(regression fix since fbdev/kms rework).

My fb rework didn't remember about the 84/65s.
Reported-by: NOndrej Zary <linux@rainbow-software.org>
Tested-by: NOndrej Zary <linux@rainbow-software.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This reverts commit 962400e8, which was
entirely bogus.

The code used to multiply the character offset by "vc->vc_cols", and
that's actually correct, because 'd' itself is an 'unsigned short'.  So
the pointer arithmetic already takes the size of a VGA character into
account.  Changing it to use vc_size_row (which is just "vc_cols"
shifted up to take the size of the character into account) ends up
multiplying with the VGA character size twice.

This got reported as bugs for various other subsystems, because what it
actually results in is writing the 16-bit vc_video_erase_char pattern
(usually 0x0720: 0x07 is the default attribute, 0x20 is ASCII space)
into some random other allocation.

So Markus ended up reporting this as a ext4 bug, while to Torsten Kaiser
it looked like a problem with KMS or libata.  Jeff Chua saw it in
different places.

And finally - Justin Mattock had slab poisoning enabled, and saw it as a
slab poison overwritten.  And bisected and reverted this to verify the
buggy commit.
Reported-by: NMarkus Trippelsdorf <markus@trippelsdorf.de>
Reported-by: NTorsten Kaiser <just.for.lkml@googlemail.com>
Reported-by: NJeff Chua <jeff.chua.linux@gmail.com>
Reported-by: NJustin P. Mattock <justinmattock@gmail.com>
Reported-bisected-and-tested-by: NJustin P. Mattock <justinmattock@gmail.com>
Acked-by: NDave Airlie <airlied@redhat.com>
Cc: Frank Pan <frankpzh@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Cursors need to be in the GTT domain when being accessed by the GPU.
Previously this was a fortuitous byproduct of userspace using pwrite()
to upload the image data into the cursor. The redundant clflush was
removed in commit 9b8c4a and so the image was no longer being flushed
out of the caches into main memory. One could also devise a scenario
where the cursor was rendered by the GPU, prior to being attached as the
cursor, resulting in similar corruption due to the missing MI_FLUSH.

Fixes:

  Bug 28335 - Cursor corruption caused by commit 9b8c4a0b
  https://bugs.freedesktop.org/show_bug.cgi?id=28335Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Reported-and-tested-by: NJeff Chua <jeff.chua.linux@gmail.com>
Tested-by: NLinus Torvalds <torvalds@linux-foundation.org>
Reported-by: NAndy Isaacson <adi@hexapodia.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Remove duplicated #include('s) in drivers/net/wan/x25_asy.c
Signed-off-by: NHuang Weiyi <weiyi.huang@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Fix bug in multilink fragment size calculation introduced by
commit 9c705260
"ppp: ppp_mp_explode() redesign"
Signed-off-by: NBen McKeegan <ben@netservers.co.uk>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Only check pfc bits in hang logic if PFC is enabled.  Previously,
if DCB was enabled but PFC was disabled the incorrect pause
bits would be checked.
Signed-off-by: NJohn Fastabend <john.r.fastabend@intel.com>
Acked-by: NDon Skidmore <donald.c.skidmore@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Remove a BUG_ON for when interrupts are disabled during an MMC request.

During boot, interrupts can be disabled when a request is made, causing
this bug to be triggered.  In reality, there's no reason this should halt
the kernel, as the driver has proved reliable in spite of disabled
interrupts, and additionally, there's nothing in this code that would
require interrupts to be enabled.

The only setup I've managed to make it trigger on is on the HTC Herald
during bootup when the driver is built into the kernel (mostly because
that's all I have).  I believe it's related to the fact that on bootup I
get many timeout errors on "CMD5" while initializing the card.  Each CMD5
timeout triggers that bug (I changed it to a WARN_ON to get it to boot in)
due to the fact that part of the timeout code involves sending the request
again.  With interrupts turned off, that BUG would be triggered.
Signed-off-by: NCory Maccarrone <darkstar6262@gmail.com>
Acked-by: NTony Lindgren <tony@atomide.com>
Cc: <linux-mmc@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit f6014419 ("imxfb: add support for
i.MX25:) has inserted the symbol HAVE_FB_IMX, which does not depend on FB
after the menuconfig FB.  This breaks the menu, presenting most of the
drivers outside of it, when using menuconfig.

Moving the symbol to the start of the file, just like HAVE_FB_ATMEL, fixes
the problem without breaking it for iMX25 configurations (tested with
ARCH=arm, no build).
Signed-off-by: NThadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Acked-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: NBaruch Siach <baruch@tkos.co.il>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

As pointed by Nick Piggin, ->page_mkwrite provides a way to keep a page
locked until the associated PTE is marked dirty.

Re-implement the fix by using this mechanism.
Signed-off-by: NAlbert Herranz <albert_herranz@yahoo.es>
Acked-by: NJaya Kumar <jayakumar.lkml@gmail.com>
Acked-by: NNick Piggin <npiggin@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit 49bbd815 ("fb_defio:
fix for non-dirty ptes").

Although the fix provided is correct, it's been suggested to avoid the
underlying race in the same way as it is currently done in filesystems
like NFS, for maintainability.

A following patch "fb_defio: redo fix for non-dirty ptes" will provide
such an alternate fix.
Signed-off-by: NAlbert Herranz <albert_herranz@yahoo.es>
Cc: Jaya Kumar <jayakumar.lkml@gmail.com>
Cc: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Limit number of accumulated non-balloonable pages during inflation cycle,
otherwise there is a chance we will be spinning and growing the list
forever.  This happens during torture tests when balloon target changes
while we are in the middle of inflation cycle and monitor starts refusing
to lock pages (since they are not needed anymore).
Signed-off-by: NDmitry Torokhov <dtor@vmware.com>
Acked-by: NBhavesh Davda <bhavesh@vmware.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The driver fails to compile on s390:

drivers/char/ramoops.c: In function 'ramoops_init':
drivers/char/ramoops.c:122: error: implicit declaration of function 'ioremap'

Since we won't make use of the driver anyway on s390 just let it depend on
HAS_IOMEM.
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Cc: Marco Stornelli <marco.stornelli@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make sure s3c_rtc_cpu_type is initialised _before_ it's used in an if()
check.
Reported-by: NJiri Pinkava <jiri.pinkava@vscht.cz>
Signed-off-by: NMaurus Cuelenaere <mcuelenaere@gmail.com>
Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Maurus Cuelenaere <mcuelenaere@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

s3c_rtc_setfreq() uses the platform driver data to derive struct rtc_device,
so make sure drvdata is set _before_ s3c_rtc_setfreq() is called.
Signed-off-by: NMaurus Cuelenaere <mcuelenaere@gmail.com>
Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Maurus Cuelenaere <mcuelenaere@gmail.com>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

get_sb_single() calls fill_super with superblock locked; calling
deactivate_super() will deadlock immedately.  Moreover, if fill_super
callback returns an error, get_sb_single() will release the reference
to superblock itself just fine.
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

copy_to_user() returns the number of bytes remaining but we want to
return a negative error code here.  These functions are used in the
ioctl handler and the error code gets returned to userspace.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

copy_to_user() returns the number of bytes remaining but we want to
return a negative error code.  This is in the ioctl handler and the
error code gets passed to userspace.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Eliminate a NULL or near NULL pointer dereference.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
expression E,E1;
identifier f;
statement S1,S2,S3;
@@

if ((E == NULL && ...) || ...)
{
  ... when != if (...) S1 else S2
      when != E = E1
* E->f
  ... when any
  return ...;
}
else S3
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In each case, the containing function is only called from one place, where
a spin lock is held.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@gfp exists@
identifier fn;
position p;
@@

fn(...) {
... when != spin_unlock
    when any
  GFP_KERNEL@p
 ... when any
}

@locked@
identifier gfp.fn;
@@

spin_lock(...)
... when != spin_unlock
fn(...)

@depends on locked@
position gfp.p;
@@

- GFP_KERNEL@p
+ GFP_ATOMIC
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: Jonathan Cameron <jic23@cam.ac.uk>
Cc: Marek Lindner <lindner_marek@yahoo.de>
Cc: Martyn Welch <martyn.welch@ge.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Correct at least one of the incorrect specs for a national instrument
data acquisition card DAQCard-6024E. This card has only four different
gain settings (+-10V, +-5V, +-0.5V, +-0.05V).
Signed-off-by: NMartin Homuth-Rosemann <homuth-rosemann@gmx.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

the dependancy of ni_labpc on mite was missing,
Signed-off-by: NAlexander Kurz <linux@kbdbabel.org>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

index 0aa2b0d..79f5f2e 100644

Fixes Kconfig so the wlags49_h2 and wlags49_h25 drivers can be
selected from menuconfig without having to select another WLAN
driver first. Before it could only be selected when another driver
already selected WIRELESS_EXT. Also adds WEXT_PRIV on which
the driver also depends.

Align help text in Kconfig.
Signed-off-by: NHenk de Groot <pe1dnn@amsat.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

phison uses interfaces and data that are built only when
ATA_BMDMA is enabled, so it should depend on that symbol.

drivers/staging/phison/phison.c:43: error: implicit declaration of function 'ATA_BMDMA_SHT'
drivers/staging/phison/phison.c:43: error: initializer element is not constant
drivers/staging/phison/phison.c:43: error: (near initialization for 'phison_sht.module')
drivers/staging/phison/phison.c:47: error: 'ata_bmdma_port_ops' undeclared here (not in a function)
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Cc: evan_ko@phison.com
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NBarry Song <21cnbao@gmail.com>
Acked-by: NJonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

A new buffer for a packet is created when a icmp packet is received.
This happens in a context with disabled irq. Thus we are not allowed to
sleep or call function which might sleep. kmalloc must be called with
GFP_ATOMIC instead of GFP_KERNEL to ensure that it does not sleep.
Signed-off-by: NSven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Free_netdev is registered as destructor in interface_setup for every
soft_device. This destructor is automatically called from
unregister_netdev and we must not call it again for the freed
net_device.
Signed-off-by: NSven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We must call unregister_netdev when we couldn't initialise the
batman-adv module and the soft_device was registered. There are two
version of the function which we can use:
 * unregister_netdevice - removes device
 * unregister_netdev - takes rtnl semaphore and remove device

We don't hold the semaphore in an error situation. So we must use
unregister_netdev.
Signed-off-by: NSven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

On module shutdown batman-adv would purge the internal packet
queue by sending all remaining packets which could confuse
other nodes. Now, the packets are silently discarded.
Signed-off-by: NMarek Lindner <lindner_marek@yahoo.de>
Signed-off-by: NSven Eckelmann <sven.eckelmann@gmx.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Qualcomm development of the MSM SOC framebuffer driver has
diverged significantly from the driver used by Android. This
is a snapshot of our current driver, in all it's agony. We are
putting this in staging to help with the process of converging
the two drivers.

At this point, the driver has been tested only in dumb
framebuffer mode.
Signed-off-by: NStepan Moskovchenko <stepanm@codeaurora.org>
Signed-off-by: NDavid Brown <davidb@codeaurora.org>
Signed-off-by: NAbhijeet Dharmapurikar <adharmap@codeaurora.org>
[dwalker@codeaurora.org: added a small compile fix and TODO.]
Signed-off-by: NDaniel Walker <dwalker@codeaurora.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

On Wed, 19 May 2010, Randy Dunlap wrote:
> linux-next of 2010-0519:
> when CONFIG_PCI is not enabled:
> 
> drivers/staging/comedi/drivers/mite.c: In function 'mite_init':
> drivers/staging/comedi/drivers/mite.c:89: error: implicit declaration of function 'pci_dev_get'
> drivers/staging/comedi/drivers/mite.c:89: warning: assignment makes pointer from integer without a cast
> make[5]: *** [drivers/staging/comedi/drivers/mite.o] Error 1

This patch fixes the problem.
Signed-off-by: NAlexander Kurz <linux@kbdbabel.org>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Both drivers support directly or indirectly multiple bus types,
hence both are listed independent of bus types.
Signed-off-by: NAlexander Kurz <linux@kbdbabel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Don't allow COMEDI_BUFINFO ioctl if some other file object has locked
the subdevice or has an active command.  If there is no active command,
just report back the last buffer position.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When the COMEDI_BUFINFO ioctl is used on a subdevice without
asynchronous streaming command support, set 'bytes_read = 0' and
'bytes_written = 0' in the buffer info returned back to the user.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

For write(), any data copied to the data buffer after the previously
set up streaming acquisition command has finished won't be used, but a
non-empty write() does not currently return 0 (or -EPIPE on error) after
the command has finished until the data buffer has been filled up.
Change this behavior to return 0 (or -EPIPE) any time after the command
has finished, without bothering to fill up the buffer with more useless
data.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The internal state of an 82C54 counter timer chip will get messed up if
several threads read, write, configure, or check the status of the chip
simultaneously.  Protect the register access sequences with a spin lock.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add support for the Advantech PCI-1735U card, including support for a
counter subdevice (based on an 82C54 counter timer chip).

The counter subdevice needs more testing, as the only person I know who
tried it couldn't get it to work!
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The Addi-Data PCI drivers for Comedi use sprintf() in their comedi
"attach" routine to construct a string to pass as the name in the call
to request_irq().  All calls to "attach" routine share the same static
buffer for this name, but the contents will differ on each call
(including the comedi device number and the comedi board name).  This
changes the name displayed in /proc/interrupts for previous calls to
request_irq() using the same buffer.  Just use the board name instead;
it has slightly less information (no comedi device number) but at least
it doesn't change over the lifetime of the IRQ handler.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

It is not currently possible for more than one of the addi_apci_*
drivers to register themselves with comedi at once because they all use
the same comedi driver name "addi_common".  Give them different names.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>