Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  fib_rules: fix unresolved_rules counting
  r8169: fix wrong eee setting for rlt8111evl
  r8169: fix driver shutdown WoL regression.
  ehea: Change maintainer to me
  pptp: pptp_rcv_core() misses pskb_may_pull() call
  tproxy: copy transparent flag when creating a time wait
  pptp: fix skb leak in pptp_xmit()
  bonding: use local function pointer of bond->recv_probe in bond_handle_frame
  smsc911x: Add support for SMSC LAN89218
  tg3: negate USE_PHYLIB flag check
  netconsole: enable netconsole can make net_device refcnt incorrent
  bluetooth: Properly clone LSM attributes to newly created child connections
  l2tp: fix a potential skb leak in l2tp_xmit_skb()
  bridge: fix hang on removal of bridge via netlink
  x25: Prevent skb overreads when checking call user data
  x25: Handle undersized/fragmented skbs
  x25: Validate incoming call user data lengths
  udplite: fast-path computation of checksum coverage
  IPVS netns shutdown/startup dead-lock
  netfilter: nf_conntrack: fix event flooding in GRE protocol tracker

diff --git a/Makefile b/Makefile
index 31f967c..2652089 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc9
+EXTRAVERSION = -rc10
 NAME = "Divemaster Edition"
 
 # *DOCUMENTATION*

diff --git a/arch/arm/common/vic.c b/arch/arm/common/vic.c
index 7aa4262..197f81c 100644 (file)
--- a/arch/arm/common/vic.c
+++ b/arch/arm/common/vic.c
@@ -259,7 +259,6 @@ static void __init vic_disable(void __iomem *base)
        writel(0, base + VIC_INT_SELECT);
        writel(0, base + VIC_INT_ENABLE);
        writel(~0, base + VIC_INT_ENABLE_CLEAR);
-       writel(0, base + VIC_IRQ_STATUS);
        writel(0, base + VIC_ITCR);
        writel(~0, base + VIC_INT_SOFT_CLEAR);
 }

diff --git a/arch/arm/include/asm/localtimer.h b/arch/arm/include/asm/localtimer.h
index 080d74f..ff66638 100644 (file)
--- a/arch/arm/include/asm/localtimer.h
+++ b/arch/arm/include/asm/localtimer.h
@@ -10,6 +10,8 @@
 #ifndef __ASM_ARM_LOCALTIMER_H
 #define __ASM_ARM_LOCALTIMER_H
 
+#include <linux/errno.h>
+
 struct clock_event_device;
 
 /*

diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 4c85183..6be3e2e 100644 (file)
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -321,8 +321,8 @@ static const unsigned armv7_a9_perf_map[PERF_COUNT_HW_MAX] = {
        [PERF_COUNT_HW_CPU_CYCLES]          = ARMV7_PERFCTR_CPU_CYCLES,
        [PERF_COUNT_HW_INSTRUCTIONS]        =
                                        ARMV7_PERFCTR_INST_OUT_OF_RENAME_STAGE,
-       [PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_COHERENT_LINE_HIT,
-       [PERF_COUNT_HW_CACHE_MISSES]        = ARMV7_PERFCTR_COHERENT_LINE_MISS,
+       [PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_DCACHE_ACCESS,
+       [PERF_COUNT_HW_CACHE_MISSES]        = ARMV7_PERFCTR_DCACHE_REFILL,
        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = ARMV7_PERFCTR_PC_WRITE,
        [PERF_COUNT_HW_BRANCH_MISSES]       = ARMV7_PERFCTR_PC_BRANCH_MIS_PRED,
        [PERF_COUNT_HW_BUS_CYCLES]          = ARMV7_PERFCTR_CLOCK_CYCLES,

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index cc7e2d8..f8037ba 100644 (file)
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -496,6 +496,13 @@ static void __init free_unused_memmap(struct meminfo *mi)
                 */
                bank_start = min(bank_start,
                                 ALIGN(prev_bank_end, PAGES_PER_SECTION));
+#else
+               /*
+                * Align down here since the VM subsystem insists that the
+                * memmap entries are valid from the bank start aligned to
+                * MAX_ORDER_NR_PAGES.
+                */
+               bank_start = round_down(bank_start, MAX_ORDER_NR_PAGES);
 #endif
                /*
                 * If we had a previous bank, and there is a space

diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e88c644..14cc88a 100644 (file)
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -277,7 +277,12 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
        case ATOM_ARG_FB:
                idx = U8(*ptr);
                (*ptr)++;
-               val = gctx->scratch[((gctx->fb_base + idx) / 4)];
+               if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                       DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
+                                 gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                       val = 0;
+               } else
+                       val = gctx->scratch[(gctx->fb_base / 4) + idx];
                if (print)
                        DEBUG("FB[0x%02X]", idx);
                break;
@@ -531,7 +536,11 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
        case ATOM_ARG_FB:
                idx = U8(*ptr);
                (*ptr)++;
-               gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
+               if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                       DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
+                                 gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+               } else
+                       gctx->scratch[(gctx->fb_base / 4) + idx] = val;
                DEBUG("FB[0x%02X]", idx);
                break;
        case ATOM_ARG_PLL:
@@ -1370,11 +1379,13 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
 
                usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
        }
+       ctx->scratch_size_bytes = 0;
        if (usage_bytes == 0)
                usage_bytes = 20 * 1024;
        /* allocate some scratch memory */
        ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
        if (!ctx->scratch)
                return -ENOMEM;
+       ctx->scratch_size_bytes = usage_bytes;
        return 0;
 }

diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index a589a55..93cfe20 100644 (file)
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -137,6 +137,7 @@ struct atom_context {
        int cs_equal, cs_above;
        int io_mode;
        uint32_t *scratch;
+       int scratch_size_bytes;
 };
 
 extern int atom_debug;

diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c742944..a515b2a 100644 (file)
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -466,7 +466,7 @@ static void atombios_crtc_program_ss(struct drm_crtc *crtc,
                        return;
                }
                args.v2.ucEnable = enable;
-               if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK))
+               if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK) || ASIC_IS_DCE41(rdev))
                        args.v2.ucEnable = ATOM_DISABLE;
        } else if (ASIC_IS_DCE3(rdev)) {
                args.v1.usSpreadSpectrumPercentage = cpu_to_le16(ss->percentage);

diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 8a171b2..eb3f6dc 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1638,7 +1638,17 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                        break;
                case 2:
                        args.v2.ucCRTC = radeon_crtc->crtc_id;
-                       args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                       if (radeon_encoder_is_dp_bridge(encoder)) {
+                               struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
+                               if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+                                       args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
+                               else if (connector->connector_type == DRM_MODE_CONNECTOR_VGA)
+                                       args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
+                               else
+                                       args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                       } else
+                               args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
@@ -1756,10 +1766,15 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
        if (ASIC_IS_DCE4(rdev)) {
                dig = radeon_encoder->enc_priv;
                if (ASIC_IS_DCE41(rdev)) {
-                       if (dig->linkb)
-                               return 1;
-                       else
-                               return 0;
+                       /* ontario follows DCE4 */
+                       if (rdev->family == CHIP_PALM) {
+                               if (dig->linkb)
+                                       return 1;
+                               else
+                                       return 0;
+                       } else
+                               /* llano follows DCE3.2 */
+                               return radeon_crtc->crtc_id;
                } else {
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ae3c6f5..082fcae 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -321,7 +321,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
        struct ttm_mem_type_manager *man = &bdev->man[new_mem->mem_type];
        struct ttm_tt *ttm = bo->ttm;
        struct ttm_mem_reg *old_mem = &bo->mem;
-       struct ttm_mem_reg old_copy;
+       struct ttm_mem_reg old_copy = *old_mem;
        void *old_iomap;
        void *new_iomap;
        int ret;

diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index d721565..a5c9ed1 100644 (file)
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -181,7 +181,7 @@ static void v4l2_device_release(struct device *cd)
         * TODO: In the long run all drivers that use v4l2_device should use the
         * v4l2_device release callback. This check will then be unnecessary.
         */
-       if (v4l2_dev->release == NULL)
+       if (v4l2_dev && v4l2_dev->release == NULL)
                v4l2_dev = NULL;
 
        /* Release video_device and perform other

diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index c8008dd..640ded8 100644 (file)
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -274,9 +274,7 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
        struct task_cputime sum;
        unsigned long flags;
 
-       spin_lock_irqsave(&cputimer->lock, flags);
        if (!cputimer->running) {
-               cputimer->running = 1;
                /*
                 * The POSIX timer interface allows for absolute time expiry
                 * values through the TIMER_ABSTIME flag, therefore we have
@@ -284,8 +282,11 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
                 * it.
                 */
                thread_group_cputime(tsk, &sum);
+               spin_lock_irqsave(&cputimer->lock, flags);
+               cputimer->running = 1;
                update_gt_cputime(&cputimer->cputime, &sum);
-       }
+       } else
+               spin_lock_irqsave(&cputimer->lock, flags);
        *times = cputimer->cputime;
        spin_unlock_irqrestore(&cputimer->lock, flags);
 }

diff --git a/kernel/sys.c b/kernel/sys.c
index 18ee1d2..1dbbe69 100644 (file)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1172,7 +1172,7 @@ DECLARE_RWSEM(uts_sem);
 static int override_release(char __user *release, int len)
 {
        int ret = 0;
-       char buf[len];
+       char buf[65];
 
        if (current->personality & UNAME26) {
                char *rest = UTS_RELEASE;

diff --git a/mm/migrate.c b/mm/migrate.c
index 666e4e6..14d0a6a 100644 (file)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -120,10 +120,10 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
 
                ptep = pte_offset_map(pmd, addr);
 
-               if (!is_swap_pte(*ptep)) {
-                       pte_unmap(ptep);
-                       goto out;
-               }
+               /*
+                * Peek to check is_swap_pte() before taking ptlock?  No, we
+                * can race mremap's move_ptes(), which skips anon_vma lock.
+                */
 
                ptl = pte_lockptr(mm, pmd);
        }