sizes are well controlled. In some situations (e.g. unchecked error conditions), the heap will remain unchanged in areas before copying back to userspace. Note that these are less of an issue since these all require CAP_NET_ADMIN. Cc: stable@kernel.org Signed-off-by: Kees Cook Acked-by: Ben Hutchings Signed-off-by: David S. Miller commit 0aa7deadffd8b596983a3abe29a218b4c5f43301 Author: Jiri Slaby Date: Sun Oct 10 23:26:58 2010 +0000 NET: wimax, fix use after free Stanse found that i2400m_rx frees skb, but still uses skb->len even though it has skb_len defined. So use skb_len properly in the code. And also define it unsinged int rather than size_t to solve compilation warnings. Signed-off-by: Jiri Slaby Cc: Inaky Perez-Gonzalez Cc: linux-wimax@intel.com Acked-by: Inaky Perez-Gonzalez Signed-off-by: David S. Miller commit ec622ab072e95cf96e78ab4d39d4eea874518c80 Author: Jiri Slaby Date: Sun Oct 10 23:26:57 2010 +0000 ATM: iphase, remove sleep-inside-atomic Stanse found that ia_init_one locks a spinlock and inside of that it calls ia_start which calls: * request_irq * tx_init which does kmalloc(GFP_KERNEL) Both of them can thus sleep and result in a deadlock. I don't see a reason to have a per-device spinlock there which is used only there and inited right before the lock location. So remove it completely. Signed-off-by: Jiri Slaby Cc: Chas Williams Signed-off-by: David S. Miller commit 5518b29f225dbdf47ded02cf229ff8225a2cdf82 Author: Jiri Slaby Date: Sun Oct 10 22:46:34 2010 +0000 ATM: mpc, fix use after free Stanse found that mpc_push frees skb and then it dereferences it. It is a typo, new_skb should be dereferenced there. Signed-off-by: Jiri Slaby Cc: Eric Dumazet Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit f1ee89d5b007620353fb7dec1d34db4baa1a5571 Author: Jiri Slaby Date: Sun Oct 10 21:50:44 2010 +0000 ATM: solos-pci, remove use after free Stanse found we do in console_show: kfree_skb(skb); return skb->len; which is not good. Fix that by remembering the len and use it in the function instead. Signed-off-by: Jiri Slaby Cc: Chas Williams Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 29979aa8bd69becd94cbad59093807a417ce2a9e Merge: 50c6dc9 e9203c9 Author: Linus Torvalds Date: Mon Oct 11 10:19:24 2010 -0700 Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6 * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: kbuild: fix oldnoconfig to do the right thing kconfig: Temporarily disable dependency warnings kconfig: delay symbol direct dependency initialization commit 50c6dc9ebad0f1abde192696bea94c3bd2f24c18 Merge: 6af0b78 d24a9da Author: Linus Torvalds Date: Mon Oct 11 10:05:05 2010 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86: IPS driver: Fix limit clamping when reducing CPU power [PATCH 2/2] IPS driver: disable CPU turbo IPS driver: apply BIOS provided CPU limit if different from default intel_ips -- ensure we do not enable gpu turbo mode without driver linkage intel_ips: Print MCP limit exceeded values. IPS driver: verify BIOS provided limits IPS driver: don't toggle CPU turbo on unsupported CPUs NULL pointer might be used in ips_monitor() Release symbol on error-handling path of ips_get_i915_syms() old_cpu_power is wrongly divided by 65535 in ips_monitor() seqno mask of THM_ITV register is 16bit commit 6af0b78cf0d3b5b39fcd892e532e567b12b32b37 Merge: 58d79e7 ca047fe Author: Linus Torvalds Date: Mon Oct 11 10:03:19 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - fix pressure in Cintiq 21UX2 commit 58d79e7141e4f5e4006089eabeec0eadef6e409e Merge: 85a3318 dd4025b Author: Linus Torvalds Date: Mon Oct 11 10:02:57 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Add another HP DV6 quirk OSS: soundcard: locking bug in sound_ioctl() ASoC: Update links for Wolfson MAINTAINERS entry ASoC: Add Dimitris Papastamos to Wolfson maintainers ASoC: Add Jassi Brar as Samsung maintainer commit dd4025bdb6c731b6cd23f97797ef6d8dbfeb9e9d Merge: 9b2167d cf8eda3 Author: Takashi Iwai Date: Mon Oct 11 14:36:25 2010 +0200 Merge branch 'fix/asoc' into for-linus commit 9b2167d59f38691b86430ce559c7fa9d4f973b1f Author: Luke Yelavich Date: Wed Oct 6 15:45:46 2010 +1100 ALSA: hda - Add another HP DV6 quirk BugLink: https://bugs.launchpad.net/bugs/653420 Add another HP DV6 notebook (103c:363e) to use STAC_HP_DV5. Signed-off-by: Luke Yelavich Signed-off-by: Takashi Iwai commit d4cfa4d12f46e2520f4c1d1a92e891ce068b7464 Author: Dan Carpenter Date: Sun Oct 10 19:33:52 2010 +0200 OSS: soundcard: locking bug in sound_ioctl() We shouldn't return directly here because we're still holding the &soundcard_mutex. This bug goes all the way back to the start of git. It's strange that no one has complained about it as a runtime bug. CC: stable@kernel.org Signed-off-by: Dan Carpenter Acked-by: Arnd Bergmann Signed-off-by: Takashi Iwai commit 47008cd887c1836bcadda123ba73e1863de7a6c4 Author: Zachary Amsden Date: Thu Aug 19 22:07:19 2010 -1000 KVM: x86: Move TSC reset out of vmcb_init The VMCB is reset whenever we receive a startup IPI, so Linux is setting TSC back to zero happens very late in the boot process and destabilizing the TSC. Instead, just set TSC to zero once at VCPU creation time. Why the separate patch? So git-bisect is your friend. Signed-off-by: Zachary Amsden Signed-off-by: Marcelo Tosatti commit 58877679fd393d3ef71aa383031ac7817561463d Author: Zachary Amsden Date: Thu Aug 19 22:07:18 2010 -1000 KVM: x86: Fix SVM VMCB reset On reset, VMCB TSC should be set to zero. Instead, code was setting tsc_offset to zero, which passes through the underlying TSC. Signed-off-by: Zachary Amsden Signed-off-by: Marcelo Tosatti commit 6dcbfe4f0b4e17e289d56fa534b7ce5a6b7f63a3 Author: Borislav Petkov Date: Fri Oct 8 12:08:34 2010 +0200 x86, AMD, MCE thresholding: Fix the MCi_MISCj iteration order This fixes possible cases of not collecting valid error info in the MCE error thresholding groups on F10h hardware. The current code contains a subtle problem of checking only the Valid bit of MSR0000_0413 (which is MC4_MISC0 - DRAM thresholding group) in its first iteration and breaking out if the bit is cleared. But (!), this MSR contains an offset value, BlkPtr[31:24], which points to the remaining MSRs in this thresholding group which might contain valid information too. But if we bail out only after we checked the valid bit in the first MSR and not the block pointer too, we miss that other information. The thing is, MC4_MISC0[BlkPtr] is not predicated on MCi_STATUS[MiscV] or MC4_MISC0[Valid] and should be checked prior to iterating over the MCI_MISCj thresholding group, irrespective of the MC4_MISC0[Valid] setting. Signed-off-by: Borislav Petkov Cc: Signed-off-by: Ingo Molnar commit 03c698c93fc15d976738a853a7ccb6ea26396003 Author: Oskar Schirmer Date: Thu Oct 7 02:30:30 2010 +0000 net/fec: carrier off initially to avoid root mount failure with hardware slow in negotiation, the system did freeze while trying to mount root on nfs at boot time. the link state has not been initialised so network stack tried to start transmission right away. this caused instant retries, as the driver solely stated business upon link down, rendering the system unusable. notify carrier off initially to prevent transmission until phylib will report link up. Signed-off-by: Oskar Schirmer Signed-off-by: David S. Miller commit ca047fedd89bbb4b79b61e0656a7b799e4e45e6d Author: Aristeu Rozanski Date: Sun Oct 10 14:12:33 2010 -0700 Input: wacom - fix pressure in Cintiq 21UX2 Currently the pressure range in Cintiq 21UX2 is limited to half of the supported. This patch fixes the problem. Signed-off-by: Aristeu Rozanski Acked-by: Ping Cheng CC: stable@kernel.org Signed-off-by: Dmitry Torokhov commit e9203c988234aa512bd45ca32b52e21c7bbfc414 Author: Kyle McMartin Date: Wed Sep 1 11:21:30 2010 -0400 kbuild: fix oldnoconfig to do the right thing Commit 861b4ea4 broke oldnoconfig when removed the oldnoconfig checks on if (input_mode == nonint_oldconfig || input_mode == oldnoconfig) { if (input_mode == nonint_oldconfig && sym->name && !sym_is_choice_value(sym)) { to avoid oldnoconfig chugging through the else stanza. Fix that to restore expected behaviour (which I've confirmed in the Fedora kernel build that the configs end up looking the same.) Signed-off-by: Kyle McMartin Acked-by: Sam Ravnborg Signed-off-by: Michal Marek commit 71ebc01d3ad4fa3f20e86603bc31ff2cbc535d95 Author: Michal Marek Date: Fri Oct 8 16:40:27 2010 +0200 kconfig: Temporarily disable dependency warnings After fixing a use-after-free bug in kconfig, a 'make defconfig' or 'make allmodconfig' fills the screen with warnings that were not detected before. Given that we are close to the release now, disable the warnings temporarily and deal with them after 2.6.36. Signed-off-by: Michal Marek commit 85a331881dd52a93e7d4c57bcaf5486cc8718465 Merge: 63847e6 ae6df5f Author: Linus Torvalds Date: Sat Oct 9 12:06:26 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits) net: clear heap allocation for ETHTOOL_GRXCLSRLALL isdn: strcpy() => strlcpy() Revert "mac80211: use netif_receive_skb in ieee80211_tx_status callpath" mac80211: delete AddBA response timer ath9k_hw: fix regression in ANI listen time calculation caif: fix two caif_connect() bugs bonding: fix WARN_ON when writing to bond_master sysfs file skge: add quirk to limit DMA MAINTAINERS: update Intel LAN Ethernet info e1000e.txt: Add e1000e documentation e1000.txt: Update e1000 documentation ixgbevf.txt: Update ixgbevf documentation cls_u32: signedness bug Bluetooth: Disallow to change L2CAP_OPTIONS values when connected sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() sctp: prevent reading out-of-bounds memory ipv4: correct IGMP behavior on v3 query during v2-compatibility mode netdev: Depend on INET before selecting INET_LRO Revert "ipv4: Make INET_LRO a bool instead of tristate." net: Fix the condition passed to sk_wait_event() ... commit 63847e66b28ed5e0dc28409d767e8f3891502ac4 Merge: b411c17 7fcca7d Author: Linus Torvalds Date: Sat Oct 9 12:05:09 2010 -0700 Merge branch 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6 * 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6: intel_idle: enable Atom C6 commit b411c17eb96a1467d08d0538a7bf5166e5372234 Merge: 8dc54e4 7cfff7f Author: Linus Torvalds Date: Sat Oct 9 12:04:38 2010 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: add DMI to disable AML Vista compatibility on MSI GX723 Notebook ACPI: Handle ACPI0007 Device in acpi_early_set_pdc commit 8dc54e49ce67e5628bf4668c64203c22cbac7fc5 Merge: 267aeb6 d91f243 Author: Linus Torvalds Date: Sat Oct 9 12:03:46 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: update issue_seq on cap grant ceph: send cap release message early on failed revoke. ceph: Update max_len with minimum required size ceph: Fix return value of encode_fh function ceph: avoid null deref in osd request error path ceph: fix list_add usage on unsafe_writes list commit 267aeb6c142b1fbad1e6ed49f46d82113339141a Merge: d6bcfd1 f17b1f9 Author: Linus Torvalds Date: Sat Oct 9 12:03:23 2010 -0700 Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd * 'for-linus' of git://git.open-osd.org/linux-open-osd: exofs: Fix double page_unlock BUG in write_begin/end commit d6bcfd1a214ae9609b27417b1844c6b6f09ca125 Merge: 8ea3f0a 6939a5a Author: Linus Torvalds Date: Sat Oct 9 11:43:40 2010 -0700 Merge branch 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel: drm/i915: Prevent module unload to avoid random memory corruption commit 8ea3f0afb23bc49a996f262ea04708b38de82bca Merge: e92ba6d 7cf4b48 Author: Linus Torvalds Date: Sat Oct 9 11:43:18 2010 -0700 Merge branch 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung * 's5p-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung: ARM: SAMSUNG: Add a workaround for get_clock() for serial driver ARM: S5P: Bug fix on errors of build with CONFIG_PREEMPT_NONE ARM: SAMSUNG: Fix build warnings because of unused codes commit e92ba6d2ec8f83a26deb68dd3c2a195657dfdebe Author: Andi Kleen Date: Fri Oct 8 20:36:15 2010 +0200 Define _addr_lsb in siginfo_t for mips Define an _addr_lsb field in the mips and ia64 siginfo_ts, following the asm-generic version. This just puts the field over padding. This fixes a compilation problem introduced with a337fda. Cc: ralf@linux-mips.org Cc: tony.luck@intel.com Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit e4c4776dea9fd0295ebb3b215599d52938d6d7a3 Author: Mike Snitzer Date: Sat Oct 9 12:12:13 2010 +1030 virtio-blk: fix request leak. Must drop reference taken by blk_make_request(). Signed-off-by: Mike Snitzer Signed-off-by: Rusty Russell Cc: stable@kernel.org # .35.x Signed-off-by: Linus Torvalds commit 82553bb6218d2707d2e6446d7b2313dfd60b48a8 Author: Stanislaw Gruszka Date: Fri Oct 8 04:25:01 2010 +0000 r8169: use device model DMA API Use DMA API as PCI equivalents will be deprecated. This change also allow to allocate with GFP_KERNEL where possible. Tested-by: Neal Becker Signed-off-by: Stanislaw Gruszka Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit aeb19f6052b5e5c8a24aa444fbff73b84341beac Author: Stanislaw Gruszka Date: Fri Oct 8 04:25:00 2010 +0000 r8169: allocate with GFP_KERNEL flag when able to sleep We have fedora bug report where driver fail to initialize after suspend/resume because of memory allocation errors: https://bugzilla.redhat.com/show_bug.cgi?id=629158 To fix use GFP_KERNEL allocation where possible. Tested-by: Neal Becker Signed-off-by: Stanislaw Gruszka Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 7cfff7f21221725f587ba90bd1acf0e2e0304901 Merge: c9933f7 3deb11e Author: Len Brown Date: Fri Oct 8 22:37:46 2010 -0400 Merge branch 'msi-dmi' into release commit c9933f795c0740eaf97e6291a68a9787346d5997 Merge: cb655d0 c1e0ddb Author: Len Brown Date: Fri Oct 8 22:35:02 2010 -0400 Merge branch 'pdc-regression' into release commit 7fcca7d900957b43c84da171b750afcf1682808a Author: Len Brown Date: Tue Oct 5 13:43:14 2010 -0400 intel_idle: enable Atom C6 ATM-C6 was commented out, pending public documentation. https://bugzilla.kernel.org/show_bug.cgi?id=19762 Tested-by: Dennis Jansen Signed-off-by: Len Brown commit ae6df5f96a51818d6376da5307d773baeece4014 Author: Kees Cook Date: Thu Oct 7 10:03:48 2010 +0000 net: clear heap allocation for ETHTOOL_GRXCLSRLALL Calling ETHTOOL_GRXCLSRLALL with a large rule_cnt will allocate kernel heap without clearing it. For the one driver (niu) that implements it, it will leave the unused portion of heap unchanged and copy the full contents back to userspace. Signed-off-by: Kees Cook Acked-by: Ben Hutchings Signed-off-by: David S. Miller commit 94b105723a3bfca45c75916423cd959ce71ed215 Merge: b530fb6 4efe7f5 Author: David S. Miller Date: Fri Oct 8 10:36:51 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit b530fb69cf54cf22768a3eabc0604d70b5c13fde Author: Dan Carpenter Date: Fri Oct 8 10:21:22 2010 -0700 isdn: strcpy() => strlcpy() setup.phone and setup.eazmsn are 32 character buffers. rcvmsg.msg_data.byte_array is a 48 character buffer. sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn is 50 chars. The rcvmsg struct comes from the memcpy_fromio() in receivemessage(). I guess that means it's data off the wire. I'm not very familiar with this code but I don't see any reason to assume these strings are NULL terminated. Also it's weird that "dn" in a 50 character buffer but we only seem to use 32 characters. In drivers/isdn/sc/scioc.h, "dn" is only a 49 character buffer. So potentially there is still an issue there. The important thing for now is to prevent the memory corruption. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit f17b1f9f1a5882e486aad469b9ac4cb18581707f Author: Boaz Harrosh Date: Thu Oct 7 13:37:51 2010 -0400 exofs: Fix double page_unlock BUG in write_begin/end This BUG is there since the first submit of the code, but only triggered in last Kernel. It's timing related do to the asynchronous object-creation behaviour of exofs. (Which should be investigated farther) The bug is obvious hence the fixed. Signed-off-by: Boaz Harrosh commit 6939a5aca7cfada279a24c307e772f33104fca20 Author: Chris Wilson Date: Fri Oct 8 13:40:27 2010 +0100 drm/i915: Prevent module unload to avoid random memory corruption The i915 driver has quite a few module unload bugs, the known ones at least have fixes that are targeting 2.6.37. However, in order to maintain a stable kernel, we should prevent this known random memory corruption following driver unload. This should have very low impact on normal users who are unlikely to need to unload the i915 driver. Suggested-by: Thomas Gleixner Acked-by: Daniel Vetter Cc: stable@kernel.org Signed-off-by: Chris Wilson commit 4793ca4028e4dcdbf2740db50995c9378ded3cf8 Author: Eric Bénard Date: Fri Oct 8 10:37:41 2010 +0200 cpuimx27: fix i2c bus selection Recent clean of i.MX devices registration changed the i2C bus number selected for our platform (Freescale start peripheral ID at 1, kernel now start it at 0 so i.MX27's i2c 1 is kernel's i2c 0). Without this fix, i2c is unusable on this platform. Signed-off-by: Eric Bénard Acked-by: Uwe Kleine-König Signed-off-by: Sascha Hauer commit 22377ec5ea0a6d65a712465df33f7c2058ac32aa Author: Eric Bénard Date: Fri Oct 8 10:37:40 2010 +0200 cpuimx27: fix compile when ULPI is selected without this patch we get : arch/arm/mach-imx/built-in.o: In function `eukrea_cpuimx27_init': eukrea_mbimx27-baseboard.c:(.init.text+0x44c): undefined reference to `mxc_ulpi_access_ops' Signed-off-by: Eric Bénard Signed-off-by: Sascha Hauer commit c0bb5862a9076992e2cbeb5fa0d08c2ac3d4fbb0 Author: Tony Lindgren Date: Thu Oct 7 19:34:04 2010 +0100 ARM: 6435/1: Fix HWCAP_TLS flag for ARM11MPCore/Cortex-A9 Commit 14eff1812679c76564b775aa95cdd378965f6cfb added proper detection for ARM11MPCore/Cortex-A9 instead of detecting them as ARMv7. However, it was missing the HWCAP_TLS flags. HWCAP_TLS is needed if support for earlier ARMv6 is compiled into the same kernel. Without HWCAP_TLS flags the userspace won't work unless nosmp is specified: Kernel panic - not syncing: Attempted to kill init! CPU0: stopping ] (unwind_backtrace+0x0/0xec) from [] (do_IPI+0xfc/0x184) ] (do_IPI+0xfc/0x184) from [] (__irq_svc+0x9c/0x160) Exception stack(0xc0565f80 to 0xc0565fc8) 5f80: 00000001 c05772a0 00000000 00003a61 c0564000 c05cf500 c003603c c0578600 5fa0: 80033ef0 410fc091 0000001f 00000000 00000000 c0565fc8 c00b91f8 c0057cb4 5fc0: 20000013 ffffffff [] (__irq_svc+0x9c/0x160) from [] (default_idle+0x30/0x38) [] (default_idle+0x30/0x38) from [] (cpu_idle+0x9c/0xf8) [] (cpu_idle+0x9c/0xf8) from [] (start_kernel+0x2a4/0x300) [] (start_kernel+0x2a4/0x300) from [<80008084>] (0x80008084) Signed-off-by: Tony Lindgren Signed-off-by: Russell King commit 5c189208b606a85b4e97109af70d59f10a42fdfd Author: Anders Larsen Date: Thu Oct 7 20:44:15 2010 +0100 ARM: 6436/1: AT91: Fix power-saving in idle-mode on 926T processors According to Atmel, their 926T processors (AT91 post RM9200) requires 'Wait for Interrupt' mode be entered right after disabling the processor clock in order to minimise current consumption when idle, so do both provided we're not running on a 920T (an RM9200). Furthermore, get rid of the #ifndef CONFIG_DEBUG_KERNEL, since arch_idle() can be turned off completely with the kernel parameter 'nohlt'. Cc: Andrew Victor Signed-off-by: Anders Larsen Signed-off-by: Russell King commit b62be8ea9db4048112219ff6d6ce5f183179d4dc Author: Jin Dongming Date: Thu Aug 26 17:29:05 2010 +0900 x86, mce, therm_throt.c: Fix missing curly braces in error handling logic When the feature PTS is not supported by CPU, the sysfile package_power_limit_count for package should not be generated. This patch is used for fixing missing { and }. The patch is not complete as there are other error handling problems in this function - but that can wait until the merge window. Signed-off-by: Jin Dongming Reviewed-by: Fenghua Yu Acked-by: Jean Delvare Cc: Brown Len Cc: Guenter Roeck Cc: Hidetoshi Seto Cc: lm-sensors@lm-sensors.org LKML-Reference: <4C7625D1.4060201@np.css.fujitsu.com> Signed-off-by: Ingo Molnar commit 7cf4b482f06df0b590a9bc1561a5a81d67e0fe4c Author: Marek Szyprowski Date: Thu Oct 7 17:19:10 2010 +0900 ARM: SAMSUNG: Add a workaround for get_clock() for serial driver Serial drivers call get_clock() very early, before platform bus has been set up, this requires a special check to let them get a proper clock. Without this patch, a serial console is broken on S5PV310 and S5PC210 boards. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park [kgene.kim@samsung.com: fix coding-style] Signed-off-by: Kukjin Kim Cc: Ben Dooks commit 4341f9b38fe33aab51439ae59593e149a6f61d9f Author: SeungChull Suh Date: Sat Oct 2 12:48:12 2010 +0900 ARM: S5P: Bug fix on errors of build with CONFIG_PREEMPT_NONE This patch adds header into the below files for build with CONFIG_PREEMPT_NONE. arch/arm/mach-s5p6440/cpu.c arch/arm/mach-s5p6442/cpu.c arch/arm/mach-s5pc100/cpu.c arch/arm/mach-s5pv210/cpu.c Following is error message of in case of s5pv210_defconfig with CONFIG_PREEMPT_NONE. arch/arm/mach-s5pv210/cpu.c:91: error: implicit declaration of function 'need_resched' Signed-off-by: SeungChull Suh [kgene.kim@samsung.com: removed mach-s5p64x0/cpu.c] [kgene.kim@samsung.com: added fix mach-s5p6440/cpu.c] Signed-off-by: Kukjin Kim commit 1a95036465e6abdcb639f0d7bb1ec612663caf5b Author: Kukjin Kim Date: Thu Sep 9 08:56:15 2010 +0900 ARM: SAMSUNG: Fix build warnings because of unused codes This patch removes following unused codes for removing build warnings. arch/arm/plat-samsung/adc.c:438: warning: unused variable 'flags' arch/arm/mach-s5pv210/clock.c:176: warning: 's5pv210_clk_ip4_ctrl' defined but not used Signed-off-by: Kukjin Kim commit 6b0cd00bc396daf5c2dcf17a8d82055335341f46 Merge: c8d86d8 47f43e7 Author: Linus Torvalds Date: Thu Oct 7 13:59:32 2010 -0700 Merge branch 'hwpoison-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6 * 'hwpoison-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6: HWPOISON: Stop shrinking at right page count HWPOISON: Report correct address granuality for AO huge page errors HWPOISON: Copy si_addr_lsb to user page-types.c: fix name of unpoison interface commit c8d86d8ac439ef6c9364bf0ba3a05a3f9a8e0dea Merge: 74de82e 430c62f Author: Linus Torvalds Date: Thu Oct 7 13:54:56 2010 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: elevator: fix oops on early call to elevator_change() commit 74de82ed1e49d9c7af84c3beb3759316854f54ed Merge: dda9cd9 5c04f55 Author: Linus Torvalds Date: Thu Oct 7 13:50:48 2010 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: check return code of read_sb_page md/raid1: minor bio initialisation improvements. md/raid1: avoid overflow in raid1 resync when bitmap is in use. commit dda9cd9fb30dfe6f2a51a394c18aef7c401b497d Merge: afe1474 dab8dcf Author: Linus Torvalds Date: Thu Oct 7 13:47:20 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm: don't drop handle reference on unload drm/ttm: Fix two race conditions + fix busy codepaths commit afe147466c8f22a69eb470ab504608a9f4ae3345 Merge: 5710c2b f6cd378 Author: Linus Torvalds Date: Thu Oct 7 13:46:33 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: wacom - fix runtime PM related deadlock Input: joydev - fix JSIOCSAXMAP ioctl Input: uinput - setup MT usage during device creation commit 5710c2b275b3c0434f0de8f4ce6721aaf4c2a100 Merge: a4099ae 081003f Author: Linus Torvalds Date: Thu Oct 7 13:45:26 2010 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: properly account for reclaimed inodes commit a4099ae79d04ecf31bd0fc5aa4c1472b6fa7993a Merge: 5672bc8 cc6e853 Author: Linus Torvalds Date: Thu Oct 7 13:45:00 2010 -0700 Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (37 commits) V4L/DVB: v4l: radio: si470x: fix unneeded free_irq() call V4L/DVB: v4l: videobuf: prevent passing a NULL to dma_free_coherent() V4L/DVB: ir-core: Fix null dereferences in the protocols sysfs interface V4L/DVB: v4l: s5p-fimc: Fix 3-planar formats handling and pixel offset error on S5PV210 SoCs V4L/DVB: v4l: s5p-fimc: Fix return value on probe() failure V4L/DVB: uvcvideo: Restrict frame rates for Chicony CNF7129 webcam V4L/DVB: uvcvideo: Fix support for Medion Akoya All-in-one PC integrated webcam V4L/DVB: ivtvfb: prevent reading uninitialized stack memory V4L/DVB: cx25840: Fix typo in volume control initialization: 65335 vs. 65535 V4L/DVB: v4l: mem2mem_testdev: add missing release for video_device V4L/DVB: v4l: mem2mem_testdev: fix errorenous comparison V4L/DVB: mt9v022.c: Fixed compilation warning V4L/DVB: mt9m111: added current colorspace at g_fmt V4L/DVB: mt9m111: cropcap and s_crop check if type is VIDEO_CAPTURE V4L/DVB: mx2_camera: fix a race causing NULL dereference V4L/DVB: tm6000: bugfix data handling V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images V4L/DVB: videobuf-dma-sg: set correct size in last sg element V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0) V4L/DVB: dvb: fix smscore_getbuffer() logic ... commit 5672bc8181b189c05ccc29c692491500682a1b49 Merge: 27b3d80 925bb9c Author: Linus Torvalds Date: Thu Oct 7 13:44:30 2010 -0700 Merge branch 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: of/i2c: Fix module load order issue caused by of_i2c.c i2c: Fix checks which cause legacy suspend to never get called i2c-pca: Fix waitforcompletion() return value i2c: Fix for suspend/resume issue i2c: Remove obsolete cleanup for clientdata commit 27b3d80a7b6adcf069b5e869e4efcc3a79f88a91 Author: Eric Dumazet Date: Thu Oct 7 12:59:29 2010 -0700 sysctl: fix min/max handling in __do_proc_doulongvec_minmax() When proc_doulongvec_minmax() is used with an array of longs, and no min/max check requested (.extra1 or .extra2 being NULL), we dereference a NULL pointer for the second element of the array. Noticed while doing some changes in network stack for the "16TB problem" Fix is to not change min & max pointers in __do_proc_doulongvec_minmax(), so that all elements of the vector share an unique min/max limit, like proc_dointvec_minmax(). [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Eric Dumazet Cc: "Eric W. Biederman" Cc: Americo Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aaac7d9e0a0630e79069341a37978b39e4bca704 Author: Kyungmin Park Date: Thu Oct 7 12:59:28 2010 -0700 MAINTAINERS: add Samsung S5P series FIMC maintainers Add Samsung S5P series FIMC(Camera Interface) maintainers. Signed-off-by: Kyungmin Park Cc: Kyungmin Park Cc: Sylwester Nawrocki Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 880b0e2649b55ccd73b304dedb69aa1221a88f9c Author: Andrew Morton Date: Thu Oct 7 12:59:28 2010 -0700 MAINTAINERS: Haavard has moved Cc: Haavard Skinnemoen Cc: Hans-Christian Egtvedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ad4ca5f4b70236dab5e457ff6567d36f75d2e7c5 Author: Kirill A. Shutemov Date: Thu Oct 7 12:59:27 2010 -0700 memcg: fix thresholds with use_hierarchy == 1 We need to check parent's thresholds if parent has use_hierarchy == 1 to be sure that parent's threshold events will be triggered even if parent itself is not active (no MEM_CGROUP_EVENTS). Signed-off-by: Kirill A. Shutemov Reviewed-by: Daisuke Nishimura Acked-by: KAMEZAWA Hiroyuki Acked-by: Balbir Singh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f241e6607b5a5aefa23c652dbe947b7465633984 Author: Robin Holt Date: Thu Oct 7 12:59:26 2010 -0700 mm: alloc_large_system_hash() printk overflow on 16TB boot During boot of a 16TB system, the following is printed: Dentry cache hash table entries: -2147483648 (order: 22, 17179869184 bytes) Signed-off-by: Robin Holt Reviewed-by: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4efe7f51be508a13965f163006dcb32b38a914a3 Author: John W. Linville Date: Thu Oct 7 11:35:40 2010 -0400 Revert "mac80211: use netif_receive_skb in ieee80211_tx_status callpath" This reverts commit 5ed3bc7288487bd4f891f420a07319e0b538b4fe. It turns-out that not all drivers are calling ieee80211_tx_status from a compatible context. Revert this for now and try again later... Signed-off-by: John W. Linville commit d91f2438d881514e4a923fd786dbd94b764a9440 Author: Sage Weil Date: Wed Sep 22 11:16:00 2010 -0700 ceph: update issue_seq on cap grant We need to update the issue_seq on any grant operation, be it via an MDS reply or a separate grant message. The update in the grant path was missing. This broke cap release for inodes in which the MDS sent an explicit grant message that was not soon after followed by a successful MDS reply on the same inode. Also fix the signedness on seq locals. Signed-off-by: Sage Weil commit 21b559de56695d36b3f0819b7e2454737db254f8 Author: Greg Farnum Date: Wed Oct 6 15:46:30 2010 -0700 ceph: send cap release message early on failed revoke. If an MDS tries to revoke caps that we don't have, we want to send releases early since they probably contain the caps message the MDS is looking for. Previously, we only sent the messages if we didn't have the inode either. But in a multi-mds system we can retain the inode after dropping all caps for a single MDS. Signed-off-by: Greg Farnum Signed-off-by: Sage Weil commit bba0cd0e3d97472855840af817b766e3f632a501 Author: Aneesh Kumar K.V Date: Tue Oct 5 16:03:42 2010 +0530 ceph: Update max_len with minimum required size encode_fh on error should update max_len with minimum required size, so that caller can redo the call with the reallocated buffer. This is required with open by handle patch series Signed-off-by: Aneesh Kumar K.V Signed-off-by: Sage Weil commit 92923dcbfcad107b0e0469f579a2455729ccf10e Author: Aneesh Kumar K.V Date: Tue Oct 5 16:03:41 2010 +0530 ceph: Fix return value of encode_fh function encode_fh function should return 255 on error as done by other file system to indicate EOVERFLOW. Also max_len is in sizeof(u32) units and not in bytes. Signed-off-by: Aneesh Kumar K.V Signed-off-by: Sage Weil commit 6bc18876ba01fd4a077db6e1ed27201e4bda8864 Author: Sage Weil Date: Mon Sep 27 10:18:52 2010 -0700 ceph: avoid null deref in osd request error path If we interrupt an osd request, we call __cancel_request, but it wasn't verifying that req->r_osd was non-NULL before dereferencing it. This could cause a crash if osds were flapping and we aborted a request on said osd. Reported-by: Henry C Chang Signed-off-by: Sage Weil commit 936aeb5c4a9fa799abd7d630a94223acedcaad50 Author: Henry C Chang Date: Wed Sep 22 20:21:17 2010 -0700 ceph: fix list_add usage on unsafe_writes list Fix argument order. Signed-off-by: Henry C Chang Signed-off-by: Sage Weil commit fb3dbece264a50ab4373f3af0bbbd9175d3ad4d7 Merge: 12e9447 eaa71b3 Author: David S. Miller Date: Thu Oct 7 00:59:39 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-2.6 commit 47f43e7efadacc627f325aba64c6a547de0926db Author: Andi Kleen Date: Tue Sep 28 07:37:55 2010 +0200 HWPOISON: Stop shrinking at right page count When we call the slab shrinker to free a page we need to stop at page count one because the caller always holds a single reference, not zero. This avoids useless looping over slab shrinkers and freeing too much memory. Reviewed-by: Wu Fengguang Signed-off-by: Andi Kleen commit 0d9ee6a2d4a6e92c49e6fa9469e5731d21ee203e Author: Andi Kleen Date: Mon Sep 27 22:03:33 2010 +0200 HWPOISON: Report correct address granuality for AO huge page errors The SIGBUS user space signalling is supposed to report the address granuality of a corruption. Pass this information correctly for huge pages by querying the hpage order. Reviewed-by: Naoya Horiguchi Reviewed-by: Wu Fengguang Signed-off-by: Andi Kleen commit a337fdac7a5622d1e6547f4b476c14dfe5a2c892 Author: Andi Kleen Date: Mon Sep 27 20:32:19 2010 +0200 HWPOISON: Copy si_addr_lsb to user The original hwpoison code added a new siginfo field si_addr_lsb to pass the granuality of the fault address to user space. Unfortunately this field was never copied to user space. Fix this here. I added explicit checks for the MCEERR codes to avoid having to patch all potential callers to initialize the field. Signed-off-by: Andi Kleen commit 67159813127309c1a65d86e40fa0368241fa668c Author: Naoya Horiguchi Date: Wed Sep 8 10:19:41 2010 +0900 page-types.c: fix name of unpoison interface The page-types utility still uses an out of date name for the unpoison interface: debugfs:hwpoison/renew-pfn This patch renames and fixes it. Signed-off-by: Naoya Horiguchi Acked-by: Wu Fengguang Signed-off-by: Andi Kleen commit 430c62fb2948d964cf8dc7f3e2f69623c04ef62f Author: Jens Axboe Date: Thu Oct 7 09:35:16 2010 +0200 elevator: fix oops on early call to elevator_change() 2.6.36 introduces an API for drivers to switch the IO scheduler instead of manually calling the elevator exit and init functions. This API was added since q->elevator must be cleared in between those two calls. And since we already have this functionality directly from use by the sysfs interface to switch schedulers online, it was prudent to reuse it internally too. But this API needs the queue to be in a fully initialized state before it is called, or it will attempt to unregister elevator kobjects before they have been added. This results in an oops like this: BUG: unable to handle kernel NULL pointer dereference at 0000000000000051 IP: [] sysfs_create_dir+0x2e/0xc0 PGD 47ddfc067 PUD 47c6a1067 PMD 0 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/0000:04:00.1/irq CPU 2 Modules linked in: t(+) loop hid_apple usbhid ahci ehci_hcd uhci_hcd libahci usbcore nls_base igb Pid: 7319, comm: modprobe Not tainted 2.6.36-rc6+ #132 QSSC-S4R/QSSC-S4R RIP: 0010:[] [] sysfs_create_dir+0x2e/0xc0 RSP: 0018:ffff88027da25d08 EFLAGS: 00010246 RAX: ffff88047c68c528 RBX: 00000000fffffffe RCX: 0000000000000000 RDX: 000000000000002f RSI: 000000000000002f RDI: ffff88047e196c88 RBP: ffff88027da25d38 R08: 0000000000000000 R09: d84156c5635688c0 R10: d84156c5635688c0 R11: 0000000000000000 R12: ffff88047e196c88 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88047c68c528 FS: 00007fcb0b26f6e0(0000) GS:ffff880287400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000051 CR3: 000000047e76e000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 7319, threadinfo ffff88027da24000, task ffff88027d377090) Stack: ffff88027da25d58 ffff88047c68c528 00000000fffffffe ffff88047e196c88 <0> ffff88047c68c528 ffff88047e05bd90 ffff88027da25d78 ffffffff8123fb77 <0> ffff88047e05bd90 0000000000000000 ffff88047e196c88 ffff88047c68c528 Call Trace: [] kobject_add_internal+0xe7/0x1f0 [] kobject_add_varg+0x38/0x60 [] kobject_add+0x69/0x90 [] ? sysfs_remove_dir+0x20/0xa0 [] ? sub_preempt_count+0x9d/0xe0 [] ? _raw_spin_unlock+0x30/0x50 [] ? sysfs_remove_dir+0x20/0xa0 [] ? sysfs_remove_dir+0x34/0xa0 [] elv_register_queue+0x34/0xa0 [] elevator_change+0xfd/0x250 [] ? t_init+0x0/0x361 [t] [] ? t_init+0x0/0x361 [t] [] t_init+0xa8/0x361 [t] [] do_one_initcall+0x3e/0x170 [] sys_init_module+0xbd/0x220 [] system_call_fastpath+0x16/0x1b Code: e5 41 56 41 55 41 54 49 89 fc 53 48 83 ec 10 48 85 ff 74 52 48 8b 47 18 49 c7 c5 00 46 61 81 48 85 c0 74 04 4c 8b 68 30 45 31 f6 <41> 80 7d 51 00 74 0e 49 8b 44 24 28 4c 89 e7 ff 50 20 49 89 c6 RIP [] sysfs_create_dir+0x2e/0xc0 RSP CR2: 0000000000000051 ---[ end trace a6541d3bf07945df ]--- Fix this by adding a registered bit to the elevator queue, which is set when the sysfs kobjects have been registered. Signed-off-by: Jens Axboe commit dab8dcfa3c8e3b021a138bee7c17791b4991ba55 Author: Dave Airlie Date: Thu Oct 7 14:01:17 2010 +1000 drm: don't drop handle reference on unload since the handle references are all tied to a file_priv, and when it disappears all the handle refs go with it. The fbcon ones we'd only notice on unload, but the nouveau notifier one would would happen on reboot. nouveau: Reported-by: Marc Dionne nouveau: Tested-by: Marc Dionne i915 unload: Reported-by: Keith Packard Acked-by: Ben Skeggs Signed-off-by: Dave Airlie commit 081003fff467ea0e727f66d5d435b4f473a789b3 Author: Johannes Weiner Date: Fri Oct 1 07:43:54 2010 +0000 xfs: properly account for reclaimed inodes When marking an inode reclaimable, a per-AG counter is increased, the inode is tagged reclaimable in its per-AG tree, and, when this is the first reclaimable inode in the AG, the AG entry in the per-mount tree is also tagged. When an inode is finally reclaimed, however, it is only deleted from the per-AG tree. Neither the counter is decreased, nor is the parent tree's AG entry untagged properly. Since the tags in the per-mount tree are not cleared, the inode shrinker iterates over all AGs that have had reclaimable inodes at one point in time. The counters on the other hand signal an increasing amount of slab objects to reclaim. Since "70e60ce xfs: convert inode shrinker to per-filesystem context" this is not a real issue anymore because the shrinker bails out after one iteration. But the problem was observable on a machine running v2.6.34, where the reclaimable work increased and each process going into direct reclaim eventually got stuck on the xfs inode shrinking path, trying to scan several million objects. Fix this by properly unwinding the reclaimable-state tracking of an inode when it is reclaimed. Signed-off-by: Johannes Weiner Cc: stable@kernel.org Reviewed-by: Dave Chinner Signed-off-by: Alex Elder commit 12e94471b2be5ef9b55b10004a3a2cd819490036 Merge: 7931506 cb655d0 Author: David S. Miller Date: Wed Oct 6 19:11:17 2010 -0700 Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 commit 5c04f5512f8134c75cd36e5b0354e10e330f4e6e Author: Vasiliy Kulikov Date: Fri Oct 1 14:18:12 2010 -0700 md: check return code of read_sb_page Function read_sb_page may return ERR_PTR(...). Check for it. Signed-off-by: Vasiliy Kulikov Cc: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: NeilBrown commit db8d9d3591f77cc6b66248b2cdfa1c43deee5ec9 Author: NeilBrown Date: Thu Oct 7 12:00:50 2010 +1100 md/raid1: minor bio initialisation improvements. When performing a resync we pre-allocate some bios and repeatedly use them. This requires us to re-initialise them each time. One field (bi_comp_cpu) and some flags weren't being initiaised reliably. Signed-off-by: NeilBrown commit 7571ae887d3b96d8e7ce63d43828866c6a91cdc6 Author: NeilBrown Date: Thu Oct 7 11:54:46 2010 +1100 md/raid1: avoid overflow in raid1 resync when bitmap is in use. bitmap_start_sync returns - via a pass-by-reference variable - the number of sectors before we need to check with the bitmap again. Since commit ef4256733506f245 this number can be substantially larger, 2^27 is a common value. Unfortunately it is an 'int' and so when raid1.c:sync_request shifts it 9 places to the left it becomes 0. This results in a zero-length read which the scsi layer justifiably complains about. This patch just removes the shift so the common case becomes safe with a trivially-correct patch. In the next merge window we will convert this 'int' to a 'sector_t' Reported-by: "George Spelvin" Signed-off-by: NeilBrown commit 44271488b91c9eecf249e075a1805dd887e222d2 Author: Johannes Berg Date: Tue Oct 5 21:40:33 2010 +0200 mac80211: delete AddBA response timer We never delete the addBA response timer, which is typically fine, but if the station it belongs to is deleted very quickly after starting the BA session, before the peer had a chance to reply, the timer may fire after the station struct has been freed already. Therefore, we need to delete the timer in a suitable spot -- best when the session is being stopped (which will happen even then) in which case the delete will be a no-op most of the time. I've reproduced the scenario and tested the fix. This fixes the crash reported at http://mid.gmane.org/4CAB6F96.6090701@candelatech.com Cc: stable@kernel.org Reported-by: Ben Greear Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 918df629d6a558ab9eb53350493f618812239a4c Author: Felix Fietkau Date: Sun Oct 3 19:07:19 2010 +0200 ath9k_hw: fix regression in ANI listen time calculation wireless-testing commit 37e5bf6535a4d697fb9fa6f268a8354a612cbc00 Author: Luis R. Rodriguez Date: Sat Jun 12 00:33:40 2010 -0400 ath9k_hw: fix clock rate calculations for ANI This commit accidentally broke clock rate calculation by doubling the calculated clock rate Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville commit 79315068f4560f3f7bd6e9790190dcb43059770c Author: Eric Dumazet Date: Mon Oct 4 22:42:08 2010 +0000 caif: fix two caif_connect() bugs caif_connect() might dereference a netdevice after dev_put() it. It also doesnt check dev_get_by_index() return value and could dereference a NULL pointer. Fix it, using RCU to avoid taking a reference. Signed-off-by: Eric Dumazet CC: Sjur Braendeland Signed-off-by: David S. Miller commit 27e6f065df132b5270014d3285889b15185e9da9 Author: Neil Horman Date: Tue Oct 5 03:39:21 2010 +0000 bonding: fix WARN_ON when writing to bond_master sysfs file Fix a WARN_ON failure in bond_masters sysfs file Got a report of this warning recently bonding: bond0 is being created... ------------[ cut here ]------------ WARNING: at fs/proc/generic.c:590 proc_register+0x14d/0x185() Hardware name: ProLiant BL465c G1 proc_dir_entry 'bonding/bond0' already registered Modules linked in: bonding ipv6 tg3 bnx2 shpchp amd64_edac_mod edac_core ipmi_si ipmi_msghandler serio_raw i2c_piix4 k8temp edac_mce_amd hpwdt microcode hpsa cc iss radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core [last unloaded: scsi_wai t_scan] Pid: 935, comm: ifup-eth Not tainted 2.6.33.5-124.fc13.x86_64 #1 Call Trace: [] warn_slowpath_common+0x77/0x8f [] warn_slowpath_fmt+0x3c/0x3e [] proc_register+0x14d/0x185 [] proc_create_data+0x87/0xa1 [] bond_create_proc_entry+0x55/0x95 [bonding] [] bond_init+0x95/0xd0 [bonding] [] register_netdevice+0xdd/0x29e [] bond_create+0x8e/0xb8 [bonding] [] bonding_store_bonds+0xb3/0x1c1 [bonding] [] class_attr_store+0x27/0x29 [] sysfs_write_file+0x10f/0x14b [] vfs_write+0xa9/0x106 [] sys_write+0x45/0x69 [] system_call_fastpath+0x16/0x1b ---[ end trace a677c3f7f8b16b1e ]--- bonding: Bond creation failed. It happens because a user space writer to bond_master can try to register an already existing bond interface name. Fix it by teaching bond_create to check for the existance of devices with that name first in cases where a non-NULL name parameter has been passed in Signed-off-by: Neil Horman Signed-off-by: David S. Miller commit cf8eda3ef0039911557a3c11f1f18f9ce2d3c323 Author: Mark Brown Date: Tue Oct 5 19:31:40 2010 -0700 ASoC: Update links for Wolfson MAINTAINERS entry We also have a separate git for audio, and a generic page for all of our drivers not just the PMICs. Signed-off-by: Mark Brown commit 645a659925ed6cba8faaabd844c2ebb9bda6fb0d Author: Mark Brown Date: Tue Oct 5 19:27:56 2010 -0700 ASoC: Add Dimitris Papastamos to Wolfson maintainers Add Dimitris Papastamos as a contact for Wolfson device drivers. Signed-off-by: Mark Brown Signed-off-by: Dimitris Papastamos commit 1df6a2ebd75067aefbdf07482bf8e3d0584e04ee Author: Thomas Hellstrom Date: Thu Sep 30 12:36:45 2010 +0200 drm/ttm: Fix two race conditions + fix busy codepaths This fixes a race pointed out by Dave Airlie where we don't take a buffer object about to be destroyed off the LRU lists properly. It also fixes a rare case where a buffer object could be destroyed in the middle of an accelerated eviction. The patch also adds a utility function that can be used to prematurely release GPU memory space usage of an object waiting to be destroyed. For example during eviction or swapout. The above mentioned commit didn't queue the buffer on the delayed destroy list under some rare circumstances. It also didn't completely honor the remove_all parameter. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=615505 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=591061 Signed-off-by: Thomas Hellstrom Signed-off-by: Dave Airlie commit 392bd0cb000d4aac9e88e4f50823db85e7220688 Author: Stanislaw Gruszka Date: Tue Oct 5 15:11:40 2010 -0700 skge: add quirk to limit DMA Skge devices installed on some Gigabyte motherboards are not able to perform 64 dma correctly due to board PCI implementation, so limit DMA to 32bit if such boards are detected. Bug was reported here: https://bugzilla.redhat.com/show_bug.cgi?id=447489 Signed-off-by: Stanislaw Gruszka Tested-by: Luya Tshimbalanga Signed-off-by: David S. Miller commit 0d164401354011e771c850ba1f04a6ae883f82ab Author: Jeff Kirsher Date: Tue Oct 5 01:15:17 2010 +0000 MAINTAINERS: update Intel LAN Ethernet info - Add ixgbevf and docs files to the maintainers file Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit da8c01c4502adc1e7209a14626d583de7ca452fd Author: Jeff Kirsher Date: Tue Oct 5 01:17:27 2010 +0000 e1000e.txt: Add e1000e documentation Adds documentation for the e1000e networking driver. Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 2bff89c3f340776398bfaf6c94404ffcd09f6e77 Author: Jeff Kirsher Date: Tue Oct 5 01:17:05 2010 +0000 e1000.txt: Update e1000 documentation Updated the e1000 networking driver documentation. Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit c4b8c01112a16f3cb8a4bffb11b89f2df079f904 Author: Jeff Kirsher Date: Tue Oct 5 01:16:44 2010 +0000 ixgbevf.txt: Update ixgbevf documentation Update the documentation for the ixgbevf (ixgbe virtual function driver). Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit d24a9da573444ab4aff38af2f4a0da07408ff491 Author: Matthew Garrett Date: Tue Oct 5 14:54:06 2010 -0400 IPS driver: Fix limit clamping when reducing CPU power Values here are in internal units rather than Watts, so we shouldn't perform any conversion. Signed-off-by: Matthew Garrett commit 96f3823f537088c13735cfdfbf284436c802352a Author: Jesse Barnes Date: Tue Oct 5 14:50:59 2010 -0400 [PATCH 2/2] IPS driver: disable CPU turbo The undocumented interface we're using for reading CPU power seems to be overreporting power. Until we figure out how to correct it, disable CPU turbo and power reporting to be safe. This will keep the CPU within default limits and still allow us to increase GPU frequency as needed. Signed-off-by: Jesse Barnes Signed-off-by: Matthew Garrett commit 4fd07ac00d87b942cc8d8f30a27192fea2fc4ab2 Author: Jesse Barnes Date: Tue Oct 5 11:26:22 2010 -0700 IPS driver: apply BIOS provided CPU limit if different from default The BIOS may hand us a lower CPU power limit than the default for a given SKU. We should use it in case the platform isn't designed to dissapate the full TDP of a given part. Signed-off-by: Jesse Barnes Signed-off-by: Matthew Garrett commit 070c0ee1ef9f5550cac9247190f0289349f28c01 Author: Andy Whitcroft Date: Tue Oct 5 09:48:42 2010 +0100 intel_ips -- ensure we do not enable gpu turbo mode without driver linkage Both when polling the current turbo status (in poll_turbo_status mode) and when handling thermal events (in ips_irq_handler) the current status of GPU turbo is updated to match the hardware status. However if during driver initialisation we were unable aquire linkage to the i915 driver enabling GPU turbo will lead to an oops on the first attempt to determine GPU busy status. Ensure that we do not enable GPU turbo unless we have driver linkage. BugLink: http://bugs.launchpad.net/bugs/632430 Cc: stable@kernel.org Signed-off-by: Andy Whitcroft Signed-off-by: Matthew Garrett commit a8c096adbd2b55942ff13c8bbc573a7551768003 Author: Tim Gardner Date: Tue Sep 28 14:58:15 2010 -0600 intel_ips: Print MCP limit exceeded values. Print some interesting values when MCP limits are exceeded. Signed-off-by: Tim Gardner Cc: Matthew Garrett Signed-off-by: Matthew Garrett commit eceab272fb895148f6293b5c0644fc2dd36d3aff Author: Jesse Barnes Date: Thu Sep 23 23:49:29 2010 +0200 IPS driver: verify BIOS provided limits They're optional. If not present or sane, we should use the CPU defaults. Signed-off-by: Jesse Barnes Signed-off-by: Matthew Garrett commit 354aeeb1ca8f82ea133ede21987034addc75057a Author: Jesse Barnes Date: Thu Sep 23 23:49:28 2010 +0200 IPS driver: don't toggle CPU turbo on unsupported CPUs If the CPU doesn't support turbo, don't try to enable/disable it. http://bugzilla.kernel.org/show_bug.cgi?id=18742 Signed-off-by: Jesse Barnes Signed-off-by: Matthew Garrett commit a7abda8d721359363d679c5f2de964f29419568c Author: minskey guo Date: Fri Sep 17 14:03:27 2010 +0800 NULL pointer might be used in ips_monitor() The patch is to create ips_adjust thread before ips_monitor begins to run because the latter will kthread_stop() or wake up the former via ips->adjust pointer. Without this change, it is possible that ips->adjust is NULL when kthread_stop() or wake_up_process() is called in ips_monitor(). Signed-off-by: minskey guo Acked-by: Jesse Barnes Signed-off-by: Matthew Garrett commit fed522f7ea780d195d5d3e55df95fee520136e17 Author: minskey guo Date: Fri Sep 17 14:03:15 2010 +0800 Release symbol on error-handling path of ips_get_i915_syms() In ips_get_i915_syms(), the symbol i915_gpu_busy() is not released when error occurs. Signed-off-by: minskey guo Acked-by: Jesse Barnes Signed-off-by: Matthew Garrett commit c21eae4f7c38db0e4693fb4cb24fb42fb83d8c15 Author: minskey guo Date: Fri Sep 17 14:03:01 2010 +0800 old_cpu_power is wrongly divided by 65535 in ips_monitor() The variable old_cpu_power is used to save the value of THM_CEC register. In get_cpu_power(), it will be divided by 65535. Signed-off-by: minskey guo Acked-by: Jesse Barnes Signed-off-by: Matthew Garrett commit 6230d18cc7c4c68b7a38ea73bf5910e7652e5b21 Author: minskey guo Date: Fri Sep 17 14:02:37 2010 +0800 seqno mask of THM_ITV register is 16bit The mask of sequence number in THM_ITV register is 16bit width instead of 8bit. Signed-off-by: minskey guo Acked-by: Jesse Barnes Signed-off-by: Matthew Garrett commit 0fa035e52373386381fcdfbd506e32eac0c662f0 Author: Hari Kanigeri Date: Fri Aug 20 13:50:18 2010 +0000 omap: iommu-load cam register before flushing the entry The flush_iotlb_page is not loading the cam register before flushing the cam entry. This causes wrong entry to be flushed out from the TLB, and if the entry happens to be a locked TLB entry it would lead to MMU faults. The fix is to load the cam register with the address to be flushed before flushing the TLB entry. Signed-off-by: Hari Kanigeri Acked-by: Hiroshi DOYU Signed-off-by: Tony Lindgren commit cdaf9a2f280b25dd2fb1e04da5d3899411766e1b Author: Russell King Date: Tue Oct 5 11:29:28 2010 +0100 ARM: fix section mismatch warnings in Versatile Express WARNING: vmlinux.o(.text+0xbf30): Section mismatch in reference from the function v2m_timer_init() to the function .init.text:sp804_clocksource_init() The function v2m_timer_init() references the function __init sp804_clocksource_init(). This is often because v2m_timer_init lacks a __init annotation or the annotation of sp804_clocksource_init is wrong. WARNING: vmlinux.o(.text+0xbf3c): Section mismatch in reference from the function v2m_timer_init() to the function .init.text:sp804_clockevents_init() The function v2m_timer_init() references the function __init sp804_clockevents_init(). This is often because v2m_timer_init lacks a __init annotation or the annotation of sp804_clockevents_init is wrong. WARNING: vmlinux.o(.text+0xc524): Section mismatch in reference from the function ct_ca9x4_init() to the function .init.text:l2x0_init() The function ct_ca9x4_init() references the function __init l2x0_init(). This is often because ct_ca9x4_init lacks a __init annotation or the annotation of l2x0_init is wrong. WARNING: vmlinux.o(.text+0xc530): Section mismatch in reference from the function ct_ca9x4_init() to the function .init.text:clkdev_add_table() The function ct_ca9x4_init() references the function __init clkdev_add_table(). This is often because ct_ca9x4_init lacks a __init annotation or the annotation of clkdev_add_table is wrong. WARNING: vmlinux.o(.text+0xc578): Section mismatch in reference from the function ct_ca9x4_init() to the (unknown reference) .init.data:(unknown) The function ct_ca9x4_init() references the (unknown reference) __initdata (unknown). This is often because ct_ca9x4_init lacks a __initdata annotation or the annotation of (unknown) is wrong. Fix these by making ct_ca9x4_init() and v2m_timer_init() both __init. Signed-off-by: Russell King commit 4e18b3edf71f5d4ad653e3c2ff6560878e965f96 Author: Dan Carpenter Date: Mon Oct 4 02:28:36 2010 +0000 cls_u32: signedness bug skb_headroom() is unsigned so "skb_headroom(skb) + toff" is also unsigned and can't be less than zero. This test was added in 66d50d25: "u32: negative offset fix" It was supposed to fix a regression. Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller commit f6cd378372bff06093d72f978c0150eeed3ea201 Author: Dmitry Torokhov Date: Mon Oct 4 21:46:11 2010 -0700 Input: wacom - fix runtime PM related deadlock When runtime PM is enabled by default for input devices, X hangs in wacom open: [] mutex_lock+0x1a/0x40 [] wacom_resume+0x3b/0x90 [wacom] [] usb_resume_interface+0xd2/0x190 [] usb_resume_both+0x6d/0x110 [] usb_runtime_resume+0x24/0x40 [] __pm_runtime_resume+0x26f/0x450 [] __pm_runtime_resume+0x1da/0x450 [] pm_runtime_resume+0x2a/0x50 [] usb_autopm_get_interface+0x26/0x60 [] wacom_open+0x36/0x90 [wacom] wacom_open() takes wacom->lock and calls usb_autopm_get_interface(), which in turn calls wacom_resume() which tries to acquire the lock again. The fix is to call usb_autopm_get_interface() first, before we take the lock. Since we do not do usb_autopm_put_interface() until wacom_close() is called runtime PM is effectively disabled for the driver, however changing it now would risk regressions so the complete fix will have to wait till the next merge window. Reported-by: Jiri Slaby Acked-by: Oliver Neukum Signed-off-by: Dmitry Torokhov commit eaa71b318c5ed0cd1ac3182a533471dc5edf372d Author: Gustavo F. Padovan Date: Mon Oct 4 19:28:52 2010 -0300 Bluetooth: Disallow to change L2CAP_OPTIONS values when connected L2CAP doesn't permit change like MTU, FCS, TxWindow values while the connection is alive, we can only set that before the connection/configuration process. That can lead to bugs in the L2CAP operation. Signed-off-by: Gustavo F. Padovan commit ccdf2e1bca8a45eaf89eb142dbed3551886413fe Author: Will Deacon Date: Mon Sep 27 18:12:12 2010 +0100 ARM: 6412/1: kprobes-decode: add support for MOVW instruction The MOVW instruction moves a 16-bit immediate into the bottom halfword of the destination register. This patch ensures that kprobes leaves the 16-bit immediate intact, rather than assume a 12-bit immediate and mask out the upper 4 bits. Acked-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit 7f58217bb6d39edac68ae0988cdb96a520ad916f Author: Santosh Shilimkar Date: Thu Sep 30 09:02:17 2010 +0100 ARM: 6419/1: mmu: Fix MT_MEMORY and MT_MEMORY_NONCACHED pte flags The commit f1a2481c0 sets up the default flags for MT_MEMORY and MT_MEMORY_NONCACHED memory types. L_PTE_USER flag is wrongly set as default for these entries so remove it. Also adding the 'L_PTE_WRITE' flag so that these pages become read-write instead of just being read-only [this stops them being exposed to userspace, which is the main concern here --rmk] Reported-by: Catalin Marinas Signed-off-by: Santosh Shilimkar Acked-by: Catalin Marinas Signed-off-by: Russell King commit 475d92fc6e72cd123dc5dbb9e70cdb80b0cfdf2d Author: Will Deacon Date: Tue Sep 28 14:02:02 2010 +0100 ARM: 6416/1: errata: faulty hazard checking in the Store Buffer may lead to data corruption On the r2p0, r2p1 and r2p2 versions of the Cortex-A9, data corruption can occur under very rare conditions due to a store buffer optimisation. This workaround sets a bit in the diagnostic register of the Cortex-A9, disabling the optimisation and preventing the problem from occurring. Acked-by: Catalin Marinas Signed-off-by: Will Deacon Signed-off-by: Russell King commit ff5ff6060bf880aac233e68dd666cbe9e39ec620 Author: Arnaud Lacombe Date: Sun Sep 26 16:22:03 2010 -0400 kconfig: delay symbol direct dependency initialization This fixes the use-after-free and associated crash in kconfig introduced in commit 246cf9c26bf11f2bffbecea6e5bd222eee7b1df8. Signed-off-by: Arnaud Lacombe Acked-by: Catalin Marinas Signed-off-by: Michal Marek commit 51e97a12bef19b7e43199fc153cf9bd5f2140362 Author: Dan Rosenberg Date: Fri Oct 1 11:51:47 2010 +0000 sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids array and attempts to ensure that only a supported hmac entry is returned. The current code fails to do this properly - if the last id in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the id integer remains set after exiting the loop, and the address of an out-of-bounds entry will be returned and subsequently used in the parent function, causing potentially ugly memory corruption. This patch resets the id integer to 0 on encountering an invalid id so that NULL will be returned after finishing the loop if no valid ids are found. Signed-off-by: Dan Rosenberg Acked-by: Vlad Yasevich Signed-off-by: David S. Miller commit d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa Author: Dan Rosenberg Date: Fri Oct 1 11:16:58 2010 +0000 sctp: prevent reading out-of-bounds memory Two user-controlled allocations in SCTP are subsequently dereferenced as sockaddr structs, without checking if the dereferenced struct members fall beyond the end of the allocated chunk. There doesn't appear to be any information leakage here based on how these members are used and additional checking, but it's still worth fixing. [akpm@linux-foundation.org: remove unfashionable newlines, fix gmail tab->space conversion] Signed-off-by: Dan Rosenberg Acked-by: Vlad Yasevich Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 5b7c84066733c5dfb0e4016d939757b38de189e4 Author: David Stevens Date: Thu Sep 30 14:29:40 2010 +0000 ipv4: correct IGMP behavior on v3 query during v2-compatibility mode A recent patch to allow IGMPv2 responses to IGMPv3 queries bypasses length checks for valid query lengths, incorrectly resets the v2_seen timer, and does not support IGMPv1. The following patch responds with a v2 report as required by IGMPv2 while correcting the other problems introduced by the patch. Signed-Off-By: David L Stevens Signed-off-by: David S. Miller commit 10ccff62bd3de7a64cf98f4c37ec0414b8affd4f Author: Ben Hutchings Date: Sun Oct 3 15:42:05 2010 +0000 netdev: Depend on INET before selecting INET_LRO Since 'select' ignores dependencies, drivers that select INET_LRO must depend on INET. This fixes the broken configuration reported in . Reported-by: Subrata Modak Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit c5d3557103f8bef81d7a150ab9cc970099cd58a2 Author: Ben Hutchings Date: Sun Oct 3 15:37:42 2010 +0000 Revert "ipv4: Make INET_LRO a bool instead of tristate." This reverts commit e81963b180ac502fda0326edf059b1e29cdef1a2. LRO is now deprecated in favour of GRO, and only a few drivers use it, so it is desirable to build it as a module in distribution kernels. The original change to prevent building it as a module was made in an attempt to avoid the case where some dependents are set to y and some to m, and INET_LRO can be set to m rather than y. However, the Kconfig system will reliably set INET_LRO=y in this case. Signed-off-by: Ben Hutchings Signed-off-by: David S. Miller commit 482964e56e1320cb7952faa1932d8ecf59c4bf75 Author: Nagendra Tomar Date: Sat Oct 2 23:45:06 2010 +0000 net: Fix the condition passed to sk_wait_event() This patch fixes the condition (3rd arg) passed to sk_wait_event() in sk_stream_wait_memory(). The incorrect check in sk_stream_wait_memory() causes the following soft lockup in tcp_sendmsg() when the global tcp memory pool has exhausted. >>> snip <<< localhost kernel: BUG: soft lockup - CPU#3 stuck for 11s! [sshd:6429] localhost kernel: CPU 3: localhost kernel: RIP: 0010:[sk_stream_wait_memory+0xcd/0x200] [sk_stream_wait_memory+0xcd/0x200] sk_stream_wait_memory+0xcd/0x200 localhost kernel: localhost kernel: Call Trace: localhost kernel: [sk_stream_wait_memory+0x1b1/0x200] sk_stream_wait_memory+0x1b1/0x200 localhost kernel: [] autoremove_wake_function+0x0/0x40 localhost kernel: [ipv6:tcp_sendmsg+0x6e6/0xe90] tcp_sendmsg+0x6e6/0xce0 localhost kernel: [sock_aio_write+0x126/0x140] sock_aio_write+0x126/0x140 localhost kernel: [xfs:do_sync_write+0xf1/0x130] do_sync_write+0xf1/0x130 localhost kernel: [] autoremove_wake_function+0x0/0x40 localhost kernel: [hrtimer_start+0xe3/0x170] hrtimer_start+0xe3/0x170 localhost kernel: [vfs_write+0x185/0x190] vfs_write+0x185/0x190 localhost kernel: [sys_write+0x50/0x90] sys_write+0x50/0x90 localhost kernel: [system_call+0x7e/0x83] system_call+0x7e/0x83 >>> snip <<< What is happening is, that the sk_wait_event() condition passed from sk_stream_wait_memory() evaluates to true for the case of tcp global memory exhaustion. This is because both sk_stream_memory_free() and vm_wait are true which causes sk_wait_event() to *not* call schedule_timeout(). Hence sk_stream_wait_memory() returns immediately to the caller w/o sleeping. This causes the caller to again try allocation, which again fails and again calls sk_stream_wait_memory(), and so on. [ Bug introduced by commit c1cbe4b7ad0bc4b1d98ea708a3fecb7362aa4088 ("[NET]: Avoid atomic xchg() for non-error case") -DaveM ] Signed-off-by: Nagendra Singh Tomar Signed-off-by: David S. Miller commit ae878ae280bea286ff2b1e1cb6e609dd8cb4501d Author: Maciej Żenczykowski Date: Sun Oct 3 14:49:00 2010 -0700 net: Fix IPv6 PMTU disc. w/ asymmetric routes Signed-off-by: Maciej Żenczykowski Signed-off-by: David S. Miller commit 3deb11ef16632fb76daead0db281f6f7d19332f2 Author: Lee, Chun-Yi Date: Fri Oct 1 16:28:29 2010 +0800 ACPI: add DMI to disable AML Vista compatibility on MSI GX723 Notebook The brightness control hotkey don't work with Vista compatibility because the MSI GX723 includes an infinite while loop in DSDT when brightness control hotkey pressed. The MSI GX723 uses Nvidia video. Perhaps the loop is specific to the Nvidia Vista driver... This patch should be reverted once nouveau grows support to call the ACPI NVIF method. Signed-off-by: Lee, Chun-Yi Signed-off-by: Len Brown commit c1e0ddbf0a97e1704d7f13b4934f9acca002402d Author: Yinghai Lu Date: Fri Sep 17 23:26:24 2010 -0700 ACPI: Handle ACPI0007 Device in acpi_early_set_pdc After | commit d8191fa4a33fdc817277da4f2b7f771ff605a41c | Author: Alex Chiang | Date: Mon Feb 22 12:11:39 2010 -0700 | | ACPI: processor: driver doesn't need to evaluate _PDC | | Now that the early _PDC evaluation path knows how to correctly | evaluate _PDC on only physically present processors, there's no | need for the processor driver to evaluate it later when it loads. | | To cover the hotplug case, push _PDC evaluation down into the | hotplug paths. only cpu with Processor Statement get processed with _PDC If bios is using Device object instead of Processor statement. SSDTs for Pstate/Cstate/Tstate can not be loaded dynamically. Need to try to scan ACPI0007 in addition to Processor. That commit is between 2.6.34-rc1 and 2.6.34-rc2, so stable tree for 2.6.34+ need this patch. Signed-off-by: Yinghai Lu Reviewed-by: Bjorn Helgaas Signed-off-by: Len Brown commit e454c844644683571617896ab2a4ce0109c1943e Author: Gustavo F. Padovan Date: Tue Sep 21 16:31:11 2010 -0300 Bluetooth: Fix deadlock in the ERTM logic The Enhanced Retransmission Mode(ERTM) is a realiable mode of operation of the Bluetooth L2CAP layer. Think on it like a simplified version of TCP. The problem we were facing here was a deadlock. ERTM uses a backlog queue to queue incomimg packets while the user is helding the lock. At some moment the sk_sndbuf can be exceeded and we can't alloc new skbs then the code sleep with the lock to wait for memory, that stalls the ERTM connection once we can't read the acknowledgements packets in the backlog queue to free memory and make the allocation of outcoming skb successful. This patch actually affect all users of bt_skb_send_alloc(), i.e., all L2CAP modes and SCO. We are safe against socket states changes or channels deletion while the we are sleeping wait memory. Checking for the sk->sk_err and sk->sk_shutdown make the code safe, since any action that can leave the socket or the channel in a not usable state set one of the struct members at least. Then we can check both of them when getting the lock again and return with the proper error if something unexpected happens. Signed-off-by: Gustavo F. Padovan Signed-off-by: Ulisses Furquim commit b0239c80fe89d5832a68a0f3121a9d5ec9fb763e Author: Gustavo F. Padovan Date: Wed Sep 8 14:59:44 2010 -0300 Revert "Bluetooth: Don't accept ConfigReq if we aren't in the BT_CONFIG state" This reverts commit 8cb8e6f1684be13b51f8429b15f39c140326b327. That commit introduced a regression with the Bluetooth Profile Tuning Suite(PTS), Reverting this make sure that L2CAP is in a qualificable state. Signed-off-by: Gustavo F. Padovan commit fad003b6c8e3d944d4453fd569b0702ef1af82b3 Author: Gustavo F. Padovan Date: Sat Aug 14 00:48:07 2010 -0300 Bluetooth: Fix inconsistent lock state with RFCOMM When receiving a rfcomm connection with the old dund deamon a inconsistent lock state happens. That's because interrupts were already disabled by l2cap_conn_start() when rfcomm_sk_state_change() try to lock the spin_lock. As result we may have a inconsistent lock state for l2cap_conn_start() after rfcomm_sk_state_change() calls bh_lock_sock() and disable interrupts as well. [ 2833.151999] [ 2833.151999] ================================= [ 2833.151999] [ INFO: inconsistent lock state ] [ 2833.151999] 2.6.36-rc3 #2 [ 2833.151999] --------------------------------- [ 2833.151999] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. [ 2833.151999] krfcommd/2306 [HC0[0]:SC0[0]:HE1:SE1] takes: [ 2833.151999] (slock-AF_BLUETOOTH){+.?...}, at: [] rfcomm_sk_state_change+0x46/0x170 [rfcomm] [ 2833.151999] {IN-SOFTIRQ-W} state was registered at: [ 2833.151999] [] __lock_acquire+0x5b6/0x1560 [ 2833.151999] [] lock_acquire+0x5a/0x70 [ 2833.151999] [] _raw_spin_lock+0x2c/0x40 [ 2833.151999] [] l2cap_conn_start+0x92/0x640 [l2cap] [ 2833.151999] [] l2cap_sig_channel+0x6bf/0x1320 [l2cap] [ 2833.151999] [] l2cap_recv_frame+0x133/0x770 [l2cap] [ 2833.151999] [] l2cap_recv_acldata+0x1cb/0x390 [l2cap] [ 2833.151999] [] hci_rx_task+0x2ab/0x450 [bluetooth] [ 2833.151999] [] tasklet_action+0xcb/0xe0 [ 2833.151999] [] __do_softirq+0xae/0x150 [ 2833.151999] [] call_softirq+0x1c/0x30 [ 2833.151999] [] do_softirq+0x75/0xb0 [ 2833.151999] [] irq_exit+0x8d/0xa0 [ 2833.151999] [] smp_apic_timer_interrupt+0x6b/0xa0 [ 2833.151999] [] apic_timer_interrupt+0x13/0x20 [ 2833.151999] [] cpu_idle+0x5a/0xb0 [ 2833.151999] [] rest_init+0xad/0xc0 [ 2833.151999] [] start_kernel+0x2dd/0x2e8 [ 2833.151999] [] x86_64_start_reservations+0xf6/0xfa [ 2833.151999] [] x86_64_start_kernel+0xe4/0xeb [ 2833.151999] irq event stamp: 731 [ 2833.151999] hardirqs last enabled at (731): [] local_bh_enable_ip+0x82/0xe0 [ 2833.151999] hardirqs last disabled at (729): [] __do_softirq+0xce/0x150 [ 2833.151999] softirqs last enabled at (730): [] __do_softirq+0xfe/0x150 [ 2833.151999] softirqs last disabled at (711): [] call_softirq+0x1c/0x30 [ 2833.151999] [ 2833.151999] other info that might help us debug this: [ 2833.151999] 2 locks held by krfcommd/2306: [ 2833.151999] #0: (rfcomm_mutex){+.+.+.}, at: [] rfcomm_run+0x174/0xb20 [rfcomm] [ 2833.151999] #1: (&(&d->lock)->rlock){+.+...}, at: [] rfcomm_dlc_accept+0x53/0x100 [rfcomm] [ 2833.151999] [ 2833.151999] stack backtrace: [ 2833.151999] Pid: 2306, comm: krfcommd Tainted: G W 2.6.36-rc3 #2 [ 2833.151999] Call Trace: [ 2833.151999] [] print_usage_bug+0x171/0x180 [ 2833.151999] [] mark_lock+0x333/0x400 [ 2833.151999] [] __lock_acquire+0x63a/0x1560 [ 2833.151999] [] ? __lock_acquire+0xb25/0x1560 [ 2833.151999] [] lock_acquire+0x5a/0x70 [ 2833.151999] [] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm] [ 2833.151999] [] _raw_spin_lock+0x2c/0x40 [ 2833.151999] [] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm] [ 2833.151999] [] rfcomm_sk_state_change+0x46/0x170 [rfcomm] [ 2833.151999] [] rfcomm_dlc_accept+0x69/0x100 [rfcomm] [ 2833.151999] [] rfcomm_check_accept+0x59/0xd0 [rfcomm] [ 2833.151999] [] rfcomm_recv_frame+0x9fb/0x1320 [rfcomm] [ 2833.151999] [] ? _raw_spin_unlock_irqrestore+0x3b/0x60 [ 2833.151999] [] ? trace_hardirqs_on_caller+0x13d/0x180 [ 2833.151999] [] ? trace_hardirqs_on+0xd/0x10 [ 2833.151999] [] rfcomm_run+0x221/0xb20 [rfcomm] [ 2833.151999] [] ? schedule+0x287/0x780 [ 2833.151999] [] ? rfcomm_run+0x0/0xb20 [rfcomm] [ 2833.151999] [] kthread+0x96/0xa0 [ 2833.151999] [] kernel_thread_helper+0x4/0x10 [ 2833.151999] [] ? restore_args+0x0/0x30 [ 2833.151999] [] ? kthread+0x0/0xa0 [ 2833.151999] [] ? kernel_thread_helper+0x0/0x10 Signed-off-by: Gustavo F. Padovan commit ccbb84af28594e19fd4bf27ff2828c80d03b6081 Author: Gustavo F. Padovan Date: Mon Aug 30 18:44:44 2010 -0300 Bluetooth: Simplify L2CAP Streaming mode sending As we don't have any error control on the Streaming mode, i.e., we don't need to keep a copy of the skb for later resending we don't need to call skb_clone() on it. Then we can go one further here, and dequeue the skb before sending it, that also means we don't need to look to sk->sk_send_head anymore. The patch saves memory and time when sending Streaming mode data, so it is good to mainline. Signed-off-by: Gustavo F. Padovan commit 8183b775bc5b79b6b1e250019c9dd930554dfa94 Author: Andrei Emeltchenko Date: Wed Sep 1 15:17:25 2010 +0300 Bluetooth: fix MTU L2CAP configuration parameter When receiving L2CAP negative configuration response with respect to MTU parameter we modify wrong field. MTU here means proposed value of MTU that the remote device intends to transmit. So for local L2CAP socket it is pi->imtu. Signed-off-by: Andrei Emeltchenko Acked-by: Ville Tervo Signed-off-by: Gustavo F. Padovan commit 8c462b6047da80491b8cb6be878e8bf9313ac3e1 Author: Mat Martineau Date: Tue Aug 24 15:35:42 2010 -0700 Bluetooth: Only enable L2CAP FCS for ERTM or streaming This fixes a bug which caused the FCS setting to show L2CAP_FCS_CRC16 with L2CAP modes other than ERTM or streaming. At present, this only affects the FCS value shown with getsockopt() for basic mode. Signed-off-by: Mat Martineau Signed-off-by: Gustavo F. Padovan commit 925bb9c649cf8d7200549b395f2ae291833dd494 Author: Grant Likely Date: Thu Sep 30 14:14:23 2010 +0200 of/i2c: Fix module load order issue caused by of_i2c.c Commit 959e85f7, "i2c: add OF-style registration and binding" caused a module dependency loop where of_i2c.c calls functions in i2c-core, and i2c-core calls of_i2c_register_devices() in of_i2c. This means that when i2c support is built as a module when CONFIG_OF is set, then neither i2c_core nor of_i2c are able to be loaded. This patch fixes the problem by moving the of_i2c_register_devices() calls back into the device drivers. Device drivers already specifically request the core code to parse the device tree for devices anyway by setting the of_node pointer, so it isn't a big deal to also call the registration function. The drivers just become slightly more verbose. Signed-off-by: Grant Likely Signed-off-by: Jean Delvare commit 64b4782fc9e4bdc59ae90897e2258e4ec938690e Author: Rajendra Nayak Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Fix checks which cause legacy suspend to never get called For devices which are not adapted to runtime PM a call to pm_runtime_suspended always returns true. Hence the pm_runtime_suspended checks below prevent legacy suspend from getting called. So do a pm_runtime_suspended check only for devices with a dev_pm_ops populated (which hence do not rely on the legacy suspend.) Signed-off-by: Rajendra Nayak Acked-by: Rafael J. Wysocki Cc: Ben Dooks Cc: Mark Brown Cc: Kevin Hilman Signed-off-by: Jean Delvare commit 6abb930af064fb1cf4177d32e2c7bfb89eee0fe5 Author: Yegor Yefremov Date: Thu Sep 30 14:14:22 2010 +0200 i2c-pca: Fix waitforcompletion() return value ret is still -1, if during the polling read_byte() returns at once with I2C_PCA_CON_SI set. So ret > 0 would lead *_waitforcompletion() to return 0, in spite of the proper behavior. The routine was rewritten, so that ret has always a proper value, before returning. Signed-off-by: Yegor Yefremov Reviewed-by: Wolfram Sang Cc: stable@kernel.org Signed-off-by: Jean Delvare commit 753419f59e10d7181e43f0b9cc5beff43ef3f7a4 Author: Vishwanath BS Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Fix for suspend/resume issue In current i2c core driver, call to pm_runtime_set_active from i2c_device_pm_resume will unconditionally enable i2c module and increment child count of the parent. Because of this, in CPU Idle path, i2c does not idle, preventing Core to enter retention. Also i2c module will not be suspended upon system suspend as pm_runtime_set_suspended is not called from i2c_device_pm_suspend. This issue is fixed by removing pm_runtime_set_active call from resume path which is not necessary. This fix has been tested on OMAP4430. Signed-off-by: Partha Basak Signed-off-by: Vishwanath BS Acked-by: Rafael J. Wysocki Cc: Kevin Hilman Cc: Ben Dooks Signed-off-by: Jean Delvare commit 59bfee6e0682635c269fb271422e2595fa441c21 Author: Wolfram Sang Date: Thu Sep 30 14:14:22 2010 +0200 i2c: Remove obsolete cleanup for clientdata A few new i2c-drivers came into the kernel which clear the clientdata-pointer on exit. This is obsolete meanwhile, so fix it and hope the word will spread. Signed-off-by: Wolfram Sang Acked-by: Mark Brown Signed-off-by: Jean Delvare commit cc6e853c5e49ea3698e87415672d818c6d7a5ee9 Author: Marek Szyprowski Date: Sun Sep 5 02:42:33 2010 -0300 V4L/DVB: v4l: radio: si470x: fix unneeded free_irq() call In case of error during probe() the driver calls free_irq() function on not yet allocated irq. This patches fixes the call sequence in case of the error. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit b2b476f53a9d24b00a313adf7f6ca92515a2af54 Author: Pawel Osciak Date: Tue Jul 20 13:49:16 2010 -0300 V4L/DVB: v4l: videobuf: prevent passing a NULL to dma_free_coherent() When a driver that uses videobuf-dma-contig is used with the USERPTR memory access method a kernel oops might happen: a NULL address may be passed to dma_free_coherent(). This happens when an application calls REQBUFS and then exits without queuing any buffers. This patch fixes that bug. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit a08c7c68f702e2a2797a4035b6c0a756c4886c26 Author: Brian Rogers Date: Wed Sep 22 08:06:43 2010 -0300 V4L/DVB: ir-core: Fix null dereferences in the protocols sysfs interface For some cards, ir_dev->props and ir_dev->raw are both NULL. These cards are using built-in IR decoding instead of raw, and can't easily be made to switch protocols. So upon reading /sys/class/rc/rc?/protocols on such a card, return 'builtin' as the supported and enabled protocol. Return -EINVAL on any attempts to change the protocol. And most important of all, don't crash. Signed-off-by: Brian Rogers Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit ddc79e0fdc16c05c3ff7f9b6ae9052bda0506108 Author: Sylwester Nawrocki Date: Mon Sep 6 03:53:44 2010 -0300 V4L/DVB: v4l: s5p-fimc: Fix 3-planar formats handling and pixel offset error on S5PV210 SoCs Fix DMA engine pixel offset calculation for 3-planar YUV formats. On S5PV210 SoCs horizontal offset is applied as number of pixels, not bytes per line. [mchehab@redhat.com: CodingStyle cleanup] Signed-off-by: Sylwester Nawrocki Signed-off-by: Kyungmin Park Signed-off-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab commit 81c69fc200bfa2f3a8b2fed614d1c6670c4a7e14 Author: Pawel Osciak Date: Mon Sep 6 03:53:43 2010 -0300 V4L/DVB: v4l: s5p-fimc: Fix return value on probe() failure On failed create_workqueue() fimc_probe() was returning 0. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Marek Szyprowski Signed-off-by: Mauro Carvalho Chehab commit 86d8b6abbbc973a1dd7d3c8f9e3c3e06131703b2 Author: Laurent Pinchart Date: Thu Sep 16 12:37:26 2010 -0300 V4L/DVB: uvcvideo: Restrict frame rates for Chicony CNF7129 webcam At all frame rates except 30fps and 5fps the camera produces very dark pictures. Auto-exposure is probably disabled by the camera at all frame rates except 30fps, making them pretty unusable. Work around the problem by introducing a new RESTRICT_FRAME_RATE quirk that disables all the frame rates except the default one. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 9275b32bced808bd57bdf3884748ed1126ba90e0 Author: Laurent Pinchart Date: Sun Sep 12 08:31:29 2010 -0300 V4L/DVB: uvcvideo: Fix support for Medion Akoya All-in-one PC integrated webcam The camera requires the STREAM_NO_FID quirk. Add a corresponding entry in the device IDs list. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit 405707985594169cfd0b1d97d29fcb4b4c6f2ac9 Author: Dan Rosenberg Date: Wed Sep 15 18:44:22 2010 -0300 V4L/DVB: ivtvfb: prevent reading uninitialized stack memory The FBIOGET_VBLANK device ioctl allows unprivileged users to read 16 bytes of uninitialized stack memory, because the "reserved" member of the fb_vblank struct declared on the stack is not altered or zeroed before being copied back to the user. This patch takes care of it. Signed-off-by: Dan Rosenberg Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit fc00a1d90d7b64e44c2475833cc3021066f67ea7 Author: Andy Walls Date: Thu Sep 16 20:54:47 2010 -0300 V4L/DVB: cx25840: Fix typo in volume control initialization: 65335 vs. 65535 The wrong value for the volume control limit, 65335 vs. 65535, prevents proper cx25840 v4l2_subdevice initialization. Reported-by: Igor M. liplianin Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit 71088bad7426650e4ea5fb4182580ea8458442e7 Author: Pawel Osciak Date: Fri Sep 10 02:05:48 2010 -0300 V4L/DVB: v4l: mem2mem_testdev: add missing release for video_device Video device was not being released on driver remove. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit b17a200f923070104a5b97085ed09ba0f682f637 Author: Pawel Osciak Date: Fri Sep 10 02:02:32 2010 -0300 V4L/DVB: v4l: mem2mem_testdev: fix errorenous comparison Output buffer has to be at least the size of input buffer, not the other way around. Signed-off-by: Pawel Osciak Signed-off-by: Kyungmin Park Signed-off-by: Mauro Carvalho Chehab commit 23f0cb62ba3a1a11ab02cb0675f28befc56c89b9 Author: Ionut Gabriel Popescu Date: Fri Sep 3 18:20:41 2010 -0300 V4L/DVB: mt9v022.c: Fixed compilation warning The drivers/media/video/mt9v022.c file, on line 405, tries a "case 0" o a v4l2_mbus_pixelcode enum which don't have an 0 value element, so I got a compile warning. That "case" is useless so it can be removed. Signed-off-by: Ionut Gabriel Popescu Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 01f5a394eac48b74c84434e95e74cd172b0682c3 Author: Michael Grzeschik Date: Tue Aug 3 07:57:45 2010 -0300 V4L/DVB: mt9m111: added current colorspace at g_fmt Signed-off-by: Michael Grzeschik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 6b6d33c746ace7bd0dbbdde674d3fb1100ab081d Author: Michael Grzeschik Date: Tue Aug 3 07:57:44 2010 -0300 V4L/DVB: mt9m111: cropcap and s_crop check if type is VIDEO_CAPTURE Signed-off-by: Philipp Wiesner Signed-off-by: Michael Grzeschik Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 5384a12b23160e11ff949a94172051476d308b66 Author: Baruch Siach Date: Tue Jul 27 09:06:07 2010 -0300 V4L/DVB: mx2_camera: fix a race causing NULL dereference The mx25_camera_irq irq handler may get called after the camera has been deactivated (from mx2_camera_deactivate). Detect this situation, and bail out. Signed-off-by: Baruch Siach Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 1b376dac05058ac5c9616a507d95c19ea5ea2646 Author: Stefan Ringel Date: Thu Sep 9 14:45:22 2010 -0300 V4L/DVB: tm6000: bugfix data handling Signed-off-by: Stefan Ringel Signed-off-by: Mauro Carvalho Chehab commit 04d174e99a6eca2f62b56c10ae1d7d0499d83e9d Author: Jean-François Moine Date: Mon Sep 13 05:22:37 2010 -0300 V4L/DVB: gspca - sn9c20x: Bad transfer size of Bayer images As the end of frame marker does not contain any pixel, it must not be transferred. Reported-by: Ivo Jager Signed-off-by: Jean-François Moine Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 2fc11536cf5c0b8eb4eb7e01a2a672a189e9280f Author: Hans Verkuil Date: Tue Sep 7 06:10:45 2010 -0300 V4L/DVB: videobuf-dma-sg: set correct size in last sg element This fixes a nasty memory corruption bug when using userptr I/O. The function videobuf_pages_to_sg() sets up the scatter-gather list for the DMA transfer to the userspace pages. The first transfer is setup correctly (the size is set to PAGE_SIZE - offset), but all other transfers have size PAGE_SIZE. This is wrong for the last transfer which may be less than PAGE_SIZE. Most, if not all, drivers will program the boards DMA engine correctly, i.e. even though the size in the last sg element is wrong, they will do their own size calculations and make sure the right amount is DMA-ed, and so seemingly prevent memory corruption. However, behind the scenes the dynamic DMA mapping support (in lib/swiotlb.c) may create bounce buffers if the memory pages are not in DMA-able memory. This happens for example on a 64-bit linux with a board that only supports 32-bit DMA. These bounce buffers DO use the information in the sg list to determine the size. So while the DMA engine transfers the correct amount of data, when the data is 'bounced' back too much is copied, causing buffer overwrites. The fix is simple: calculate and set the correct size for the last sg list element. Signed-off-by: Hans Verkuil Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit c10469c637602c2385e2993d8c730cc44fd47d23 Author: Mauro Carvalho Chehab Date: Sat Sep 11 11:37:51 2010 -0300 V4L/DVB: cx231xx: Avoid an OOPS when card is unknown (card=0) As reported by: Carlos Americo Domiciano : [ 220.033500] cx231xx v4l2 driver loaded. [ 220.033571] cx231xx #0: New device Conexant Corporation Polaris AV Capturb @ 480 Mbps (1554:5010) with 6 interfaces [ 220.033577] cx231xx #0: registering interface 0 [ 220.033591] cx231xx #0: registering interface 1 [ 220.033654] cx231xx #0: registering interface 6 [ 220.033910] cx231xx #0: Identified as Unknown CX231xx video grabber (card=0) [ 220.033946] BUG: unable to handle kernel NULL pointer dereference at (null) [ 220.033955] IP: [] cx231xx_pre_card_setup+0x5d/0xb0 [cx231xx] Thanks-to: Carlos Americo Domiciano Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 3cdadc50bbe8f04c1231c8af614cafd7ddd622bf Author: Richard Zidlicky Date: Tue Aug 24 09:52:36 2010 -0300 V4L/DVB: dvb: fix smscore_getbuffer() logic Drivers shouldn't sleep while holding a spinlock. A previous workaround were to release the spinlock before callinc schedule(). This patch uses a different approach: it just waits for the siano hardware to answer. Signed-off-by: Richard Zidlicky Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 970d14c6cca8c71307a4d23fe373c5895175b2d7 Author: Olivier Grenie Date: Tue Sep 7 12:50:46 2010 -0300 V4L/DVB: dib7000p: add disable sample and hold, and diversity delay parameter This patch improves the overall driver performance in diversity-reception scenarios. Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 90e12cec707204930934acdb5efce5f94a163a5f Author: Olivier Grenie Date: Tue Sep 7 12:50:45 2010 -0300 V4L/DVB: dib7770: enable the current mirror To improve performance on DiB7770-devices enabling the current mirror is needed. This patch adds an option to the dib7000p-driver to do that and it creates a separate device-entry in dib0700-device to use those changes on hardware which is using the DiB7770. Signed-off-by: Olivier Grenie Signed-off-by: Patrick Boettcher Signed-off-by: Mauro Carvalho Chehab commit 00a220aa98133dc43c6f7016c218aaf3afd66e11 Author: Maxim Levitsky Date: Mon Sep 6 18:26:10 2010 -0300 V4L/DVB: IR: extend MCE keymap These keys are found on remote bundled with Toshiba Qosmio F50-10q. Found and tested by, Sami R Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit e0172fd373ab77a83ea952fd6a75c612e1b0bf9e Author: Maxim Levitsky Date: Mon Sep 6 18:26:09 2010 -0300 V4L/DVB: IR: fix keys beeing stuck down forever The logic in ir_timer_keyup was inverted. In case that values aren't equal, the meaning of the time_is_after_eq_jiffies(ir->keyup_jiffies) is that ir->keyup_jiffies is after the the jiffies or equally that that jiffies are before the the ir->keyup_jiffies which is exactly the situation we want to avoid (that the timeout is in the future) Confusing Eh? Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 67332ba83242f814490884161fee8676a9fd8a09 Author: Maxim Levitsky Date: Mon Sep 6 18:26:08 2010 -0300 V4L/DVB: IR: fix duty cycle capability Due to typo lirc bridge enabled wrong capability. Signed-off-by: Maxim Levitsky Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 04cab131ce2a267b6777a98d68fbc0cae44d4ba8 Author: Mauro Carvalho Chehab Date: Wed Sep 8 12:58:12 2010 -0300 V4L/DVB: rc-core: increase repeat time As reported by Anton Blanchard , double IR events on 2.6.36-rc2 and a DViCO FusionHDTV DVB-T Dual Express are happening: [ 1351.032084] ir_keydown: i2c IR (FusionHDTV): key down event, key 0x0067, scancode 0x0051 [ 1351.281284] ir_keyup: keyup key 0x0067 ie one key down event and one key up event 250ms later. So, we need to increase the repeat timeout, to avoid this bug to hit. As we're doing it at core, this fix is not needed anymore at dib0700 driver. Thanks-to: Anton Blanchard Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 3bfb317f97cfddbbec67bbe8e35ad38af3507397 Author: Mauro Carvalho Chehab Date: Fri Sep 3 10:50:24 2010 -0300 V4L/DVB: Don't identify PV SBTVD Hybrid as a DibCom device As reported by Carlos, Prolink Pixelview SBTVD Hybrid is based on Conexant cx231xx + Fujitsu 86A20S demodulator. However, both shares the same USB ID. So, we need to use USB bcdDevice, in order to properly discover what's the board. We know for sure that bcd 0x100 is used for a dib0700 device, while bcd 0x4001 is used for a cx23102 device. This patch reserves two ranges, the first one from 0x0000-0x3f00 for dib0700, and the second from 0x4000-0x4fff for cx231xx devices. This may need fixes in the future, as we get access to other devices. Thanks-to: Carlos Americo Domiciano Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit c13df9cf6b1cad7fd088c9acceb98b6bffd9ca31 Author: Jarod Wilson Date: Fri Aug 27 18:21:14 2010 -0300 V4L/DVB: mceusb: add two new ASUS device IDs Reported in lirc sf.net tracker and on lirc mailing list Signed-off-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 882787ff8fdeb0be790547ee9b22b281095e95da Author: Jason Wang Date: Fri Sep 3 06:57:19 2010 -0300 V4L/DVB: gspca - main: Fix a crash of some webcams on ARM arch When plugging some webcams on ARM, the system crashes. This is because we alloc buffer for an urb through usb_buffer_alloc, the alloced buffer is already in DMA coherent region, so we should set the flag of this urb to URB_NO_TRANSFER_DMA_MAP, otherwise when we submit this urb, the hcd core will handle this address as an non-DMA address and call dma_map_single/sg to map it. On arm architecture, dma_map_single a DMA coherent address will be catched by a BUG_ON(). Signed-off-by: Jason Wang Signed-off-by: Jean-François Moine Cc: stable@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 29d834912bbcf0d095e6cd0e95b0d9790fdf7957 Author: Dmitri Belimov Date: Mon Aug 23 10:30:14 2010 -0300 V4L/DVB: Fix regression for BeholdTV Columbus Some time a go our customers wrote me about problem with our TV card BeholdTV Columbus. It's PCMCIA TV card for notebook. As I understand v4l has some regression with autodetect address of tuners. I can set incorrect I2C address and had report about detect tuner. No any TV of course. When I set correct tuner type and I2C address of the tuners all works well. Signed-off-by: Beholder Intl. Ltd. Dmitry Belimov Signed-off-by: Mauro Carvalho Chehab commit 23e64d55859ea619c17832645e0e56faac84d750 Author: Dan Carpenter Date: Thu Aug 19 07:00:22 2010 -0300 V4L/DVB: saa7164: move dereference under NULL check The original code dereferenced "port" before checking it for NULL. I moved the test down below the check. Also I changed the comparisons a little so people wouldn't get confused and think "port" and "buf" were ints instead of pointers. (Probably that's what lead to this issue in the first place.) There is only one caller for this function and it passes non-NULL pointers, so this is essentially a cleanup rather than a bugfix. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab commit d5337966ce4639c775ff5edf92d78f5fad34ef0d Author: Dan Carpenter Date: Thu Aug 19 06:50:04 2010 -0300 V4L/DVB: pvrusb2: remove unneeded NULL checks We dereference "maskptr" unconditionally at the start of the function and also inside the call to parse_tlist() towards the end of the function. This function is called from store_val_any() and it always passes a non-NULL pointer. Signed-off-by: Dan Carpenter Acked-by: Mike Isely Signed-off-by: Mauro Carvalho Chehab commit a8e07124500184f81541ddf3e9669000af9ac4bc Author: Dan Carpenter Date: Thu Aug 19 06:47:50 2010 -0300 V4L/DVB: opera1: remove unneeded NULL check "fw" is always a non-NULL pointer at this point, and anyway release_firmware() accepts NULL pointers. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab commit 028816bc85db5ac6a562c2aff2113c7480d67919 Author: Dan Carpenter Date: Thu Aug 12 04:47:07 2010 -0300 V4L/DVB: IR: ir-raw-event: null pointer dereference The original code dereferenced ir->raw after freeing it and setting it to NULL. Signed-off-by: Dan Carpenter Acked-by: Jarod Wilson Signed-off-by: Mauro Carvalho Chehab commit 590a58d18027b18db78f538aca592c2cdb249079 Author: Dan Carpenter Date: Thu Aug 12 04:41:58 2010 -0300 V4L/DVB: unlock on error path If we return directly here then we miss out on some mutex_unlock()s Signed-off-by: Dan Carpenter Acked-by: Sylwester Nawrocki Signed-off-by: Mauro Carvalho Chehab commit 0f63a14d357b3a80abb5203a574cbb3f8988c2f7 Author: lawrence rust Date: Tue Aug 24 06:50:48 2010 -0300 V4L/DVB: cx88: Kconfig: Remove EXPERIMENTAL dependency from VIDEO_CX88_ALSA The cx88-alsa module has been around since January 2006 and has seen no significant changes since September 2007. It is stable in operation and so I believe that the 'experimental' tag is no longer warranted. Signed-off-by: Mauro Carvalho Chehab commit fb0c484f72df9e336605b5659f39eb1ab5e8d946 Author: Randy Dunlap Date: Thu Aug 19 14:42:14 2010 -0300 V4L/DVB: tm6000: depends on IR_CORE tm6000 uses IR interfaces, so it should depend on IR_CORE. ERROR: "get_rc_map" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "ir_input_unregister" [drivers/staging/tm6000/tm6000.ko] undefined! ERROR: "__ir_input_register" [drivers/staging/tm6000/tm6000.ko] undefined! Signed-off-by: Randy Dunlap Signed-off-by: Mauro Carvalho Chehab commit 4a109cc0511209276e58f1dbe53259e7a8f1508b Author: Mark Brown Date: Fri Sep 24 10:50:46 2010 +0100 ASoC: Add Jassi Brar as Samsung maintainer Since Jassi is doing so much good work and can offer such good review for the Samsung CPU support add an entry for the Samsung ASoC drivers to MAINTAINERS listing him. Signed-off-by: Mark Brown Acked-by: Jassi Brar Acked-by: Liam Girdwood commit d2520a426dc3033c00077e923a553fc6c98c7564 Author: Kenneth Waters Date: Tue Sep 21 00:58:23 2010 -0700 Input: joydev - fix JSIOCSAXMAP ioctl Fixed JSIOCSAXMAP ioctl to update absmap, the map from hardware axis to event axis in addition to abspam. This fixes a regression introduced by 999b874f. Signed-off-by: Kenneth Waters Cc: stable@kernel.org Signed-off-by: Dmitry Torokhov commit 38e7afe96c7c0ad900824911c61fdb04078033dc Author: Henrik Rydberg Date: Sun Sep 19 16:25:36 2010 -0700 Input: uinput - setup MT usage during device creation The input devices created by uinput do not currently handle multitouch properly. All events will appear as if they came from slot zero, and the input event buffers are not adjusted. This patch creates the MT slots during setup, and sets the number of events per packet based on the MT usage. Signed-off-by: Henrik Rydberg Signed-off-by: Dmitry Torokhov