This patch corrects a userspace pointer dereference in the VGA arbiter
in 2.6.32.1.

copy_from_user() is used at line 822 to copy the contents of buf into
kbuf, but a call to strncmp() on line 964 uses buf rather than kbuf.  This
problem led to a GPF in strncmp() when X was started on my x86_32 systems.
 X triggered the behavior with a write of "target PCI:0000:01:00.0" to
/dev/vga_arbiter.

The patch has been tested against 2.6.32.1 and observed to correct the GPF
observed when starting X or manually writing the string "target
PCI:0000:01:00.0" to /dev/vga_arbiter.
Signed-off-by: NAndy Getzendanner <james.getzendanner@students.olin.edu>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

* 'drm-radeon-linus' of ../drm-next:
  drm/radeon/kms: retry auxch on 0x20 timeout value.
  drm/radeon: Skip dma copy test in benchmark if card doesn't have dma engine.
  drm/radeon/kms: fix screen clearing before fbcon.
  drm/radeon/kms: add quirk for VGA without DDC on rv730 XFX card.
  drm/radeon/kms: don't crash if no DDC bus on VGA/DVI connector.
  drm/radeon/kms: change Kconfig text to reflect the new option.
  drm/radeon/kms: suspend and resume audio stuff

ATOM appears to return 0x20 which seems to mean some sort of timeout.

retry the transaction up to 10 times before failing, this
makes DP->VGA convertor we bought work at least a bit more predictably.
Signed-off-by: NDave Airlie <airlied@redhat.com>

radeon_copy_dma is only available for r200 or newer cards.
Call to radeon_copy_dma would result to NULL pointer
dereference if benchmarking asic without dma engine.
Signed-off-by: NPauli Nieminen <suokkos@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

* 'nouveau/for-airlied' of /home/airlied/kernel/drm-next:
  nouveau: fix state detection with switchable graphics
  drm/nouveau: move dereferences after null checks
  drm/nv50: make the pgraph irq handler loop like the pre-nv50 version
  drm/nv50: delete ramfc object after disabling fifo, not before
  drm/nv50: avoid unloading pgraph context when ctxprog is running
  drm/nv50: align size of buffer object to the right boundaries.
  drm/nv50: disregard dac outputs in nv50_sor_dpms()
  drm/nv50: prevent multiple init tables being parsed at the same time
  drm/nouveau: make dp auxch xfer len check for reads only
  drm/nv40: make INIT_COMPUTE_MEM a NOP, just like nv50
  drm/nouveau: Add proper vgaarb support.
  drm/nouveau: Fix fbcon on mixed pre-NV50 + NV50 multicard.
  drivers/gpu/drm/nouveau/nouveau_grctx.c: correct NULL test
  drm/nouveau: call ttm_bo_wait with the bo lock held to prevent hang
  drm/nouveau: Fixup semaphores on pre-nv50 cards.
  drm/nouveau: Add getparam to get available PGRAPH units.
  drm/nouveau: Add module options to disable acceleration.
  drm/nouveau: fix non-vram notifier blocks

Signed-off-by: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Even if this bumps the version to 1 it does not mean the driver is
out of staging. From what we know this is the last backwards
incompatible change to the driver.
Signed-off-by: NJakob Bornecrantz <jakob@vmware.com>
Signed-off-by: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Signed-off-by: NJakob Bornecrantz <jakob@vmware.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

When time-based throttling is implemented, we need to bump minor.
When the old way of detecting scanout is removed, we need to bump major.
In the meantime, this change should not break existing user-space.
Signed-off-by: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NJakob Bornecrantz <jakob@vmware.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This memset_io was added to debug something way back and got
left behind, memset the fb to black so the borders don't be all white.
Signed-off-by: NDave Airlie <airlied@redhat.com>

Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Reported-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: NMaarten Maathuis <madman2003@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  i2c-tiny-usb: Fix on big-endian systems

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] Fix struct _lowcore layout.
  [S390] qdio: prevent call trace if CHPID is offline
  [S390] qdio: continue polling for buffer state ERROR

* 'kvm-updates/2.6.33' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: PIT: control word is write-only
  kvmclock: count total_sleep_time when updating guest clock
  Export the symbol of getboottime and mmonotonic_to_bootbased

* git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6:
  avr32: clean up memory allocation in at32_add_device_mci
  arch/avr32: Fix build failure for avr32 caused by typo

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Fix address masking bug in hpte_need_flush()

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: fix dentry hash calculation for case-insensitive mounts
  [CIFS] Don't cache timestamps on utimes due to coarse granularity
  [CIFS] Maximum username length check in session setup does not match
  cifs: fix length calculation for converted unicode readdir names
  [CIFS] Add support for TCP_NODELAY

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (29 commits)
  drivers/net: Correct NULL test
  MAINTAINERS: networking drivers - Add git net-next tree
  net/sched: Fix module name in Kconfig
  cxgb3: fix GRO checksum check
  dst: call cond_resched() in dst_gc_task()
  netfilter: nf_conntrack: fix hash resizing with namespaces
  netfilter: xtables: compat out of scope fix
  netfilter: nf_conntrack: restrict runtime expect hashsize modifications
  netfilter: nf_conntrack: per netns nf_conntrack_cachep
  netfilter: nf_conntrack: fix memory corruption with multiple namespaces
  Bluetooth: Keep a copy of each HID device's report descriptor
  pktgen: Fix freezing problem
  igb: make certain to reassign legacy interrupt vectors after reset
  irda: add missing BKL in irnet_ppp ioctl
  irda: unbalanced lock_kernel in irnet_ppp
  ixgbe: Fix return of invalid txq
  ixgbe: Fix ixgbe_tx_map error path
  netxen: protect resource cleanup by rtnl lock
  netxen: fix tx timeout recovery for NX2031 chip
  Bluetooth: Enter active mode before establishing a SCO link.
  ...

Commit f71dc176 'Make
hpte_need_flush() correctly mask for multiple page sizes' introduced
bug, which is triggered when a kernel with a 64k base page size is run
on a system whose hardware does not 64k hash PTEs.  In this case, we
emulate 64k pages with multiple 4k hash PTEs, however in
hpte_need_flush() we incorrectly only mask the hardware page size from
the address, instead of the logical page size.  This causes things to
go wrong when we later attempt to iterate through the hardware
subpages of the logical page.

This patch corrects the error.  It has been tested on pSeries bare
metal by Michael Neuling.
Signed-off-by: NDavid Gibson <dwg@au1.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

* 'for-linus' of git://neil.brown.name/md:
  md: fix some lockdep issues between md and sysfs.
  md: fix 'degraded' calculation when starting a reshape.

======
This fix is related to
    http://bugzilla.kernel.org/show_bug.cgi?id=15142
but does not address that exact issue.
======

sysfs does like attributes being removed while they are being accessed
(i.e. read or written) and waits for the access to complete.

As accessing some md attributes takes the same lock that is held while
removing those attributes a deadlock can occur.

This patch addresses 3 issues in md that could lead to this deadlock.

Two relate to calling flush_scheduled_work while the lock is held.
This is probably a bad idea in general and as we use schedule_work to
delete various sysfs objects it is particularly bad.

In one case flush_scheduled_work is called from md_alloc (called by
md_probe) called from do_md_run which holds the lock.  This call is
only present to ensure that ->gendisk is set.  However we can be sure
that gendisk is always set (though possibly we couldn't when that code
was originally written.  This is because do_md_run is called in three
different contexts:
  1/ from md_ioctl.  This requires that md_open has succeeded, and it
     fails if ->gendisk is not set.
  2/ from writing a sysfs attribute.  This can only happen if the
     mddev has been registered in sysfs which happens in md_alloc
     after ->gendisk has been set.
  3/ from autorun_array which is only called by autorun_devices, which
     checks for ->gendisk to be set before calling autorun_array.
So the call to md_probe in do_md_run can be removed, and the check on
->gendisk can also go.


In the other case flush_scheduled_work is being called in do_md_stop,
purportedly to wait for all md_delayed_delete calls (which delete the
component rdevs) to complete.  However there really isn't any need to
wait for them - they have already been disconnected in all important
ways.

The third issue is that raid5->stop() removes some attribute names
while the lock is held.  There is already some infrastructure in place
to delay attribute removal until after the lock is released (using
schedule_work).  So extend that infrastructure to remove the
raid5_attrs_group.

This does not address all lockdep issues related to the sysfs
"s_active" lock.  The rest can be address by splitting that lockdep
context between symlinks and non-symlinks which hopefully will happen.
Signed-off-by: NNeilBrown <neilb@suse.de>

Unset the bit that indicates that a ctxprog can continue at the end.
Signed-off-by: NMaarten Maathuis <madman2003@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

ramfc is zero'ed upon destruction, so it's safer to do things in the right
order.
Signed-off-by: NMaarten Maathuis <madman2003@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

- We need to disable pgraph fifo access before checking the current channel,
  otherwise we could still hit a running ctxprog.
- The writes to 0x400500 are already handled by pgraph->fifo_access and are
  therefore redundant, moreover pgraph fifo access should not be reenabled
  before current context is set as invalid. So remove them altogether.
Signed-off-by: NMaarten Maathuis <madman2003@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

- In the current situation the padding that is added is dangerous to write
  to, userspace could potentially overwrite parts of another bo.
- Depth and stencil buffers are supposed to be large enough in general so
  the waste of memory should be acceptable.
- Alternatives are hiding the padding from users or splitting vram into 2
  zones.
Signed-off-by: NMaarten Maathuis <madman2003@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Fixes DVI+VGA on my 9400, and likely a lot of other configurations that
got broken by the previos DVI-over-DP fix.
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

With DVI and DP plugged, the DVI clock change interrupts being run can
cause DP link training to fail.  This adds a spinlock around init table
parsing to prevent this.
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: fix p9_client_destroy unconditional calling v9fs_put_trans
  9p: fix memory leak in v9fs_parse_options()
  9p: Fix the kernel crash on a failed mount
  9p: fix option parsing
  9p: Include fsync support for 9p client
  net/9p: fix statsize inside twstat
  net/9p: fail when user specifies a transport which we can't find
  net/9p: fix virtio transport to correctly update status on connect

PIT control word (address 0x43) is write-only, reads are undefined.

Cc: stable@kernel.org
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

Current kvm wallclock does not consider the total_sleep_time which could cause
wrong wallclock in guest after host suspend/resume. This patch solve
this issue by counting total_sleep_time to get the correct host boot time.

Cc: stable@kernel.org
Signed-off-by: NJason Wang <jasowang@redhat.com>
Acked-by: NGlauber Costa <glommer@redhat.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

Export getboottime and monotonic_to_bootbased in order to let them
could be used by following patch.

Cc: stable@kernel.org
Signed-off-by: NJason Wang <jasowang@redhat.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

Offsets and sizes are wrong for 32 bit.
Got broken with 866ba284 "[S390] cleanup lowcore.h".
Reported-by: NMahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

If a CHPID is offline during a device shutdown the ccw_device_halt|clear
may fail and the qdio device stays in state STOPPED until the shutdown is
finished. If an interrupt occurs before the device is set to INACTIVE
the STOPPED state triggers a WARN_ON in the interrupt handler.
Prevent this WARN_ON by catching the STOPPED state in the interrupt
handler.
Signed-off-by: NJan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Inbound traffic handling may hang if next buffer to check is in
state ERROR, polling is stopped and the final check for further
available inbound buffers disregards buffers in state ERROR.
This patch includes state ERROR when checking availability of
more inbound buffers.

Cc: Jan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: NUrsula Braun <ursula.braun@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Test the value that was just allocated rather than the previously tested one.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r@
expression *x;
expression e;
identifier l;
@@

if (x == NULL || ...) {
    ... when forall
    return ...; }
... when != goto l;
    when != x = e
    when != &x
*x == NULL
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

During the rc period, patches that are not bugfixes
should be done using the net-next tree.
Signed-off-by: NJoe Perches <joe@perches.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The action modules have been prefixed with 'act_', but the Kconfig
description was not changed.
Signed-off-by: NJan Luebbe <jluebbe@debian.org>
Acked-by: NJamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Verify the HW checksum state for frames handed to GRO processing.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>