10 years agoMerge tag 'v2.6.35-rc6' into drm-radeon-next
Dave Airlie [Mon, 2 Aug 2010 00:05:18 +0000 (10:05 +1000)]
Merge tag 'v2.6.35-rc6' into drm-radeon-next

Need this to avoid conflicts with future radeon fixes

10 years agodrm: radeon: fix sign bug
Dan Carpenter [Sat, 17 Jul 2010 10:28:02 +0000 (12:28 +0200)]
drm: radeon: fix sign bug

The "error" variable is unsigned so it's never less than zero.  I
changed it to check if (freq < current_freq) directly.

"best_error" is also unsigned so "best_error - 100" could be a large
number instead of a negative.  Since "error" is unsigned it is never
less than a negative and so the cases where "best_error" is less than or
equal to 100 are false.

Signed-off-by: Dan Carpenter <>
Reviewed-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: check/restore sanity before doing anything else with GPU.
Dave Airlie [Thu, 15 Jul 2010 02:13:50 +0000 (12:13 +1000)]
drm/radeon/kms: check/restore sanity before doing anything else with GPU.

On systems using kexec, the new kernel is booted straight from the old kernel, without any warning to the graphics driver. So the GPU is basically left as-is in a running state, however the CPU side is completly reset.

Without stating the saneness of anyone using kexec on live systems, we should at least try not to crash the GPU. This patch resets 3 registers to 0 that could cause bad things to happen to the running system.

This allows kexec to work on a Power6/RN50 system.

Signed-off-by: Dave Airlie <>
10 years agodrm/radeon: fall back to GTT if bo creation/validation in VRAM fails.
Michel Dänzer [Thu, 8 Jul 2010 02:43:28 +0000 (12:43 +1000)]
drm/radeon: fall back to GTT if bo creation/validation in VRAM fails.

This fixes a problem where on low VRAM cards we'd run out of space for validation.

[airlied: Tested on my M7, Thinkpad T42, compiz works with no problems.]

Signed-off-by: Michel Dänzer <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: add ioport register access
Alex Deucher [Wed, 30 Jun 2010 15:52:50 +0000 (11:52 -0400)]
drm/radeon/kms: add ioport register access

This is required for the NB_MISC regs on rs780/rs880 which
means HDMI/DVI/DP ports using PCIEPHY won't work without
it. It might also help with s/r (asic init) issues on other
atombios cards.

and similar issues reported by Alberto Milone.

[airlied: Squash io fix patch]

Signed-off-by: Alex Deucher <>
Tested-by: Rafał Miłecki <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: enable HDMI audio on RS600/RS690/RS740
Rafał Miłecki [Sat, 19 Jun 2010 10:24:57 +0000 (12:24 +0200)]
drm/radeon/kms: enable HDMI audio on RS600/RS690/RS740

We will need method of selecting encoder that should receive HDMI block. For
now we assign HDMI block to first enabled encoder. Hopefully there are not many
RS6x0 chips with two digital encoders.

[airlied: add RS740 checks as per Alex suggestion.]

Signed-off-by: Rafał Miłecki <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: track audio engine state, do not use not setup timer
Rafał Miłecki [Sat, 19 Jun 2010 10:24:56 +0000 (12:24 +0200)]
drm/radeon/kms: track audio engine state, do not use not setup timer

This is needed to enable audio support on devices using polling. In case user
decides to disable audio (module parameter) we still will try to use timer in
r600_audio_enable_polling. This would lead to BUG in kernel/timer.c.

Signed-off-by: Rafał Miłecki <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms/r6xx+: add query for tile config (v2)
Alex Deucher [Fri, 4 Jun 2010 17:10:12 +0000 (13:10 -0400)]
drm/radeon/kms/r6xx+: add query for tile config (v2)

Userspace needs this information to access tiled
buffers via the CPU.

v2: rebased on evergreen accel changes

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: fix CS alignment checking for tiling (v2)
Alex Deucher [Fri, 4 Jun 2010 22:41:42 +0000 (18:41 -0400)]
drm/radeon/kms: fix CS alignment checking for tiling (v2)

Covers depth, cb, and textures. Hopefully I got this right.

v2: - fix bugs:
    - use ALIGNED(), IS_ALIGNED() macros

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: add tiling support to the cs checker for r6xx/r7xx
Alex Deucher [Thu, 20 May 2010 16:43:52 +0000 (12:43 -0400)]
drm/radeon/kms: add tiling support to the cs checker for r6xx/r7xx

Check for relocs for DB_DEPTH_INFO, CB_COLOR*_INFO, and texture

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: Add crtc tiling setup support for evergreen
Alex Deucher [Thu, 20 May 2010 16:12:48 +0000 (12:12 -0400)]
drm/radeon/kms: Add crtc tiling setup support for evergreen

Needed for scanning out of a tiled buffer.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: Add crtc tiling setup support for r6xx/r7xx
Alex Deucher [Thu, 20 May 2010 16:04:59 +0000 (12:04 -0400)]
drm/radeon/kms: Add crtc tiling setup support for r6xx/r7xx

Needed for scanning out of a tiled buffer.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: add support for internal thermal sensors (v3)
Alex Deucher [Fri, 2 Jul 2010 16:58:16 +0000 (12:58 -0400)]
drm/radeon/kms: add support for internal thermal sensors (v3)

rv6xx/rv7xx/evergreen families supported; older asics did
not have an internal thermal sensor.

Note, not all oems use the internal thermal sensor, so it's
only exposed in cases where it is used.

Note also, that most laptops use an oem specific ACPI solution for
GPU thermal information rather than using the internal thermal
sensor directly.

v2: export millidegrees celsius, use hwmon device properly.
v3: fix Kconfig

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon: Add support for the ATIF ACPI method to the radeon driver
Alberto Milone [Tue, 6 Jul 2010 15:40:24 +0000 (11:40 -0400)]
drm/radeon: Add support for the ATIF ACPI method to the radeon driver

By calling the ATIF method in the radeon driver we can make sure
that hotkeys such as the video switch key emit ACPI events when

agd5f: fix warning

Signed-off-by: Alberto Milone <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms/atom: bump atom loop timeout from 1 sec to 5 secs
Alex Deucher [Wed, 30 Jun 2010 18:58:59 +0000 (14:58 -0400)]
drm/radeon/kms/atom: bump atom loop timeout from 1 sec to 5 secs

Some tables have delays that can cause the timeout to hit
even when not intended.

Should fix:
and related bugs.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: minor driver cleanups
Alex Deucher [Wed, 30 Jun 2010 16:13:55 +0000 (12:13 -0400)]
drm/radeon/kms: minor driver cleanups

- Make the logic in r100_pll_errata_after_index() match the other
errata functions
- Use rdev->family rather than rdev->flags & RADEON_FAMILY_MASK for kms
- replace rn50 check using ids with ASIC_IS_RN50 convenience macro

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agoLinux 2.6.35-rc6 v2.6.35-rc6
Linus Torvalds [Thu, 22 Jul 2010 19:13:38 +0000 (12:13 -0700)]
Linux 2.6.35-rc6

10 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 22 Jul 2010 18:46:15 +0000 (11:46 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/dtor/input

* 'for-linus' of git://
  Input: synaptics - relax capability ID checks on newer hardware
  Input: twl40300-keypad - fix handling of "all ground" rows
  Input: gamecon - reference correct pad in gc_psx_command()
  Input: gamecon - reference correct input device in NES mode
  Input: w90p910_keypad - change platfrom driver name to 'nuc900-kpi'
  Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table
  Input: qt2160 - rename kconfig symbol name

10 years agoMerge branch 'drm-fixes' of git://
Linus Torvalds [Thu, 22 Jul 2010 18:45:57 +0000 (11:45 -0700)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-fixes' of git://
  drm/radeon/kms: add quirk to make HP DV5000 laptop resume
  drm/radeon/kms: fix RADEON_INFO_CRTC_FROM_ID info ioctl
  Fix ttm_page_alloc.c build breakage
  drm/radeon/kms: fix legacy LVDS dpms sequence
  drm/radeon/kms: drop taking lock around crtc lookup.

10 years agoMerge git://
Linus Torvalds [Thu, 22 Jul 2010 18:45:23 +0000 (11:45 -0700)]
Merge git://git./linux/kernel/git/herbert/crypto-2.6

* git://
  crypto: talitos - fix bug in sg_copy_end_to_buffer

10 years agoMerge branch 'x86/auditsyscall' of git://
Linus Torvalds [Thu, 22 Jul 2010 18:45:02 +0000 (11:45 -0700)]
Merge branch 'x86/auditsyscall' of git://git./linux/kernel/git/frob/linux-2.6-roland

* 'x86/auditsyscall' of git://
  x86: auditsyscall: fix fastpath return value after reschedule

10 years agoMerge branch 'for_linus' of git://
Linus Torvalds [Thu, 22 Jul 2010 18:44:26 +0000 (11:44 -0700)]
Merge branch 'for_linus' of git://git./linux/kernel/git/jwessel/linux-2.6-kgdb

* 'for_linus' of git://
  sysrq,kdb: Use __handle_sysrq() for kdb's sysrq function
  debug_core,kdb: fix kgdb_connected bit set in the wrong place
  Fix merge regression from external kdb to upstream kdb
  repair gdbstub to match the gdbserial protocol specification
  kdb: break out of kdb_ll() when command is terminated

10 years agoCIFS: Fix a malicious redirect problem in the DNS lookup code
David Howells [Thu, 22 Jul 2010 11:53:18 +0000 (12:53 +0100)]
CIFS: Fix a malicious redirect problem in the DNS lookup code

Fix the security problem in the CIFS filesystem DNS lookup code in which a
malicious redirect could be installed by a random user by simply adding a
result record into one of their keyrings with add_key() and then invoking a
CIFS CFS lookup [CVE-2010-2524].

This is done by creating an internal keyring specifically for the caching of
DNS lookups.  To enforce the use of this keyring, the module init routine
creates a set of override credentials with the keyring installed as the thread
keyring and instructs request_key() to only install lookup result keys in that

The override is then applied around the call to request_key().

This has some additional benefits when a kernel service uses this module to
request a key:

 (1) The result keys are owned by root, not the user that caused the lookup.

 (2) The result keys don't pop up in the user's keyrings.

 (3) The result keys don't come out of the quota of the user that caused the

The keyring can be viewed as root by doing cat /proc/keys:

2a0ca6c3 I-----     1 perm 1f030000     0     0 keyring   .dns_resolver: 1/4

It can then be listed with 'keyctl list' by root.

# keyctl list 0x2a0ca6c3
1 key in keyring:
726766307: --alswrv     0     0 dns_resolver:

Signed-off-by: David Howells <>
Reviewed-and-Tested-by: Jeff Layton <>
Acked-by: Steve French <>
Signed-off-by: Linus Torvalds <>
10 years agodrm/radeon/kms: add quirk to make HP DV5000 laptop resume
Alex Deucher [Thu, 22 Jul 2010 03:54:35 +0000 (23:54 -0400)]
drm/radeon/kms: add quirk to make HP DV5000 laptop resume


Reported-by: Andres Cimmarusti <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agoInput: synaptics - relax capability ID checks on newer hardware
Dmitry Torokhov [Wed, 21 Jul 2010 07:01:19 +0000 (00:01 -0700)]
Input: synaptics - relax capability ID checks on newer hardware

Older firmwares fixed the middle byte of the Synaptics capabilities
query to 0x47, but starting with firmware 7.5 the middle byte
represents submodel ID, sometimes also called "dash number".

Reported-and-tested-by: Miroslav Šulc <>
Signed-off-by: Dmitry Torokhov <>
10 years agox86: auditsyscall: fix fastpath return value after reschedule
Roland McGrath [Thu, 22 Jul 2010 00:44:12 +0000 (17:44 -0700)]
x86: auditsyscall: fix fastpath return value after reschedule

In the CONFIG_AUDITSYSCALL fast-path for x86 64-bit system calls,
we can pass a bad return value and/or error indication for the
system call to audit_syscall_exit().  This happens when
TIF_NEED_RESCHED was set as the system call returned, so we went
out to schedule() and came back to the exit-audit fast-path.  The
fix is to reload the user return value register from the pt_regs
before using it for audit_syscall_exit().

Both the 32-bit kernel's fast path and the 64-bit kernel's 32-bit
system call fast paths work slightly differently, so that they
always leave the fast path entirely to reschedule and don't return
there, so they don't have the analogous bugs.

Reported-by: Alexander Viro <>
Signed-off-by: Roland McGrath <>
10 years agosysrq,kdb: Use __handle_sysrq() for kdb's sysrq function
Jason Wessel [Thu, 22 Jul 2010 00:27:07 +0000 (19:27 -0500)]
sysrq,kdb: Use __handle_sysrq() for kdb's sysrq function

The kdb code should not toggle the sysrq state in case an end user
wants to try and resume the normal kernel execution.

Signed-off-by: Jason Wessel <>
Acked-by: Dmitry Torokhov <>
10 years agodebug_core,kdb: fix kgdb_connected bit set in the wrong place
Jason Wessel [Thu, 22 Jul 2010 00:27:07 +0000 (19:27 -0500)]
debug_core,kdb: fix kgdb_connected bit set in the wrong place

Immediately following an exit from the kdb shell the kgdb_connected
variable should be set to zero, unless there are breakpoints planted.
If the kgdb_connected variable is not zeroed out with kdb, it is
impossible to turn off kdb.

This patch is merely a work around for now, the real fix will check
for the breakpoints.

Signed-off-by: Jason Wessel <>
10 years agoFix merge regression from external kdb to upstream kdb
Jason Wessel [Thu, 22 Jul 2010 00:27:06 +0000 (19:27 -0500)]
Fix merge regression from external kdb to upstream kdb

In the process of merging kdb to the mainline, the kdb lsmod command
stopped printing the base load address of kernel modules.  This is
needed for using kdb in conjunction with external tools such as gdb.

Simply restore the functionality by adding a kdb_printf for the base
load address of the kernel modules.

Signed-off-by: Jason Wessel <>
10 years agorepair gdbstub to match the gdbserial protocol specification
Jason Wessel [Thu, 22 Jul 2010 00:27:05 +0000 (19:27 -0500)]
repair gdbstub to match the gdbserial protocol specification

The gdbserial protocol handler should return an empty packet instead
of an error string when ever it responds to a command it does not

The problem cases come from a debugger client sending
qTBuffer, qTStatus, qSearch, qSupported.

The incorrect response from the gdbstub leads the debugger clients to
not function correctly.  Recent versions of gdb will not detach correctly as a result of this behavior.

Signed-off-by: Jason Wessel <>
Signed-off-by: Dongdong Deng <>
10 years agokdb: break out of kdb_ll() when command is terminated
Martin Hicks [Thu, 22 Jul 2010 00:27:05 +0000 (19:27 -0500)]
kdb: break out of kdb_ll() when command is terminated

Without this patch the "ll" linked-list traversal command won't
terminate when you hit q/Q.

Signed-off-by: Martin Hicks <>
Signed-off-by: Jason Wessel <>
10 years agodrm/radeon/kms: fix RADEON_INFO_CRTC_FROM_ID info ioctl
Alex Deucher [Wed, 21 Jul 2010 18:05:35 +0000 (14:05 -0400)]
drm/radeon/kms: fix RADEON_INFO_CRTC_FROM_ID info ioctl

Return the crtc_id, not the counter value.  They are not
necessarily the same.

Cc: Jerome Glisse <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agoFix ttm_page_alloc.c build breakage
Luck, Tony [Wed, 21 Jul 2010 17:15:39 +0000 (10:15 -0700)]
Fix ttm_page_alloc.c build breakage

The commit 1e8655f87333def92bb8215b423adc65403b08a5
    drm/ttm: Fix build on architectures without AGP

looks at TTM_HAS_AGP before it has been set in ttm_bo_driver.h

Move the conditional inclusion of <asm/agp.h> *after* we have included

Signed-of-by: Tony Luck <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: fix legacy LVDS dpms sequence
Alex Deucher [Wed, 21 Jul 2010 23:37:21 +0000 (19:37 -0400)]
drm/radeon/kms: fix legacy LVDS dpms sequence

Add delay after turning off the LVDS encoder.


Tested-by: Jan Kreuzer <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: drop taking lock around crtc lookup.
Dave Airlie [Wed, 21 Jul 2010 23:57:13 +0000 (09:57 +1000)]
drm/radeon/kms: drop taking lock around crtc lookup.

We only add/remove crtcs at driver load, you cannot remove when
the GPU is running a CS packet since the fd is open, when
GPU hotplugging on radeons actually is needed all this locking
needs a review and I've started re-working kms core locking to deal
with this better. But for now avoid long delays in CS processing when
hotplug detect is happening in a different thread.

this fixes a regression introduced with hotplug detection.

Signed-off-by: Dave Airlie <>
10 years agoMerge branch 'urgent' of git://
Linus Torvalds [Wed, 21 Jul 2010 16:31:15 +0000 (09:31 -0700)]
Merge branch 'urgent' of git://git./linux/kernel/git/brodo/pcmcia-2.6

* 'urgent' of git://
  pcmcia: fix 'driver ... did not release config properly' warning

10 years agoMerge branch 'shrinker' of git://
Linus Torvalds [Wed, 21 Jul 2010 16:30:59 +0000 (09:30 -0700)]
Merge branch 'shrinker' of git://git./linux/kernel/git/dgc/xfsdev

* 'shrinker' of git://
  mm: add context argument to shrinker callback to remaining shrinkers

10 years agoMerge branch 'fix/asoc' of git://
Linus Torvalds [Wed, 21 Jul 2010 16:29:39 +0000 (09:29 -0700)]
Merge branch 'fix/asoc' of git://git./linux/kernel/git/tiwai/sound-2.6

* 'fix/asoc' of git://
  ASoC: Select wm_hubs automatically for WM8994
  ASoC: Remove duplicate AUX definition from WM8776
  ASoC:: remove a redundant snd_soc_unregister_codec call in wm8988_register
  ASoC: wm8727: add a missing return in wm8727_platform_probe
  ASoC: fsi: fixup wrong value setting order of TDM
  ASoC: fsi: fixup clock inversion operation

10 years agoMerge git://
Linus Torvalds [Wed, 21 Jul 2010 16:28:50 +0000 (09:28 -0700)]
Merge git://git./linux/kernel/git/davem/sparc-2.6

* git://
  math-emu: correct test for downshifting fraction in _FP_FROM_INT()
  perf: Add DWARF register lookup for sparc
  MAINTAINERS: Add SBUS driver path to sparc entry.
  drivers/sbus: Remove unnecessary casts of private_data
  sparc: remove homegrown L1_CACHE_ALIGN macro
  sparc64: fix the build error due to smp_kgdb_capture_client()
  sparc64: Fix maybe_change_configuration() PCR setting.
  arch/sparc/kernel: Eliminate what looks like a NULL pointer dereference
  sparc64: Update defconfig.
  sunsu: Fix use after free in su_remove().
  sunserial: Don't call add_preferred_console() when console= is specified.
  sparc32: Kill none_mask, it's bogus.

10 years agoFix up trivial spelling errors ('taht' -> 'that')
Linus Torvalds [Wed, 21 Jul 2010 16:25:42 +0000 (09:25 -0700)]
Fix up trivial spelling errors ('taht' -> 'that')

Pointed out by Lucas who found the new one in a comment in
setup_percpu.c. And then I fixed the others that I grepped

Reported-by: Lucas <>
Signed-off-by: Linus Torvalds <>
10 years agopcmcia: fix 'driver ... did not release config properly' warning
Patrick McHardy [Tue, 20 Jul 2010 22:21:42 +0000 (15:21 -0700)]
pcmcia: fix 'driver ... did not release config properly' warning

Up to 2.6.34 pcmcia_release_irq() reset p_dev->_irq to 0 after releasing
the irq.  The IRQ is now released in pcmcia_disable_device(), however
p_dev->_irq is not reset, triggering a warning in pcmcia_device_remove().

Signed-off-by: Patrick McHardy <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Dominik Brodowski <>
10 years agomm: add context argument to shrinker callback to remaining shrinkers
Dave Chinner [Wed, 21 Jul 2010 05:33:01 +0000 (15:33 +1000)]
mm: add context argument to shrinker callback to remaining shrinkers

Add the shrinkers missed in the first conversion of the API in
commit 7f8275d0d660c146de6ee3017e1e2e594c49e820 ("mm: add context argument to
shrinker callback").

Signed-off-by: Dave Chinner <>
10 years agoInput: twl40300-keypad - fix handling of "all ground" rows
Dmitry Torokhov [Wed, 21 Jul 2010 03:25:35 +0000 (20:25 -0700)]
Input: twl40300-keypad - fix handling of "all ground" rows

The Nokia RX51 board code (arch/arm/mach-omap2/board-rx51-peripherals.c)
defines a key map for the matrix keypad keyboard. The hardware seems to
use all of the 8 rows and 8 columns of the keypad, although not all
possible locations are used.

The TWL4030 supports keypads with at most 8 rows and 8 columns. Most keys
are defined with a row and column number between 0 and 7, except

        KEY(0xff, 2, KEY_F9),
        KEY(0xff, 4, KEY_F10),
        KEY(0xff, 5, KEY_F11),

which represent keycodes that should be emitted when entire row is
connected to the ground.  since the driver handles this case as if we
had an extra column in the key matrix. Unfortunately we do not allocate
enough space and end up owerwriting some random memory.

Reported-and-tested-by: Laurent Pinchart <>
Signed-off-by: Dmitry Torokhov <>
10 years agoInput: gamecon - reference correct pad in gc_psx_command()
Dmitry Torokhov [Wed, 21 Jul 2010 03:25:35 +0000 (20:25 -0700)]
Input: gamecon - reference correct pad in gc_psx_command()

Otherwise we won't see any events from the gamepad.

Reported-and-tested-by: Eugene Yudin <>
Signed-off-by: Dmitry Torokhov <>
10 years agoInput: gamecon - reference correct input device in NES mode
Dmitry Torokhov [Wed, 21 Jul 2010 03:25:35 +0000 (20:25 -0700)]
Input: gamecon - reference correct input device in NES mode

We moved input devices from 'struct gc' to individial pads (struct
gc-pad), but gc_nes_process_packet() was still trying to use old
ones and crashing.

Signed-off-by: Dmitry Torokhov <>
10 years agomath-emu: correct test for downshifting fraction in _FP_FROM_INT()
Mikael Pettersson [Wed, 21 Jul 2010 01:45:14 +0000 (18:45 -0700)]
math-emu: correct test for downshifting fraction in _FP_FROM_INT()

The kernel's math-emu code contains a macro _FP_FROM_INT() which is
used to convert an integer to a raw normalized floating-point value.
It does this basically in three steps:

1. Compute the exponent from the number of leading zero bits.
2. Downshift large fractions to put the MSB in the right position
   for normalized fractions.
3. Upshift small fractions to put the MSB in the right position.

There is an boundary error in step 2, causing a fraction with its
MSB exactly one bit above the normalized MSB position to not be
downshifted.  This results in a non-normalized raw float, which when
packed becomes a massively inaccurate representation for that input.

The impact of this depends on a number of arch-specific factors,
but it is known to have broken emulation of FXTOD instructions
on UltraSPARC III, which was originally reported as GCC bug 44631

Any arch which uses math-emu to emulate conversions from integers to
same-size floats may be affected.

The fix is simple: the exponent comparison used to determine if the
fraction should be downshifted must be "<=" not "<".

I'm sending a kernel module to test this as a reply to this message.
There are also SPARC user-space test cases in the GCC bug entry.

Signed-off-by: Mikael Pettersson <>
Signed-off-by: David S. Miller <>
10 years agoMerge branch 'drm-fixes' of git://
Linus Torvalds [Wed, 21 Jul 2010 01:29:25 +0000 (18:29 -0700)]
Merge branch 'drm-fixes' of git://git./linux/kernel/git/airlied/drm-2.6

* 'drm-fixes' of git://
  drm/r600: fix possible NULL pointer derefernce
  drm/radeon/kms: add quirk for ASUS HD 3600 board
  include/linux/vgaarb.h: add missing part of include guard
  drm/nouveau: Fix crashes during fbcon init on single head cards.
  drm/nouveau: fix pcirom vbios shadow breakage from acpi rom patch
  drm/radeon/kms: fix shared ddc harder
  drm/i915: enable low power render writes on GEN3 hardware.
  drm/i915: Define MI_ARB_STATE bits
  vmwgfx: return -EFAULT if copy_to_user fails
  fb: handle allocation failure in alloc_apertures()
  drm: radeon: check kzalloc() result
  drm/ttm: Fix build on architectures without AGP
  drm/radeon/kms: fix gtt MC base alignment on rs4xx/rs690/rs740 asics
  drm/radeon/kms: fix possible mis-detection of sideport on rs690/rs740
  drm/radeon/kms: fix legacy tv-out pal mode

10 years agodrm/radeon/kms/atom: add crtc disable function
Alex Deucher [Fri, 11 Jun 2010 21:58:38 +0000 (17:58 -0400)]
drm/radeon/kms/atom: add crtc disable function

Disables the crts as per dpms and also disables the ppll
associated with the crtc.  This should save additional power.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm: Return EBUSY if the framebuffer is unbound when flipping.
Chris Wilson [Sat, 17 Jul 2010 19:23:26 +0000 (20:23 +0100)]
drm: Return EBUSY if the framebuffer is unbound when flipping.

It looks like there is a race condition between unbinding a framebuffer
on a hotplug event and user space trying to flip:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
IP: [<ffffffffa008c7d3>] intel_crtc_page_flip+0xc9/0x39c [i915]
PGD 114724067 PUD 1145bd067 PMD 0
Oops: 0000 [#1] SMP
Pid: 10954, comm: X Not tainted 2.6.35-rc5_stable_20100714+ #1
RIP: 0010:[<ffffffffa008c7d3>]  [<ffffffffa008c7d3>]
intel_crtc_page_flip+0xc9/0x39c [i915]
RSP: 0018:ffff880114927cc8  EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff88012df48320 RCX: ffff88010c945600
RDX: ffff880001a109c8 RSI: ffff88010c945840 RDI: ffff88012df48320
RBP: ffff880114927d18 R08: ffff88012df48280 R09: ffff88012df48320
R10: 0000000003c2e0b0 R11: 0000000000003246 R12: ffff88010c945840
R13: ffff88012df48000 R14: 0000000000000060 R15: ffff88012dbb8000
FS:  00007f9e6078e830(0000) GS:ffff880001a00000(0000)
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000058 CR3: 00000001177a8000 CR4: 00000000000406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process X (pid: 10954, threadinfo ffff880114926000, task
 ffff88010c945600 ffff880115b176c0 ffff88012db10000 0000000000000246
<0> fffffff40006101c ffff88010c945600 00000000ffffffea ffff88010c945600
<0> ffff88012df48320 ffff88011b4b6780 ffff880114927d78 ffffffffa003bd0e
Call Trace:
 [<ffffffffa003bd0e>] drm_mode_page_flip_ioctl+0x1bc/0x214 [drm]
 [<ffffffffa00311fc>] drm_ioctl+0x25e/0x35e [drm]
 [<ffffffffa003bb52>] ? drm_mode_page_flip_ioctl+0x0/0x214 [drm]
 [<ffffffff810f1c3c>] vfs_ioctl+0x2a/0x9e
 [<ffffffff810f227e>] do_vfs_ioctl+0x531/0x565
 [<ffffffff810f2307>] sys_ioctl+0x55/0x77
 [<ffffffff810e56d6>] ? sys_read+0x47/0x6f
 [<ffffffff81002a2b>] system_call_fastpath+0x16/0x1b
Code: 45 d4 f4 ff ff ff 0f 84 e0 02 00 00 48 8b 4d b0 49 8d 9d 20 03 00 00 48
89 df 49 89 4c 24 38 49 8b 07 49 89 44 24 20 49 8b 47 20 <48> 8b 40 58 49 c7 04
24 00 00 00 00 49 c7 44 24 18 a9 a5 08 a0
RIP  [<ffffffffa008c7d3>] intel_crtc_page_flip+0xc9/0x39c [i915]
 RSP <ffff880114927cc8>
CR2: 0000000000000058


  Bug 28811 - [page-flipping] GPU hang when modeset after unplugging
              another monitor (under compiz)

Signed-off-by: Chris Wilson <>
Reviewed-by: Jesse Barnes <>
Signed-off-by: Dave Airlie <>
10 years agodrm: add "auto" dithering method
Ben Skeggs [Fri, 16 Jul 2010 05:09:17 +0000 (15:09 +1000)]
drm: add "auto" dithering method

There's no convenient/reliable way for drivers to both obey the dithering
mode property, and to be able to attempt to provide a good default in all

This commit adds an "auto" method to the property which drivers can default
to if they wish, whilst still allowing the user to override the choice as
they do now.

Signed-off-by: Ben Skeggs <>
Signed-off-by: Dave Airlie <>
10 years agodrm/r600: fix possible NULL pointer derefernce
Alex Deucher [Wed, 21 Jul 2010 00:29:32 +0000 (10:29 +1000)]
drm/r600: fix possible NULL pointer derefernce

Reported-by: Alexander Y. Fomichev <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: add quirk for ASUS HD 3600 board
Alex Deucher [Tue, 20 Jul 2010 22:07:22 +0000 (18:07 -0400)]
drm/radeon/kms: add quirk for ASUS HD 3600 board

Connector is actually DVI rather than HDMI.

Reported-by: trapDoor <>
Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agoinclude/linux/vgaarb.h: add missing part of include guard
Doug Goldstein [Tue, 20 Jul 2010 22:22:25 +0000 (15:22 -0700)]
include/linux/vgaarb.h: add missing part of include guard

vgaarb.h was missing the #define of the #ifndef at the top for the guard
to prevent multiple #include's from causing re-define errors

Signed-off-by: Doug Goldstein <>
Cc: Dave Airlie <>
Cc: Jesse Barnes <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Dave Airlie <>
10 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Tue, 20 Jul 2010 23:27:58 +0000 (16:27 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/sage/ceph-client

* 'for-linus' of git://
  ceph: do not include cap/dentry releases in replayed messages
  ceph: reuse request message when replaying against recovering mds
  ceph: fix creation of ipv6 sockets
  ceph: fix parsing of ipv6 addresses
  ceph: fix printing of ipv6 addrs
  ceph: add kfree() to error path
  ceph: fix leak of mon authorizer
  ceph: fix message revocation

10 years agoMerge branch 'linuxdocs' of git://
Linus Torvalds [Tue, 20 Jul 2010 23:27:34 +0000 (16:27 -0700)]
Merge branch 'linuxdocs' of git://git./linux/kernel/git/rdunlap/linux-docs

* 'linuxdocs' of git://
  documentation: fix almost duplicate filenames (IO/io-mapping.txt)

10 years agoMerge git://
Linus Torvalds [Tue, 20 Jul 2010 23:26:42 +0000 (16:26 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git:// (24 commits)
  bridge: Partially disable netpoll support
  tcp: fix crash in tcp_xmit_retransmit_queue
  IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input())
  ibmveth: lost IRQ while closing/opening device leads to service loss
  rt2x00: Fix lockdep warning in rt2x00lib_probe_dev()
  vhost: avoid pr_err on condition guest can trigger
  ipmr: Don't leak memory if fib lookup fails.
  vhost-net: avoid flush under lock
  net: fix problem in reading sock TX queue
  net/core: neighbour update Oops
  net: skb_tx_hash() fix relative to skb_orphan_try()
  rfs: call sock_rps_record_flow() in tcp_splice_read()
  xfrm: do not assume that template resolving always returns xfrms
  hostap_pci: set dev->base_addr during probe
  axnet_cs: use spin_lock_irqsave in ax_interrupt
  dsa: Fix Kconfig dependencies.
  act_nat: not all of the ICMP packets need an IP header payload
  r8169: incorrect identifier for a 8168dp
  Phonet: fix skb leak in pipe endpoint accept()
  Bluetooth: Update sec_level/auth_type for already existing connections

10 years agovfs: fix RCU-lockdep false positive due to /proc
Paul E. McKenney [Tue, 20 Jul 2010 20:24:34 +0000 (13:24 -0700)]
vfs: fix RCU-lockdep false positive due to /proc

If a single-threaded process does a file-descriptor operation, and some
other process accesses that same file descriptor via /proc, the current
rcu_dereference_check_fdtable() can give a false-positive RCU-lockdep
splat due to the reference count being increased by the /proc access after
the reference-count check in fget_light() but before the check in

This commit prevents this false positive by checking for a single-threaded
process.  To avoid #include hell, this commit uses the wrapper for
thread_group_empty(current) defined by rcu_my_thread_group_empty()
provided in a separate commit.

Located-by: Miles Lane <>
Located-by: Eric Dumazet <>
Signed-off-by: Paul E. McKenney <>
Cc: Al Viro <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agosdhci-s3c: add missing remove function
Marek Szyprowski [Tue, 20 Jul 2010 20:24:33 +0000 (13:24 -0700)]
sdhci-s3c: add missing remove function

System will crash sooner or later once the memory with the code of the
s3c-sdhci.ko module is reused for something else. I really have no idea
how the lack of remove function went unnoticed into the mainline code.

Signed-off-by: Marek Szyprowski <>
Signed-off-by: Kyungmin Park <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agoAndres has moved
Andres Salomon [Tue, 20 Jul 2010 20:24:32 +0000 (13:24 -0700)]
Andres has moved

My Collabora address is no longer enabled - update the MODULE_AUTHOR
fields of drivers to my current email address.

Signed-off-by: Andres Salomon <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agox86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is...
Yinghai Lu [Tue, 20 Jul 2010 20:24:31 +0000 (13:24 -0700)]
x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used

Borislav Petkov reported his 32bit numa system has problem:

[    0.000000] Reserving total of 4c00 pages for numa KVA remap
[    0.000000] kva_start_pfn ~ 32800 max_low_pfn ~ 375fe
[    0.000000] max_pfn = 238000
[    0.000000] 8202MB HIGHMEM available.
[    0.000000] 885MB LOWMEM available.
[    0.000000]   mapped low ram: 0 - 375fe000
[    0.000000]   low ram: 0 - 375fe000
[    0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 1000 1000 => 34e7000
[    0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 200 40 => 34c9d80
[    0.000000] alloc (nid=0 100000 - 7ee00000) (1000000 - ffffffffffffffff) 180 40 => 34e6140
[    0.000000] alloc (nid=1 80000000 - c7e60000) (1000000 - ffffffffffffffff) 240 40 => 80000000
[    0.000000] BUG: unable to handle kernel paging request at 40000000
[    0.000000] IP: [<c2c8cff1>] __alloc_memory_core_early+0x147/0x1d6
[    0.000000] *pdpt = 0000000000000000 *pde = f000ff53f000ff00
[    0.000000] Call Trace:
[    0.000000]  [<c2c8b4f8>] ? __alloc_bootmem_node+0x216/0x22f
[    0.000000]  [<c2c90c9b>] ? sparse_early_usemaps_alloc_node+0x5a/0x10b
[    0.000000]  [<c2c9149e>] ? sparse_init+0x1dc/0x499
[    0.000000]  [<c2c79118>] ? paging_init+0x168/0x1df
[    0.000000]  [<c2c780ff>] ? native_pagetable_setup_start+0xef/0x1bb

looks like it allocates too much high address for bootmem.

Try to cut limit with get_max_mapped()

Reported-by: Borislav Petkov <>
Tested-by: Conny Seidel <>
Signed-off-by: Yinghai Lu <>
Cc: <> [2.6.34.x]
Cc: Ingo Molnar <>
Cc: "H. Peter Anvin" <>
Cc: Thomas Gleixner <>
Cc: Johannes Weiner <>
Cc: Lee Schermerhorn <>
Cc: Mel Gorman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agox86, numa: fix boot without RAM on node0 again
Yinghai Lu [Tue, 20 Jul 2010 20:24:30 +0000 (13:24 -0700)]
x86, numa: fix boot without RAM on node0 again

Commit e534c7c5f8d6 ("numa: x86_64: use generic percpu var
numa_node_id() implementation") broke numa systems that don't have ram
on node0 when MEMORY_HOTPLUG is enabled, because cpu_up() will call
cpu_to_node() before per_cpu(numa_node) is setup for APs.

When Node0 doesn't have RAM, on x86, cpus already round it to nearest
node with RAM in x86_cpu_to_node_map.  and per_cpu(numa_node) is not set
up until in c_init for APs.

When later cpu_up() calling cpu_to_node() will get 0 again, and make it
online even there is no RAM on node0.  so later all APs can not booted up,
and later will have panic.

[    1.611101] On node 0 totalpages: 0
[    2.608558] On node 0 totalpages: 0
[    2.612065] Brought up 1 CPUs
[    2.615199] Total of 1 processors activated (3990.31 BogoMIPS).
   93.225341] calling  loop_init+0x0/0x1a4 @ 1
[   93.229314] PERCPU: allocation failed, size=80 align=8, failed to populate
[   93.246539] Pid: 1, comm: swapper Tainted: G        W   2.6.35-rc4-tip-yh-04371-gd64e6c4-dirty #354
[   93.264621] Call Trace:
[   93.266533]  [<ffffffff81125e43>] pcpu_alloc+0x83a/0x8e7
[   93.270710]  [<ffffffff81125f15>] __alloc_percpu+0x10/0x12
[   93.285849]  [<ffffffff8140786c>] alloc_disk_node+0x94/0x16d
[   93.291811]  [<ffffffff81407956>] alloc_disk+0x11/0x13
[   93.306157]  [<ffffffff81503e51>] loop_alloc+0xa7/0x180
[   93.310538]  [<ffffffff8277ef48>] loop_init+0x9b/0x1a4
[   93.324909]  [<ffffffff8277eead>] ? loop_init+0x0/0x1a4
[   93.329650]  [<ffffffff810001f2>] do_one_initcall+0x57/0x136
[   93.345197]  [<ffffffff827486d0>] kernel_init+0x184/0x20e
[   93.348146]  [<ffffffff81034954>] kernel_thread_helper+0x4/0x10
[   93.365194]  [<ffffffff81c7cc3c>] ? restore_args+0x0/0x30
[   93.369305]  [<ffffffff8274854c>] ? kernel_init+0x0/0x20e
[   93.386011]  [<ffffffff81034950>] ? kernel_thread_helper+0x0/0x10
[   93.392047] loop: out of memory

Try to assign per_cpu(numa_node) early

[ tidy up code comment]
Signed-off-by: Yinghai <>
Cc: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: "H. Peter Anvin" <>
Cc: Tejun Heo <>
Cc: Denys Vlasenko <>
Acked-by: Lee Schermerhorn <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agoedac: mpc85xx: add support for MPC8569 EDAC controllers
Anton Vorontsov [Tue, 20 Jul 2010 20:24:28 +0000 (13:24 -0700)]
edac: mpc85xx: add support for MPC8569 EDAC controllers

Simply add a proper ID into the device table.

Signed-off-by: Anton Vorontsov <>
Cc: Doug Thompson <>
Cc: Peter Tyser <>
Cc: Dave Jiang <>
Cc: Kumar Gala <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agoedac: mpc85xx: fix MPC85xx dependency
Anton Vorontsov [Tue, 20 Jul 2010 20:24:27 +0000 (13:24 -0700)]
edac: mpc85xx: fix MPC85xx dependency

Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx:
Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the
driver became non-selectable.

This patch fixes the issue by switching to PPC_85xx symbol.

Signed-off-by: Anton Vorontsov <>
Cc: Doug Thompson <>
Cc: Peter Tyser <>
Cc: Dave Jiang <>
Cc: Kumar Gala <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agomm/vmscan.c: fix mapping use after free
Nick Piggin [Tue, 20 Jul 2010 20:24:25 +0000 (13:24 -0700)]
mm/vmscan.c: fix mapping use after free

We need lock_page_nosync() here because we have no reference to the
mapping when taking the page lock.

Signed-off-by: Nick Piggin <>
Reviewed-by: Johannes Weiner <>
Cc: Mel Gorman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agoipc/sem.c: bugfix for semop() not reporting successful operation
Manfred Spraul [Tue, 20 Jul 2010 20:24:23 +0000 (13:24 -0700)]
ipc/sem.c: bugfix for semop() not reporting successful operation

The last change to improve the scalability moved the actual wake-up out of
the section that is protected by spin_lock(sma->sem_perm.lock).

This means that IN_WAKEUP can be in queue.status even when the spinlock is
acquired by the current task.  Thus the same loop that is performed when
queue.status is read without the spinlock acquired must be performed when
the spinlock is acquired.

Thanks to for noticing lack of the memory


[ clean up kerneldoc, checkpatch warning and whitespace]
Signed-off-by: Manfred Spraul <>
Reported-by: Luca Tettamanti <>
Tested-by: Luca Tettamanti <>
Reported-by: Christoph Lameter <>
Cc: Maciej Rutecki <>
Cc: KAMEZAWA Hiroyuki <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
10 years agodrm/nouveau: Fix crashes during fbcon init on single head cards.
Francisco Jerez [Sat, 10 Jul 2010 15:37:00 +0000 (17:37 +0200)]
drm/nouveau: Fix crashes during fbcon init on single head cards.

this fixes a regression since the fbcon rework.

Signed-off-by: Francisco Jerez <>
Signed-off-by: Ben Skeggs <>
Signed-off-by: Dave Airlie <>
10 years agodrm/nouveau: fix pcirom vbios shadow breakage from acpi rom patch
Ben Skeggs [Mon, 12 Jul 2010 03:15:44 +0000 (13:15 +1000)]
drm/nouveau: fix pcirom vbios shadow breakage from acpi rom patch

On nv50 it became impossible to attempt a PCI ROM shadow of the VBIOS,
which will break some setups.

This patch also removes the different ordering of shadow methods for
pre-nv50 chipsets.  The reason for the different ordering was paranoia,
but it should hopefully be OK to try shadowing PRAMIN first.

Signed-off-by: Ben Skeggs <>
Signed-off-by: Dave Airlie <>
10 years agodrm/radeon/kms: fix shared ddc harder
Alex Deucher [Tue, 20 Jul 2010 15:27:54 +0000 (11:27 -0400)]
drm/radeon/kms: fix shared ddc harder

This fixes a regression caused by b2ea4aa67bfd084834edd070e0a4a47857d6db59
due to the way shared ddc with multiple digital connectors was handled.

You generally have two cases where DDC lines are shared:

HDMI + VGA is easy to deal with because you can check the EDID for the
to see if the attached monitor is digital.  A shared DDC line with two
digital connectors is more complex.  You can't use the hdmi bits in the
EDID since they may not be there with DVI<->HDMI adapters.  In this case
all we can do is check the HPD pins to see which is connected as we have
no way of knowing using the EDID.

Signed-off-by: Alex Deucher <>
Signed-off-by: Dave Airlie <>
10 years agodocumentation: fix almost duplicate filenames (IO/io-mapping.txt)
Randy Dunlap [Mon, 19 Jul 2010 22:20:27 +0000 (22:20 +0000)]
documentation: fix almost duplicate filenames (IO/io-mapping.txt)

Having both IO-mapping.txt and io-mapping.txt in Documentation/
was confusing and/or bothersome to some people, so rename
IO-mapping.txt to bus-virt-phys-mapping.txt.  Also update
Documentation/00-INDEX for both of these files.

Signed-off-by: Randy Dunlap <>
Cc: Kees Bakker <>
Cc: Keith Packard <>
10 years agoMerge git://
Linus Torvalds [Tue, 20 Jul 2010 15:22:15 +0000 (08:22 -0700)]
Merge git://

* git://
  ds2782_battery: Fix ds2782_get_capacity return value

10 years agoASoC: Select wm_hubs automatically for WM8994
Chanwoo Choi [Tue, 20 Jul 2010 05:28:33 +0000 (14:28 +0900)]
ASoC: Select wm_hubs automatically for WM8994

Otherwise all machine drivers need to do so.

Signed-off-by: Chanwoo Choi <>
Signed-off-by: Joonyoung Shim <>
Signed-off-by: Kyungmin Park <>
Acked-by: Liam Girdwood <>
Signed-off-by: Mark Brown <>
10 years agobridge: Partially disable netpoll support
Herbert Xu [Mon, 19 Jul 2010 19:26:45 +0000 (19:26 +0000)]
bridge: Partially disable netpoll support

The new netpoll code in bridging contains use-after-free bugs
that are non-trivial to fix.

This patch fixes this by removing the code that uses skbs after
they're freed.

As a consequence, this means that we can no longer call bridge
from the netpoll path, so this patch also removes the controller
function in order to disable netpoll.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
10 years agodrm/i915: enable low power render writes on GEN3 hardware.
Dave Airlie [Tue, 20 Jul 2010 03:15:31 +0000 (13:15 +1000)]
drm/i915: enable low power render writes on GEN3 hardware.

A lot of 945GMs have had stability issues for a long time, this manifested as X hangs, blitter engine hangs, and lots of crashes.

one such report is at:

along with numerous distro bugzillas.

This only took a week of digging and hair ripping to figure out.

Tracked down and tested on a 945GM Lenovo T60,
previously running
x11perf -copypixwin500
x11perf -copywinpix500
repeatedly would cause the GPU to wedge within 4 or 5 tries, with random busy bits set.

After this patch no hangs were observed.

Signed-off-by: Dave Airlie <>
10 years agodrm/i915: Define MI_ARB_STATE bits
Keith Packard [Tue, 20 Jul 2010 04:12:35 +0000 (21:12 -0700)]
drm/i915: Define MI_ARB_STATE bits

The i915 memory arbiter has a register full of configuration
bits which are currently not defined in the driver header file.

Signed-off-by: Keith Packard <>
Signed-off-by: Dave Airlie <>
10 years agovmwgfx: return -EFAULT if copy_to_user fails
Dan Carpenter [Sat, 10 Jul 2010 14:30:04 +0000 (16:30 +0200)]
vmwgfx: return -EFAULT if copy_to_user fails

copy_to_user() returns the number of bytes remaining to be copied, but
we want to return a negative error code.  This gets copied to user

Signed-off-by: Dan Carpenter <>
Signed-off-by: Dave Airlie <>
10 years agofb: handle allocation failure in alloc_apertures()
Dan Carpenter [Thu, 15 Jul 2010 08:39:47 +0000 (10:39 +0200)]
fb: handle allocation failure in alloc_apertures()

If the kzalloc() fails we should return NULL.  All the places that call
alloc_apertures() check for this already.

Signed-off-by: Dan Carpenter <>
Acked-by: James Simmons <>
Acked-by: Marcin Slusarz <>
Signed-off-by: Dave Airlie <>
10 years agodrm: radeon: check kzalloc() result
Kulikov Vasiliy [Fri, 16 Jul 2010 16:13:33 +0000 (20:13 +0400)]
drm: radeon: check kzalloc() result

If kzalloc() fails exit with -ENOMEM.

Signed-off-by: Kulikov Vasiliy <>
Signed-off-by: Dave Airlie <>
10 years agodrm/ttm: Fix build on architectures without AGP
Ben Hutchings [Sun, 18 Jul 2010 20:51:42 +0000 (21:51 +0100)]
drm/ttm: Fix build on architectures without AGP

Make inclusion of <asm/agp.h> conditional on TTM_HAS_AGP.  The use
of the functions declared in it is already conditional.

Reported-by: Geert Stappers <>
Signed-off-by: Ben Hutchings <>
Tested-by: Geert Stappers <>
Signed-off-by: Dave Airlie <>
10 years agoInput: w90p910_keypad - change platfrom driver name to 'nuc900-kpi'
Wan ZongShun [Mon, 19 Jul 2010 05:23:19 +0000 (22:23 -0700)]
Input: w90p910_keypad - change platfrom driver name to 'nuc900-kpi'

The name of platfrom device was changed and we need to make driver's
name match in order for it to bind to the device.

Signed-off-by: Wan ZongShun <>
Signed-off-by: Dmitry Torokhov <>
10 years agoInput: i8042 - add Gigabyte Spring Peak to dmi_noloop_table
Kamal Mostafa [Mon, 19 Jul 2010 18:00:52 +0000 (11:00 -0700)]
Input: i8042 - add Gigabyte Spring Peak to dmi_noloop_table

Gigabyte "Spring Peak" notebook indicates wrong chassis-type, tripping up
i8042 and breaking the touchpad.  Add this model to i8042_dmi_noloop_table[]
to resolve.

Signed-off-by: Kamal Mostafa <>
Signed-off-by: Dmitry Torokhov <>
10 years agoMerge branch 'shrinker' of git://
Linus Torvalds [Tue, 20 Jul 2010 03:18:24 +0000 (20:18 -0700)]
Merge branch 'shrinker' of git://git./linux/kernel/git/dgc/xfsdev

* 'shrinker' of git://
  xfs: track AGs with reclaimable inodes in per-ag radix tree
  xfs: convert inode shrinker to per-filesystem contexts
  mm: add context argument to shrinker callback

10 years agoMerge git://
Linus Torvalds [Tue, 20 Jul 2010 02:33:02 +0000 (19:33 -0700)]
Merge git://git./linux/kernel/git/mason/btrfs-unstable

* git://
  Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
  Btrfs: fix CLONE ioctl destination file size expansion to block boundary
  Btrfs: fix split_leaf double split corner case

10 years agoxfs: track AGs with reclaimable inodes in per-ag radix tree
Dave Chinner [Mon, 19 Jul 2010 23:43:39 +0000 (09:43 +1000)]
xfs: track AGs with reclaimable inodes in per-ag radix tree

When the filesystem grows to a large number of allocation groups,
the summing of recalimable inodes gets expensive. In many cases,
most AGs won't have any reclaimable inodes and so we are wasting CPU
time aggregating over these AGs. This is particularly important for
the inode shrinker that gets called frequently under memory

To avoid the overhead, track AGs with reclaimable inodes in the
per-ag radix tree so that we can find all the AGs with reclaimable
inodes via a simple gang tag lookup. This involves setting the tag
when the first reclaimable inode is tracked in the AG, and removing
the tag when the last reclaimable inode is removed from the tree.
Then the summation process becomes a loop walking the radix tree
summing AGs with the reclaim tag set.

This significantly reduces the overhead of scanning - a 6400 AG
filesystea now only uses about 25% of a cpu in kswapd while slab
reclaim progresses instead of being permanently stuck at 100% CPU
and making little progress. Clean filesystems filesystems will see
no overhead and the overhead only increases linearly with the number
of dirty AGs.

Signed-off-by: Dave Chinner <>
Reviewed-by: Christoph Hellwig <>
10 years agoxfs: convert inode shrinker to per-filesystem contexts
Dave Chinner [Mon, 19 Jul 2010 22:07:02 +0000 (08:07 +1000)]
xfs: convert inode shrinker to per-filesystem contexts

Now the shrinker passes us a context, wire up a shrinker context per
filesystem. This allows us to remove the global mount list and the
locking problems that introduced. It also means that a shrinker call
does not need to traverse clean filesystems before finding a
filesystem with reclaimable inodes.  This significantly reduces
scanning overhead when lots of filesystems are present.

Signed-off-by: Dave Chinner <>
Reviewed-by: Christoph Hellwig <>
10 years agoBtrfs: fix checks in BTRFS_IOC_CLONE_RANGE
Dan Rosenberg [Mon, 19 Jul 2010 20:58:20 +0000 (16:58 -0400)]
Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE

1.  The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check
whether the donor file is append-only before writing to it.

2.  The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer
overflow that allows a user to specify an out-of-bounds range to copy
from the source file (if off + len wraps around).  I haven't been able
to successfully exploit this, but I'd imagine that a clever attacker
could use this to read things he shouldn't.  Even if it's not
exploitable, it couldn't hurt to be safe.

Signed-off-by: Dan Rosenberg <>
Signed-off-by: Chris Mason <>
10 years agoMerge branch 'x86-fixes-for-linus' of git://
Linus Torvalds [Mon, 19 Jul 2010 20:19:32 +0000 (13:19 -0700)]
Merge branch 'x86-fixes-for-linus' of git://git./linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://
  x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain
  x86: Fix x2apic preenabled system with kexec
  x86: Force HPET readback_cmp for all ATI chipsets

10 years agoMerge branch 'kmemleak' of git://
Linus Torvalds [Mon, 19 Jul 2010 20:18:34 +0000 (13:18 -0700)]
Merge branch 'kmemleak' of git://git./linux/kernel/git/cmarinas/linux-2.6-cm

* 'kmemleak' of git://
  kmemleak: Add support for NO_BOOTMEM configurations
  kmemleak: Annotate false positive in init_section_page_cgroup()

10 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Mon, 19 Jul 2010 20:18:05 +0000 (13:18 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  [S390] cio: fix potential overflow in chpid descriptor
  [S390] add missing device put
  [S390] dasd: use correct label location for diag fba disks

10 years agointel_scu_ipc: Oops/crash fixes
Sreedhara DS [Mon, 19 Jul 2010 08:37:42 +0000 (09:37 +0100)]
intel_scu_ipc: Oops/crash fixes

- fix reversing of command/sub arguments
- fix a crash if the i2c interface is called before the device is found

Signed-off-by: Sreedhara DS <>
Signed-off-by: Alan Cox <>
Signed-off-by: Linus Torvalds <>
10 years agoBtrfs: fix CLONE ioctl destination file size expansion to block boundary
Sage Weil [Sat, 12 Jun 2010 22:31:14 +0000 (22:31 +0000)]
Btrfs: fix CLONE ioctl destination file size expansion to block boundary

The CLONE and CLONE_RANGE ioctls round up the range of extents being
cloned to the block size when the range to clone extends to the end of file
(this is always the case with CLONE).  It was then using that offset when
extending the destination file's i_size.  Fix this by not setting i_size
beyond the originally requested ending offset.

This bug was introduced by a22285a6 (2.6.35-rc1).

Signed-off-by: Sage Weil <>
Signed-off-by: Chris Mason <>
10 years agoBtrfs: fix split_leaf double split corner case
Chris Mason [Wed, 7 Jul 2010 14:51:48 +0000 (10:51 -0400)]
Btrfs: fix split_leaf double split corner case

split_leaf was not properly balancing leaves when it was forced to
split a leaf twice.  This commit adds an extra push left and right
before forcing the double split in hopes of getting the slot where
we want to insert at either the start or end of the leaf.

If the extra pushes do work, then we are able to avoid splitting twice
and we keep the tree properly balanced.

Signed-off-by: Chris Mason <>
10 years agotcp: fix crash in tcp_xmit_retransmit_queue
Ilpo Järvinen [Mon, 19 Jul 2010 01:16:18 +0000 (01:16 +0000)]
tcp: fix crash in tcp_xmit_retransmit_queue

It can happen that there are no packets in queue while calling
tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns
NULL and that gets deref'ed to get sacked into a local var.

There is no work to do if no packets are outstanding so we just
exit early.

This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out
guard to make joining diff nicer).

Signed-off-by: Ilpo Järvinen <>
Reported-by: Lennart Schulte <>
Tested-by: Lennart Schulte <>
Signed-off-by: David S. Miller <>
10 years agoMerge branch 'master' of git://
David S. Miller [Mon, 19 Jul 2010 19:38:51 +0000 (12:38 -0700)]
Merge branch 'master' of git://git./linux/kernel/git/linville/wireless-2.6

10 years agokmemleak: Add support for NO_BOOTMEM configurations
Catalin Marinas [Mon, 19 Jul 2010 10:54:15 +0000 (11:54 +0100)]
kmemleak: Add support for NO_BOOTMEM configurations

With commits 08677214 and 59be5a8e, alloc_bootmem()/free_bootmem() and
friends use the early_res functions for memory management when
NO_BOOTMEM is enabled. This patch adds the kmemleak calls in the
corresponding code paths for bootmem allocations.

Signed-off-by: Catalin Marinas <>
Acked-by: Pekka Enberg <>
Acked-by: Yinghai Lu <>
Cc: H. Peter Anvin <>
10 years agokmemleak: Annotate false positive in init_section_page_cgroup()
Catalin Marinas [Mon, 19 Jul 2010 10:54:14 +0000 (11:54 +0100)]
kmemleak: Annotate false positive in init_section_page_cgroup()

The pointer to the page_cgroup table allocated in
init_section_page_cgroup() is stored in section->page_cgroup as (base -
pfn). Since this value does not point to the beginning or inside the
allocated memory block, kmemleak reports a false positive.

This was reported in as #16297.

Signed-off-by: Catalin Marinas <>
Reported-by: Adrien Dessemond <>
Reviewed-by: KAMEZAWA Hiroyuki <>
Cc: Pekka Enberg <>
Cc: Andrew Morton <>
10 years ago[S390] cio: fix potential overflow in chpid descriptor
Sebastian Ott [Mon, 19 Jul 2010 07:22:37 +0000 (09:22 +0200)]
[S390] cio: fix potential overflow in chpid descriptor

The length filed in the chsc response block (if valid)
has a value of n*(sizeof(chp_desc))+8 (for the response
block header). When we memcopied from the response block
to the actual descriptor we copied 8 bytes too much.
The bug was not revealed since the descriptor is embedded
in struct channel_path.
Since we only write one descriptor at a time ignore the
length value and use sizeof(*desc).

Signed-off-by: Sebastian Ott <>
Signed-off-by: Martin Schwidefsky <>
10 years ago[S390] add missing device put
Stefan Haberland [Mon, 19 Jul 2010 07:22:36 +0000 (09:22 +0200)]
[S390] add missing device put

The dasd_alias_show function does not return a device reference
in case the device is an alias.

Signed-off-by: Stefan Haberland <>
Signed-off-by: Martin Schwidefsky <>
10 years ago[S390] dasd: use correct label location for diag fba disks
Peter Oberparleiter [Mon, 19 Jul 2010 07:22:35 +0000 (09:22 +0200)]
[S390] dasd: use correct label location for diag fba disks

Partition boundary calculation fails for DASD FBA disks under the
following conditions:
- disk is formatted with CMS FORMAT with a blocksize of more than
  512 bytes
- all of the disk is reserved to a single CMS file using CMS RESERVE
- the disk is accessed using the DIAG mode of the DASD driver

Under these circumstances, the partition detection code tries to
read the CMS label block containing partition-relevant information
from logical block offset 1, while it is in fact located at physical
block offset 1.

Fix this problem by using the correct CMS label block location
depending on the device type as determined by the DASD SENSE ID

Signed-off-by: Peter Oberparleiter <>
Signed-off-by: Martin Schwidefsky <>
10 years agocrypto: talitos - fix bug in sg_copy_end_to_buffer
Lee Nipper [Mon, 19 Jul 2010 06:11:24 +0000 (14:11 +0800)]
crypto: talitos - fix bug in sg_copy_end_to_buffer

In function sg_copy_end_to_buffer, too much data
is copied when a segment in the scatterlist
has .length greater than the requested copy length.

This patch adds the limit checks to fix this bug of over copying,
which affected only the ahash algorithms.

Signed-off-by: Lee Nipper <>
Acked-by: Kim Phillips <>
Signed-off-by: Herbert Xu <>
10 years agomm: add context argument to shrinker callback
Dave Chinner [Mon, 19 Jul 2010 04:56:17 +0000 (14:56 +1000)]
mm: add context argument to shrinker callback

The current shrinker implementation requires the registered callback
to have global state to work from. This makes it difficult to shrink
caches that are not global (e.g. per-filesystem caches). Pass the shrinker
structure to the callback so that users can embed the shrinker structure
in the context the shrinker needs to operate on and get back to it in the
callback via container_of().

Signed-off-by: Dave Chinner <>
Reviewed-by: Christoph Hellwig <>