Although I'd consider this a hardware bug, as there is hardware out that
for whatever reason does not support hardware cursors on LCD output we
have to care about it in the driver.  This fixes a regression (invisible
cursor) introduced by:

    viafb: cleanup viafb_cursor
Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat@gmx.de>
Reported-by: Julian Wollrath <jwollrath@web.de>
Tested-by: Julian Wollrath <jwollrath@web.de>
Cc: Scott Fang <ScottFang@viatech.com.cn>
Cc: Joseph Chan <JosephChan@via.com.tw>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix a wrong optimization in include/linux/kfifo.h which could cause a race
in kfifo_out_locked.
Signed-off-by: Stefani Seibold <stefani@seibold.net>
Reported-by: Johan Hovold <jhovold@gmail.com>
Cc: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
  drm/i915: enable 36bit physical address for hardware status page
  drm/i915: fix eDP pipe mask
  drm/i915: fix pixel color depth setting on eDP
  drm/i915: parse eDP panel color depth from VBT block
  drm/i915: disable LVDS downclock by default
  drm/i915: Fix the incorrect cursor A bit definition in DSPFW2 register
  drm/i915: Remove chatty execbuf failure message.
  drm/i915: remove loop in Ironlake interrupt handler
  drm/i915: Don't wait interruptible for possible plane buffer flush
  drm/i915: try another possible DDC bus for the SDVO device with multiple outputs
  drm/i915: Read the response after issuing DDC bus switch command
  drm/i915: Don't use the child device parsed from VBT to setup HDMI/DP
  drm/i915: Fix resume regression on MSI Wind U100 w/o KMS
  drm/i915: Fix Ironlake M/N/P ranges to match the spec
  drm/i915: Use find_pll function to calculate DPLL setting for LVDS downclock
  drm/i915: Add HP nx9020/SamsungSX20S to ACPI LID quirk list
  drm/i915: disable TV hotplug status check

Trivial conflicts in drivers/gpu/drm/i915/i915_drv.c due to i915
non-modeset suspend fix with different comment.

* 'for-linus/samsung' of git://git.fluff.org/bjdooks/linux:
  ARM: MINI2440: Fixup __initdata usage
  ARM: MINI2440: Fix crash on boot due to improper __initdata qualifier
  ARM: SMDK6410: Specify no GPIO for B_PWR_5V regulator
  ARM: S3C: NAND: Check the existence of nr_map before copying

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
  amd64_edac: Ensure index stays within bounds in amd64_get_scrub_rate

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: sentelic - fix left/right horizontal scroll mapping
  Input: pmouse - move Sentelic probe down the list
  Input: add compat support for sysfs and /proc capabilities output
  Input: i8042 - add Dritek quirk for Acer Aspire 5610.
  Input: xbox - do not use GFP_KERNEL under spinlock
  Input: psmouse - fix Synaptics detection when protocol is disabled
  Input: bcm5974 - report ABS_MT events
  Input: davinci_keyscan - add device_enable method to platform data
  Input: evdev - be less aggressive about sending SIGIO notifies
  Input: atkbd - fix canceling event_work in disconnect
  Input: serio - fix potential deadlock when unbinding drivers
  Input: gf2k - fix &&/|| confusion in gf2k_connect()

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha-2.6:
  alpha: cpumask_of_node() should handle -1 as a node
  alpha: add myself as a maintainer, and drop mention of 2.4

* 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  serial: sh-sci: using correct fifo size for SCIF and SCIFA ports.
  sh: mach-ecovec24: Add motion sensor driver support.

This enables possible 36bit address mask on 965G that use physical
address for hw status page.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

inotify will WARN() if it finds that the idr and the fsnotify internals
somehow got out of sync.  It was only supposed to do this once but due
to this stupid bug it would warn every single time a problem was
detected.
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Since commit 7e790dd5 ("inotify: fix
error paths in inotify_update_watch") inotify changed the manor in which
it gave watch descriptors back to userspace.  Previous to this commit
inotify acted like the following:

  inotify_add_watch(X, Y, Z) = 1
  inotify_rm_watch(X, 1);
  inotify_add_watch(X, Y, Z) = 2

but after this patch inotify would return watch descriptors like so:

  inotify_add_watch(X, Y, Z) = 1
  inotify_rm_watch(X, 1);
  inotify_add_watch(X, Y, Z) = 1

which I saw as equivalent to opening an fd where

  open(file) = 1;
  close(1);
  open(file) = 1;

seemed perfectly reasonable.  The issue is that quite a bit of userspace
apparently relies on the behavior in which watch descriptors will not be
quickly reused.  KDE relies on it, I know some selinux packages rely on
it, and I have heard complaints from other random sources such as debian
bug 558981.

Although the man page implies what we do is ok, we broke userspace so
this patch almost reverts us to the old behavior.  It is still slightly
racey and I have patches that would fix that, but they are rather large
and this will fix it for all real world cases.  The race is as follows:

 - task1 creates a watch and blocks in idr_new_watch() before it updates
   the hint.
 - task2 creates a watch and updates the hint.
 - task1 updates the hint with it's older wd
 - task removes the watch created by task2
 - task adds a new watch and will reuse the wd originally given to task2

it requires moving some locking around the hint (last_wd) but this should
solve it for the real world and be -stable safe.

As a side effect this patch papers over a bug in the lib/idr code which
is causing a large number WARN's to pop on people's system and many
reports in kerneloops.org.  I'm working on the root cause of that idr
bug seperately but this should make inotify immune to that issue.
Signed-off-by: Eric Paris <eparis@redhat.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

eDP could be on pipe A or B.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

Original DP mode_valid check didn't take pixel color depth into account,
which made one 1600x900 eDP panel's mode check invalid because of overclock,
but actually this 6bpc panel does can work with x1 lane at 2.7G. This one
trys to take bpp value properly both in mode validation and mode setting.
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

Many platform support this feature, and it can provide significant
power savings when the reduced refresh rate is low.  However, on some
platforms a secondary (reduced) timing is provided but not actually
supported by the hardware.  This results in undesirable flicker at
runtime.

So disable the feature by default, but allow users to opt-in to the
reduced clock behavior with a new module parameter, lvds_downclock,
that can be set to 1 to enable the feature.
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Eric Anholt <eric@anholt.net>

Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Eric Anholt <eric@anholt.net>

Suggested-by: Chris Wilson <chris@chris-wilson.co.uk&gt;>
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org> (in principle)
Signed-off-by: Eric Anholt <eric@anholt.net>

On Ironlake, there is an interrupt master control bit. With the bit
disabled before clearing IIR, we do not need to handle extra interrupt
in a loop. This patch removes the loop in Ironlake interrupt handler.
It fixed irq lost issue on some Ironlake platforms.

Cc: Stable Team <stable@kernel.org>
Signed-off-by: Zou Nan hai <Nanhai.zou@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Eric Anholt <eric@anholt.net>

Add a missing iterator variable thus fixing the conditional of the
for-loop in amd64_get_scrub_rate().
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>

Remove some of the __initdata tags which are currently inappropriate for
platform_device and some of the platform data. These can be returned once
support for copying platform devices and data is added.
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

This patch fix mini2440 crash on boot due to improper __initdata
qualifier on mini2440_led1_pdata.
Signed-off-by: Uri Yosef <uri.yosef@gmail.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

Since the fixed voltage regulator grew support for GPIO based
enables and GPIO 0 is valid on some systems we need to specify
that there is no valid GPIO enable control.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

The sh-sci driver used the wrong fifosize for PORT_SCIFA and PORT_SCIF
ports. If an incorrect size is used, the serial core will enforce an
early shutdown on the port, especially with baudrates < 9600.
Signed-off-by: Markus Pietrek <Markus.Pietrek@emtrion.de>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This patch adds support for the lis3lv02d motion sensor connected via
i2c on the Ecovec board. Tested with evtest.
Signed-off-by: NISHIMOTO Hiroki <nishimoto.hiroki@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

CC: Richard Henderson <rth@twiddle.net>
CC: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Matt Turner <mattst88@gmail.com>
CC: linux-alpha@vger.kernel.org
CC: Rusty Russell <rusty@rustcorp.com.au>
CC: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Anton Blanchard <anton@samba.org>

CC: Richard Henderson <rth@twiddle.net>
CC: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
CC: linux-alpha@vger.kernel.org
Signed-off-by: Matt Turner <mattst88@gmail.com>

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] tape_char: add missing compat_ptr conversion
  [S390] zcrypt: add sanity check before copy_from_user()
  [S390] unwire sys_recvmmsg again
  [S390] con3215: remove empty ioctl function
  [S390] dasd: add proper compat pointer conversion for symmetrix ioctl
  [S390] mmap: add missing compat_ptr conversion to both mmap compat syscalls
  [S390] bug: implement arch specific __WARN macro
  [S390] Move __cpu_logical_map to smp.c
  [S390] tape_block: remove ioctl function
  [S390] smp: remove volatile type quilifier from __cpu_logical_map
  [S390] smp: setup smp_processor_id early
  [S390] use helpers for rlimits
  [S390] fs3270: add missing compat ptr conversion
  [S390] vmcp: add missing compat ptr conversion
  [S390] cio: add missing compat ptr conversion
  [S390] dasd: add missing compat ptr conversion
  [S390] remove superfluous TIF_USEDFPU bit
  [S390] duplicate SIGTRAP on signal delivery.
  [S390] clear TIF_SINGLE_STEP for new process.
  [S390] fix loading of PER control registers for utrace.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (34 commits)
  net: fix build erros with CONFIG_BUG=n, CONFIG_GENERIC_BUG=n
  ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().
  tg3: Update copyright and driver version
  tg3: Disable 5717 serdes and B0 support
  tg3: Add reliable serdes detection for 5717 A0
  tg3: Fix std rx prod ring handling
  tg3: Fix std prod ring nicaddr for 5787 and 57765
  sfc: Fix conditions for MDIO self-test
  sfc: Fix polling for slow MCDI operations
  e1000e: workaround link issues on busy hub in half duplex on 82577/82578
  e1000e: MDIO slow mode should always be done for 82577
  ixgbe: update copyright dates
  ixgbe: Do not attempt to perform interrupts in netpoll when down
  cfg80211: fix refcount imbalance when wext is disabled
  mac80211: fix queue selection for data frames on monitor interfaces
  iwlwifi: silence buffer overflow warning
  iwlwifi: disable tx on beacon update notification
  iwlwifi: fix iwl_queue_used bug when read_ptr == write_ptr
  mac80211: fix endian error
  mac80211: add missing sanity checks for action frames
  ...

Since the structure field nr_map is optional, we need to check whether the
chip number map is provided to avoid unexpected NULL pointer exception.
Signed-off-by: Ramax Lo <ramaxlo@gmail.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

Fixed build errors introduced by commit 7ad6848c (ip: fix mc_loop
checks for tunnels with multicast outer addresses)
Signed-off-by: Octavian Purdila <opurdila@ixiacom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes CERT-FI FICORA #341748

Discovered by Olli Jarva and Tuomo Untinen from the CROSS
project at Codenomicon Ltd.

Just like in CVE-2007-4567, we can't rely upon skb_dst() being
non-NULL at this point.  We fixed that in commit
e76b2b25 ("[IPV6]: Do no rely on
skb->dst before it is assigned.")

However commit 483a47d2 ("ipv6: added
net argument to IP6_INC_STATS_BH") put a new version of the same bug
into this function.

Complicating analysis further, this bug can only trigger when network
namespaces are enabled in the build.  When namespaces are turned off,
the dev_net() does not evaluate it's argument, so the dereference
would not occur.

So, for a long time, namespaces couldn't be turned on unless SYSFS was
disabled.  Therefore, this code has largely been disabled except by
people turning it on explicitly for namespace development.

With help from Eugene Teo <eugene@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch updates the copyright notice for 2010 and updates the version
number to 3.106.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The B0 revision of the 5717 will not get enough testing by the time
2.6.33 ships.  Since the kernel is already at RC3, serdes support
will require too many patches to fix.  For these reasons, this patch
disables 5717 serdes support and will refuse to attach to all 5717
devices that are later than an A0 revision.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The serdes status bit does not work as intended for the 5717 A0.
This patch implements an alternative detection scheme that will only be
valid for A0 revisions.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There are some tg3 devices that require the driver to post new rx
buffers in smaller increments.  Commit
4361935a, "tg3: Consider
rx_std_prod_idx a hw mailbox" changed how the driver tracks the rx
producer ring updates, but it does not make any special considerations
for the above-mentioned devices.  For those devices, it is possible for
the driver to hit the special case path, which updates the hardware
mailbox register but skips updating the shadow software mailbox member.
If the special case path represents the final mailbox update for this
ISR iteration, the hardware and software mailbox values will be out of
sync.  Ultimately, this will cause the driver to use a stale mailbox
value on the next iteration, which will appear to the hardware as a
large rx buffer update.  Bad things ensue.

The fix is to update the software shadow mailbox member when the special
case path is taken.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 87668d35, titled "tg3: Don't
touch RCB nic addresses", tried to avoid assigning the nic address of
the standard producer ring.  Unfortunately, the default nic address is
not correct for the 5787, the 5755M, or the 57765.  This patch
reenables the old behavior and opts out of the assignment only
for the 5717.
Signed-off-by: Matt Carlson <mcarlson@broadcom.com>
Reviewed-by: Michael Chan <mchan@broadcom.com>
Tested-by: Chow Loong Jin <hyperair@ubuntu.com>
Tested-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>

The MDIO self-test should not be run on boards without an MDIO PHY,
such as SFN5122F-R3 and later revisions.  It should also not try to
address a specific MMD in an MDIO clause 22 PHY.  Check the
mode_support field to decide which mode to use, if any.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When the interface is down and we are using polled mode for MCDI
operations, we busy-wait for completion for approximately 1 jiffy
using udelay() and then back off to schedule().  But the completion
will not wake the task, since we are using polled mode!  We must use
schedule_timeout_uninterruptible() instead.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch removes a delay in hardware after every received packet allowing
more time for transmitted packets to go out in between received packets in
half duplex.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

A previous 82577 workaround that set the MDIO access speed to slow mode for
every PHY register read/write when the cable is unplugged should instead
set the access mode to always be slow before any PHY register access.
Since the mode bit gets cleared when the PHY is reset, set the mode after
every PHY reset.
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>