commit 066519068ad2fbe98c7f45552b1f592903a9c8c8 Merge: b92dea6... 0cbccbc... Author: Linus Torvalds Date: Sun Jun 15 16:53:20 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: ide-generic: don't probe all legacy ISA IDE ports by default ide-cs: fix releasing I/O resources ide-cs: fix probing and add warm-plug support ide-pmac: remove bogus comment about pmac_ide_setup_device() ide-pmac: add ->cable_detect method ide-pmac: bugfix for media-bay support rework opti621: add PIO 4 support opti621: use pre-calculated PIO timings opti621: program devices timings separately in ->set_pio_mode opti621: use PCI clock value provided by controller opti621: remove DMA support opti621: disable read prefetch commit b92dea67cc66970cda6b5b11895d08e35b4618e7 Author: Mark McLoughlin Date: Sun Jun 15 23:20:50 2008 +1000 virtio: Complete feature negotation before updating status lguest (in rusty's use-tun-ringfd patch) assumes that the guest has updated its feature bits before setting its status to VIRTIO_CONFIG_S_DRIVER_OK. That's pretty reasonable, so let's make it so. Signed-off-by: Mark McLoughlin Signed-off-by: Rusty Russell Signed-off-by: Linus Torvalds commit 0cbccbc30a60ff60dbeb203154f1f527c632de9b Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:24 2008 +0200 ide-generic: don't probe all legacy ISA IDE ports by default We can't probe all legacy ISA IDE ports by default as the resources may be occupied by other ISA devices. Add "probe_mask" module parameter and probe only first two ISA IDE ports by default leaving the decision about probing the rest to the user (systems with ISA ide2-6 should be very, very rare). This fixes a regression caused by: commit 343a3451e20314d5959b59b992e33fbaadfe52bf Author: Bartlomiej Zolnierkiewicz Date: Tue Jun 10 20:56:36 2008 +0200 ide-generic: add missing hwif->chipset setup ... Reported-by: Mikael Pettersson Bisected-by: Mikael Pettersson Tested-by: Mikael Pettersson Cc: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit fbc69fd9b76158daaa83e5372e44fdd81df20f92 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:23 2008 +0200 ide-cs: fix releasing I/O resources hwif content is already freed after ide_release() call so cache hwif->io_ports.{data,ctl}_addr in local variables in ide_detach(). This fixes post-2.6.25 regression. Signed-off-by: Bartlomiej Zolnierkiewicz commit 792a1a98560a2a1619491eed8b18fccb09b312a7 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:23 2008 +0200 ide-cs: fix probing and add warm-plug support * Fix probing by using ide_port_scan() and moving "retry loop" from ide_config() to idecs_register(). * Don't fail probe if there are no devices attached to a port. * Remove (now redundant) error message from ide_config(). Signed-off-by: Bartlomiej Zolnierkiewicz commit 5b16464ac32a92c2332030d11ec445bddeb141fa Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:23 2008 +0200 ide-pmac: remove bogus comment about pmac_ide_setup_device() Cc: Benjamin Herrenschmidt Signed-off-by: Bartlomiej Zolnierkiewicz commit 07a6c66da53f646a39103290bfbd85be18892895 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:23 2008 +0200 ide-pmac: add ->cable_detect method Add ->cable_detect method and remove no longer needed pmif->cable_80 flag (there is also no need to mask ->udma_mask now). This fixes: - forced ignoring of cable detection (needed for some CF devices & debug) - cable detection for warm-plug Cc: Benjamin Herrenschmidt Signed-off-by: Bartlomiej Zolnierkiewicz commit c1a8e39819bd6797ee2b82b88517268d39921b03 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:23 2008 +0200 ide-pmac: bugfix for media-bay support rework Fix bug introduced by: commit 2dde7861afa23cd59db83515cb0b810b92b220aa Author: Bartlomiej Zolnierkiewicz Date: Fri Apr 18 00:46:23 2008 +0200 ide: rework PowerMac media-bay support (take 2) ... [ Yeah, I suck. ] bay->cd_index shouldn't be changed if IDE devices are not present or retry operations won't happen. Cc: Benjamin Herrenschmidt Signed-off-by: Bartlomiej Zolnierkiewicz commit 80a65fc5ee04497e6c28bdaefc44d375b19c4a79 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:22 2008 +0200 opti621: add PIO 4 support * Add PIO 4 support. While at it: * Use a single struct ide_port_info instance for OPTi621 and OPTi621X. Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Tested-by: Juergen Kosel Signed-off-by: Bartlomiej Zolnierkiewicz commit 810253d44bc92b44b66cd9944b579de54c0cd3ff Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:22 2008 +0200 opti621: use pre-calculated PIO timings * Use pre-calculated PIO timings in ->set_pio_mode. * Remove no longer needed compute_clocks(), cmpt_clk(), struct pio_clocks_s, PIO_* defines and OPTI621_DEBUG define. There should be no functional changes caused by this patch. Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Tested-by: Juergen Kosel Signed-off-by: Bartlomiej Zolnierkiewicz commit 6c987183fcc3c6cb9eb77fd0b3e8ca1ac98a4813 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:22 2008 +0200 opti621: program devices timings separately in ->set_pio_mode * Set drive->drive_data to 'pio + XFER_PIO_0' instead of 'pio', then simplify selecting maximum adress setup timing. * Remove no longer needed compute_pios() and opti621_port_init_devs(). * Program devices timings separately in ->set_pio_mode. Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Tested-by: Juergen Kosel Signed-off-by: Bartlomiej Zolnierkiewicz commit 21bd33a656a60daadc475ce330272f4410ae27b7 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:22 2008 +0200 opti621: use PCI clock value provided by controller Use PCI clock value provided by controller instead of depending on a default (or user supplied) value. Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Tested-by: Juergen Kosel Signed-off-by: Bartlomiej Zolnierkiewicz commit f361037631ba547ea88adf8d2359d810c1b2605a Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:21 2008 +0200 opti621: remove DMA support These controllers don't support DMA. Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Tested-by: Juergen Kosel Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 62128b2ca812c1266f4ff7bac068bf0b626c6179 Author: Bartlomiej Zolnierkiewicz Date: Sun Jun 15 21:00:21 2008 +0200 opti621: disable read prefetch This fixes 2.6.25 regression (kernel.org bugzilla bug #10723) caused by: commit 912fb29a36a7269ac1c4a4df45bc0ac1d2637972 Author: Bartlomiej Zolnierkiewicz Date: Fri Oct 19 00:30:11 2007 +0200 opti621: always tune PIO ... Based on a bugreport from Juergen Kosel & inspired by pata_opti.c code. Bisected-by: Juergen Kosel Tested-by: Juergen Kosel Signed-off-by: Bartlomiej Zolnierkiewicz commit 0269c5c6d9a9de22715ecda589730547435cd3e8 Merge: 7775c97... 81d5575... Author: Linus Torvalds Date: Sat Jun 14 13:32:56 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: fixup write combine comment in pci_mmap_resource x86: PAT export resource_wc in pci sysfs x86, pci-dma.c: don't always add __GFP_NORETRY to gfp suspend-vs-iommu: prevent suspend if we could not resume x86: pci-dma.c: use __GFP_NO_OOM instead of __GFP_NORETRY pci, x86: add workaround for bug in ASUS A7V600 BIOS (rev 1005) PCI: use dev_to_node in pci_call_probe PCI: Correct last two HP entries in the bfsort whitelist commit 7775c9753b94fe429dc4323360d6502c95e0dd6e Merge: fa8d84b... 42a5a8a... Author: Linus Torvalds Date: Fri Jun 13 09:47:07 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6: parisc: update my email address parisc: fix miscompilation of ip_fast_csum with gcc >= 4.3 parisc: fix off by one in setup_sigcontext32 parisc: export empty_zero_page parisc: export copy_user_page_asm parisc: move head.S to head.text section Revert "parisc: fix trivial section name warnings" commit 42a5a8a60a093c359987fd884aec99b9d7f4c084 Author: Kyle McMartin Date: Fri Jun 6 17:16:17 2008 -0400 parisc: update my email address Signed-off-by: Kyle McMartin commit e374d17cd74ec5967f81e2b0c67ec3219a2bbbcc Author: Kyle McMartin Date: Sat May 31 12:15:42 2008 -0400 parisc: fix miscompilation of ip_fast_csum with gcc >= 4.3 ip_fast_csum needs an asm "memory" clobber, otherwise the aggressive optimizations in gcc-4.3 cause it to be miscompiled. Signed-off-by: Kyle McMartin commit f4441b62d46e7033e907dfd6a8bb0b75b5519e88 Author: Kyle McMartin Date: Tue May 27 01:56:29 2008 -0400 parisc: fix off by one in setup_sigcontext32 Thankfully, the values were irrelevant... Spotted by newer gcc. Signed-off-by: Kyle McMartin commit 22febf1f372496d74534be32b6b5edcee7fb7cc5 Author: Kyle McMartin Date: Mon May 26 01:54:35 2008 -0400 parisc: export empty_zero_page Needed by ext4 when built as a module. Signed-off-by: Kyle McMartin commit db51d92b90193cf69b2bcc2874fd0b267fd3e710 Author: Kyle McMartin Date: Mon May 26 01:49:01 2008 -0400 parisc: export copy_user_page_asm Needed by fuse (via copy_highpage). Signed-off-by: Kyle McMartin commit 1138a72cd96857d1d5928c0c8c83d8b8995eeb38 Author: Kyle McMartin Date: Thu May 22 14:38:26 2008 -0400 parisc: move head.S to head.text section And explicitly list it in vmlinux.lds... Signed-off-by: Kyle McMartin commit dfcf753bd3fb09f336659d07b1c48db7e62772e0 Author: Kyle McMartin Date: Thu May 22 14:36:31 2008 -0400 Revert "parisc: fix trivial section name warnings" This reverts commit bd3bb8c15b9a80dbddfb7905b237a4a11a4725b4. Signed-off-by: Kyle McMartin commit fa8d84b78be10d0c455dd716f40152bb7003bd5b Merge: 5155857... bd17243... Author: Linus Torvalds Date: Fri Jun 13 07:40:57 2008 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ahci: Workaround HW bug for SB600/700 SATA controller PMP support ahci: workarounds for mcp65 commit 51558576ead54c1047e4d41440626e4f9aa015ea Merge: d36e311... ec0a196... Author: Linus Torvalds Date: Fri Jun 13 07:34:47 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tcp: Revert 'process defer accept as established' changes. ipv6: Fix duplicate initialization of rawv6_prot.destroy bnx2x: Updating the Maintainer net: Eliminate flush_scheduled_work() calls while RTNL is held. drivers/net/r6040.c: correct bad use of round_jiffies() fec_mpc52xx: MPC52xx_MESSAGES_DEFAULT: 2nd NETIF_MSG_IFDOWN => IFUP ipg: fix receivemode IPG_RM_RECEIVEMULTICAST{,HASH} in ipg_nic_set_multicast_list() netfilter: nf_conntrack: fix ctnetlink related crash in nf_nat_setup_info() netfilter: Make nflog quiet when no one listen in userspace. ipv6: Fail with appropriate error code when setting not-applicable sockopt. ipv6: Check IPV6_MULTICAST_LOOP option value. ipv6: Check the hop limit setting in ancillary data. ipv6 route: Fix route lifetime in netlink message. ipv6 mcast: Check address family of gf_group in getsockopt(MS_FILTER). dccp: Bug in initial acknowledgment number assignment dccp ccid-3: X truncated due to type conversion dccp ccid-3: TFRC reverse-lookup Bug-Fix dccp ccid-2: Bug-Fix - Ack Vectors need to be ignored on request sockets dccp: Fix sparse warnings dccp ccid-3: Bug-Fix - Zero RTT is possible commit d36e311070ee3a378a54142a168ff5cfedba33d5 Merge: 61d6cc5... 738eca7... Author: Linus Torvalds Date: Fri Jun 13 07:34:01 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc: get leo framebuffer working commit bd17243a84632465f5403bc9eb8b4831bd67e582 Author: Shane Huang Date: Tue Jun 10 15:52:04 2008 +0800 ahci: Workaround HW bug for SB600/700 SATA controller PMP support There is one bug in ATI SATA PMP of SB600 and SB700 old revision, which leads to soft reset failure. This patch can fix the bug. Signed-off-by: Shane Huang Acked-by: Tejun Heo Signed-off-by: Jeff Garzik commit e297d99e103f951a71fcb1534f1ff3480dd3a851 Author: Tejun Heo Date: Tue Jun 10 00:13:04 2008 +0900 ahci: workarounds for mcp65 MCP65 ahci can do NCQ but doesn't set the CAP bit and rev A0 and A1 can't do MSI but have MSI capability. Implement AHCI_HFLAG_YES_NCQ and apply appropriate workarounds. Signed-off-by: Tejun Heo Cc: Peer Chen Signed-off-by: Jeff Garzik commit 61d6cc54896811086b51fa78d440311974a09b3a Merge: c6d8f40... 3692fd0... Author: Linus Torvalds Date: Thu Jun 12 19:37:29 2008 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] 5091/1: Add missing bitfield include to regs-lcd.h [ARM] 5090/1: Correct pxafb palette typo error [ARM] 5077/1: spi: fix list scan success verification in PXA ssp driver commit c6d8f400cc7610f04177f81168c19b8407cb48c3 Author: Sergey Lapin Date: Thu Jun 12 15:21:55 2008 -0700 rtc: Ramtron FM3130 RTC support Ramtron FM3130 is a chip with two separate devices inside, RTC clock and FRAM. This driver provides only RTC functionality. This chip is met in lots of custom boards with AT91SAMXXXX CPU I work with, is cheap and in no way better or worse than any other RTC on market. While it is mostly met on much smaller devices, I think it is great to have it supported in Linux. Signed-off-by: Sergey Lapin Signed-off-by: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e6d2bb2bacb43ff03b0f458108d71981d58e775a Author: David Brownell Date: Thu Jun 12 15:21:55 2008 -0700 rtc: make HPET_RTC_IRQ track HPET_EMULATE_RTC More Kconfig tweaks related to the legacy PC RTC code: - Describe the legacy PC RTC driver as such ... it's never quite been clear that this driver is for PC RTCs, and now it's fair to call this the "legacy" driver. - Force it to understand about HPET stealing its IRQs ... kernel code does this always when HPET is in use, there should be no option for users to goof up the config. This seems to fix kernel bugzilla #10729. Signed-off-by: David Brownell Cc: Maxim Levitsky Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1da2e3d679a8ea2d9e82040359a706da0bd3bef6 Author: Stas Sergeev Date: Thu Jun 12 15:21:54 2008 -0700 provide rtc_cmos platform device Recently (around 2.6.25) I've noticed that RTC no longer works for me. It turned out this is because I use pnpacpi=off kernel option to work around the parport_pc bugs. I always did so, but RTC used to work fine in the past, and now it have regressed. The patch fixes the problem by creating the platform device for the RTC when PNP is disabled. This may also help running the PNP-enabled kernel on an older PCs. Signed-off-by: Stas Sergeev Cc: David Brownell Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Bjorn Helgaas Cc: Adam Belay Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 643b52b9c0b4e959436b4b551ebf4060d06d5ae8 Author: Nick Piggin Date: Thu Jun 12 15:21:52 2008 -0700 radix-tree: fix small lockless radix-tree bug We shrink a radix tree when its root node has only one child, in the left most slot. The child becomes the new root node. To perform this operation in a manner compatible with concurrent lockless lookups, we atomically switch the root pointer from the parent to its child. However a concurrent lockless lookup may now have loaded a pointer to the parent (and is presently deciding what to do next). For this reason, we also have to keep the parent node in a valid state after shrinking the tree, until the next RCU grace period -- otherwise this lookup with the parent pointer may not do the right thing. Notably, we need to keep the child in the left most slot there in case that is requested by the lookup. This is all pretty standard RCU stuff. It is worth repeating because in my eagerness to obey the radix tree node constructor scheme, I had broken it by zeroing the radix tree node before the grace period. What could happen is that a lookup can load the parent pointer, then decide it wants to follow the left most child slot, only to find the slot contained NULL due to the concurrent shrinker having zeroed the parent node before waiting for a grace period. The lookup would return a false negative as a result. Fix it by doing that clearing in the RCU callback. I would normally want to rip out the constructor entirely, but radix tree nodes are one of those places where they make sense (only few cachelines will be touched soon after allocation). This was never actually found in any lockless pagecache testing or by the test harness, but by seeing the odd problem with my scalable vmap rewrite. I have not tickled the test harness into reproducing it yet, but I'll keep working at it. Fortunately, it is not a problem anywhere lockless pagecache is used in mainline kernels (pagecache probe is not a guarantee, and brd does not have concurrent lookups and deletes). Signed-off-by: Nick Piggin Acked-by: Peter Zijlstra Cc: "Paul E. McKenney" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2187ebd84c7dd13ef269e9600f4daebeb02816e Author: Jiri Bohac Date: Thu Jun 12 15:21:51 2008 -0700 console keyboard mapping broken by 04c71976 Several console keyboard maps are broken since commit 04c71976500352d02f60616d2b960267d8c5fe24 Author: Samuel Thibault Date: Tue Oct 16 23:27:04 2007 -0700 unicode diacritics support because that changeset made k_self consider the value as a latin1 character when in Unicode mode, which is wrong; k_self should still take the console map into account. Signed-off-by: Samuel Thibault Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c826818ff55eae7702b778b5f8bdf765af3b2af Author: Paul Menage Date: Thu Jun 12 15:21:49 2008 -0700 /proc/sysvipc/shm: fix 32-bit truncation of segment sizes sysvipc_shm_proc_show() picks between format strings (based on the expected maximum length of a SHM segment) in a way that prevents gcc from performing format checks on the seq_printf() parameters. This hid two format errors - shp->shm_segsz and shp->shm_nattach are both unsigned long, but were being printed as unsigned int and signed int respectively. This leads to 32-bit truncation of SHM segment sizes reported in /proc/sysvipc/shm. (And for nattach, but that's less of a problem for most users). This patch makes the format string directly visible to gcc's format specifier checker, and fixes the two broken format specifiers. Signed-off-by: Paul Menage Cc: Nadia Derbey Cc: Manfred Spraul Cc: Pierre Peiffer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bcf8039ed45f56013c4afea5520bca7d909e5e61 Author: Dave Hansen Date: Thu Jun 12 15:21:48 2008 -0700 pagemap: fix large pages in pagemap We were walking right into huge page areas in the pagemap walker, and calling the pmds pmd_bad() and clearing them. That leaked huge pages. Bad. This patch at least works around that for now. It ignores huge pages in the pagemap walker for the time being, and won't leak those pages. Signed-off-by: Dave Hansen Acked-by: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2165009bdf63f79716a36ad545df14c3cdf958b7 Author: Dave Hansen Date: Thu Jun 12 15:21:47 2008 -0700 pagemap: pass mm into pagewalkers We need this at least for huge page detection for now, because powerpc needs the vm_area_struct to be able to determine whether a virtual address is referring to a huge page (its pmd_huge() doesn't work). It might also come in handy for some of the other users. Signed-off-by: Dave Hansen Acked-by: Matt Mackall Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cfc53f65f56f9f33c0cf522124045ac5a64076b3 Author: Philippe De Muyter Date: Thu Jun 12 15:21:46 2008 -0700 driver/char/generic_nvram: fix banner The generic nvram driver announces itself as 'Macintosh non-volatile memory driver' instead of 'Generic non-volatile memory driver'. Fix that. Signed-off-by: Philippe De Muyter Cc: Benjamin Herrenschmidt Cc: Arjan van de Ven Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e59b6a5ab51f6192cbe20d4f031335fe6d0e73fd Author: Philippe De Muyter Date: Thu Jun 12 15:21:45 2008 -0700 drivers/video/cirrusfb: fix RAM address printk In the cirrusfb driver, the RAM address printk has a superfluous 'x' that could be interpreted as "don't care", while it is actually a typo. Fix that. [akpm@linux-foundation.org: join the two printk strings to make it atomic] Signed-off-by: Philippe De Muyter Cc: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c97aee9ba43d60ff20d955065d29b6d3d8c950d5 Author: Stephen Hemminger Date: Thu Jun 12 15:21:45 2008 -0700 intel_rng: make device not found a warning Since many distros load this driver by default (throw it against the wall and see what sticks method). Change the error message severity level to avoid alarming users. Isn't it annoying when users actually read the error logs... Signed-off-by: Stephen Hemminger Cc: Michael Buesch Acked-by: Jan Beulich Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 093a44e71aa29157fb1611b00507d67c954099d6 Author: Julia Lawall Date: Thu Jun 12 15:21:43 2008 -0700 drivers/isdn/sc/ioctl.c: add missing kfree spid has been allocated in this function and so should be freed before leaving it, as in the other error handling cases. The semantic match that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) @r exists@ expression E,E1; statement S; position p1,p2,p3; @@ E =@p1 \(kmalloc\|kcalloc\|kzalloc\)(...) ... when != E = E1 if (E == NULL || ...) S ... when != E = E1 if@p2 (...) { ... when != kfree(E) } ... when != E = E1 kfree@p3(E); @forall@ position r.p2; expression r.E; int E1 != 0; @@ * if@p2 (...) { ... when != kfree(E) when strict return E1; } Signed-off-by: Julia Lawall Cc: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cef33400d0349fb24b6f8b7dea79b66e3144fd8b Author: Chuck Ebbert Date: Thu Jun 12 15:21:42 2008 -0700 mmc: wbsd: initialize tasklets before requesting interrupt With CONFIG_DEBUG_SHIRQ set we will get an interrupt as soon as we allocate one. Tasklets may be scheduled in the interrupt handler but they will be initialized after the handler returns, causing a BUG() in kernel/softirq.c when they run. Should fix this Fedora bug report: https://bugzilla.redhat.com/show_bug.cgi?id=449817 Signed-off-by: Chuck Ebbert Acked-by: Pierre Ossman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30ec261e5f97986644c0982543bc1cee1b2782bf Author: Eric Miao Date: Thu Jun 12 15:21:41 2008 -0700 MAINTAINERS: update maintainership of pxa2xx/pxa3xx Signed-off-by: Eric Miao Acked-by: Russell King Acked-by: Nicolas Pitre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f1ef9167ca4494a8c6d71d0031c73e9c8841eadd Author: Jeff Dike Date: Thu Jun 12 15:21:41 2008 -0700 uml: work around broken host PTRACE_SYSEMU Fedora broke PTRACE_SYSEMU again, and UML crashes as a result when it doesn't need to. This patch makes the PTRACE_SYSEMU check fail gracefully and makes UML fall back to PTRACE_SYSCALL. Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14c8a77e1bbd693446dad297d2ae2dd22f187e4f Author: Jeff Dike Date: Thu Jun 12 15:21:40 2008 -0700 uml: remove include of asm/user.h I allowed an include of asm/user.h to sneak back in. This patch replaces it with sys/user.h. Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 529a4f4ec90ffd9394fdfc22bea7a858ae343171 Author: Haavard Skinnemoen Date: Thu Jun 12 15:21:38 2008 -0700 rtc-at32ap700x: fix bug in at32_rtc_readalarm() alarm->pending indicates whether there's an alarm that has actually been triggered, not whether we're waiting for it. alarm->enabled indicates that. Also add missing locking around reading the RTC registers. Signed-off-by: Haavard Skinnemoen Signed-off-by: Alessandro Zummo Cc: Hans-Christian Egtvedt Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c38d8578545482fe45d6e6ea37be02a2e1bb289 Author: Philippe De Muyter Date: Thu Jun 12 15:21:36 2008 -0700 m68knommu: init coldfire timer TRR with n - 1, not n The coldfire timer must be initialised to n - 1 if we want it to count n cycles between each tick interrupt. This was already fixed, but has been lost with the conversion to GENERIC_TIMER. Signed-off-by: Philippe De Muyter Acked-by: Greg Ungerer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67dddaad5d8b8c5ee5b96a7e2f6cb0faad703865 Author: Masami Hiramatsu Date: Thu Jun 12 15:21:35 2008 -0700 kprobes: fix error checking of batch registration Fix error checking routine to catch an error which occurs in first __register_*probe(). Signed-off-by: Masami Hiramatsu Cc: Ananth N Mavinakayanahalli Cc: Jim Keniston Cc: David Miller Cc: Anil S Keshavamurthy Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 24aac480e76c6f5d1391ac05c5e9c0eb9b0cd302 Author: Mike Miller Date: Thu Jun 12 15:21:34 2008 -0700 cciss: add new hardware support Add support for the next generation of HP Smart Array SAS/SATA controllers. Shipping date is late Fall 2008. Bump the driver version to 3.6.20 to reflect the new hardware support from patch 1 of this set. Signed-off-by: Mike Miller Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8cdbc2b9826b3543fecff2f6d6400fa77b21ffdd Author: Andrew G. Morgan Date: Thu Jun 12 15:21:33 2008 -0700 capabilities: add (back) dummy support for KEEPCAPS The dummy module is used by folk that run security conscious code(!?). A feature of such code (for example, dhclient) is that it tries to operate with minimum privilege (dropping unneeded capabilities). While the dummy module doesn't restrict code execution based on capability state, the user code expects the kernel to appear to support it. This patch adds back faked support for the PR_SET_KEEPCAPS etc., calls - making the kernel behave as before 2.6.26. For details see: http://bugzilla.kernel.org/show_bug.cgi?id=10748 Signed-off-by: Andrew G. Morgan Acked-by: Serge Hallyn Cc: James Morris Cc: Stephen Smalley Cc: Chris Wright Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 57d3c64fd8130ebdacd85a36c9656ba5e221f3a3 Author: Ben Nizette Date: Thu Jun 12 15:21:31 2008 -0700 proc_fs.h: move struct mm_struct forward-declaration Move the forward-declaration of struct mm_struct a little way up proc_fs.h. This fixes a bunch of "'struct mm_struct' declared inside parameter list" warnings with CONFIG_PROC_FS=n Signed-off-by: Ben Nizette Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 551e172a20cf960f7caab4d31b252dc59538bfa4 Author: Paul Jackson Date: Thu Jun 12 15:21:31 2008 -0700 cpusets: provide another web page URL in MAINTAINERS file Add URL for another CPUSETS web page to the MAINTAINERS file. This URL provides links to major LGPL user level C libraries supporting cpuset usage and user level cpu and node masks. Signed-off-by: Paul Jackson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 630c270183133ac25bef8c8d726ac448df9b169a Author: Krzysztof Helt Date: Thu Jun 12 15:21:29 2008 -0700 hgafb: resource management fix Release ports which are requested during detection which are not freed if there is no hga card. Otherwise there is a crash during cat /proc/ioports command. Signed-off-by: Krzysztof Helt Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 69c5ddf58a03da3686691ad2f293bc79fd977c10 Author: Aneesh Kumar K.V Date: Thu Jun 12 15:21:29 2008 -0700 m68k: Add ext2_find_{first,next}_bit() for ext4 Add ext2_find_{first,next}_bit(), which are needed for ext4. They're derived out of the ext2_find_next_zero_bit found in the same file. Compile tested with crosstools [Reworked to preserve all symmetry with ext2_find_{first,next}_zero_bit()] This fixes http://bugzilla.kernel.org/show_bug.cgi?id=10393 [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2d518f84e5ecd1d71df0e6ac5176d212f68c27ce Author: OGAWA Hirofumi Date: Thu Jun 12 15:21:28 2008 -0700 fat: relax the permission check of fat_setattr() New chmod() allows only acceptable permission, and if not acceptable, it returns -EPERM. Old one allows even if it can't store permission to on disk inode. But it seems too strict for users. E.g. https://bugzilla.redhat.com/show_bug.cgi?id=449080: With new one, rsync couldn't create the temporary file. So, this patch allows like old one, but now it doesn't change the permission if it can't store, and it returns 0. Also, this patch fixes missing check. Signed-off-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c700be3d1320d2be4f04c8a5330186b7df724438 Author: kosaki.motohiro@jp.fujitsu.com Date: Thu Jun 12 15:21:27 2008 -0700 mm: fix incorrect variable type in do_try_to_free_pages() "Smarter retry of costly-order allocations" patch series change behaver of do_try_to_free_pages(). But unfortunately ret variable type was unchanged. Thus an overflow is possible. Signed-off-by: KOSAKI Motohiro Acked-by: Nishanth Aravamudan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df0bcab2c66ac876d5e80864fca5cce944a44540 Author: Amit Kucheria Date: Thu Jun 12 15:21:26 2008 -0700 agp: add support for Radeon Mobility 9000 chipset Addresses https://bugs.edge.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/178634 Signed-off-by: Amit Kucheria Signed-off-by: maximilian attems Acked-by: Dave Airlie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec0a196626bd12e0ba108d7daa6d95a4fb25c2c5 Author: David S. Miller Date: Thu Jun 12 16:31:35 2008 -0700 tcp: Revert 'process defer accept as established' changes. This reverts two changesets, ec3c0982a2dd1e671bad8e9d26c28dcba0039d87 ("[TCP]: TCP_DEFER_ACCEPT updates - process as established") and the follow-on bug fix 9ae27e0adbf471c7a6b80102e38e1d5a346b3b38 ("tcp: Fix slab corruption with ipv6 and tcp6fuzz"). This change causes several problems, first reported by Ingo Molnar as a distcc-over-loopback regression where connections were getting stuck. Ilpo Järvinen first spotted the locking problems. The new function added by this code, tcp_defer_accept_check(), only has the child socket locked, yet it is modifying state of the parent listening socket. Fixing that is non-trivial at best, because we can't simply just grab the parent listening socket lock at this point, because it would create an ABBA deadlock. The normal ordering is parent listening socket --> child socket, but this code path would require the reverse lock ordering. Next is a problem noticed by Vitaliy Gusev, he noted: ---------------------------------------- >--- a/net/ipv4/tcp_timer.c >+++ b/net/ipv4/tcp_timer.c >@@ -481,6 +481,11 @@ static void tcp_keepalive_timer (unsigned long data) > goto death; > } > >+ if (tp->defer_tcp_accept.request && sk->sk_state == TCP_ESTABLISHED) { >+ tcp_send_active_reset(sk, GFP_ATOMIC); >+ goto death; Here socket sk is not attached to listening socket's request queue. tcp_done() will not call inet_csk_destroy_sock() (and tcp_v4_destroy_sock() which should release this sk) as socket is not DEAD. Therefore socket sk will be lost for freeing. ---------------------------------------- Finally, Alexey Kuznetsov argues that there might not even be any real value or advantage to these new semantics even if we fix all of the bugs: ---------------------------------------- Hiding from accept() sockets with only out-of-order data only is the only thing which is impossible with old approach. Is this really so valuable? My opinion: no, this is nothing but a new loophole to consume memory without control. ---------------------------------------- So revert this thing for now. Signed-off-by: David S. Miller commit f23d60de719e639690b2dc5c2d0e4243ff614b7a Author: David S. Miller Date: Thu Jun 12 14:47:58 2008 -0700 ipv6: Fix duplicate initialization of rawv6_prot.destroy In changeset 22dd485022f3d0b162ceb5e67d85de7c3806aa20 ("raw: Raw socket leak.") code was added so that we flush pending frames on raw sockets to avoid leaks. The ipv4 part was fine, but the ipv6 part was not done correctly. Unlike the ipv4 side, the ipv6 code already has a .destroy method for rawv6_prot. So now there were two assignments to this member, and what the compiler does is use the last one, effectively making the ipv6 parts of that changeset a NOP. Fix this by removing the: .destroy = inet6_destroy_sock, line, and adding an inet6_destroy_sock() call to the end of raw6_destroy(). Noticed by Al Viro. Signed-off-by: David S. Miller Acked-by: YOSHIFUJI Hideaki commit 24e3fcefb9cc61acce59ed54c00c4e4c32537de7 Author: Eilon Greenstein Date: Thu Jun 12 14:30:28 2008 -0700 bnx2x: Updating the Maintainer I would like to thank Eliezer Tamir for writing and maintaining the driver for the past two years. I will take over maintaining the bnx2x driver from now on. Signed-off-by: Eilon Greenstein Signed-off-by: Eliezer Tamir Signed-off-by: David S. Miller commit 81d5575a48f49f494289a1299a32e4e5e41fbf40 Author: Jesse Barnes Date: Thu Jun 12 13:51:46 2008 -0700 PCI: fixup write combine comment in pci_mmap_resource Now that we can actually do write combining properly, there's no need to have the FIXME. Signed-off-by: Jesse Barnes commit 883eed1b3e25fb1d7d8f32c6550cc1ac44888838 Merge: 5e70b7f... 45aec1a... Author: Jesse Barnes Date: Thu Jun 12 13:51:05 2008 -0700 Merge branch 'pci-for-jesse' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-tip into for-linus commit 3692fd0aaef489b063518b5999c702bada5b6e22 Author: Stefan Schmidt Date: Thu Jun 12 07:07:22 2008 +0100 [ARM] 5091/1: Add missing bitfield include to regs-lcd.h Macros like Fld() or FShft used in regs-lcd.h are defined in bitfield.h, but the latter is not included. Also fix one whitespace issue while being there. Signed-off-by: Antonio Ospite Signed-off-by: Stefan Schmidt Acked-by: Eric Miao Signed-off-by: Russell King commit 4bb073c0e32a0862bdb5215d11af19f6c0180c98 Author: David S. Miller Date: Thu Jun 12 02:22:02 2008 -0700 net: Eliminate flush_scheduled_work() calls while RTNL is held. If the RTNL is held when we invoke flush_scheduled_work() we could deadlock. One such case is linkwatch, it is a work struct which tries to grab the RTNL semaphore. The most common case are net driver ->stop() methods. The simplest conversion is to instead use cancel_{delayed_}work_sync() explicitly on the various work struct the driver uses. This is an OK transformation because these work structs are doing things like resetting the chip, restarting link negotiation, and so forth. And if we're bringing down the device, we're about to turn the chip off and reset it anways. So if we cancel a pending work event, that's fine here. Some drivers were working around this deadlock by using a msleep() polling loop of some sort, and those cases are converted to instead use cancel_{delayed_}work_sync() as well. Signed-off-by: David S. Miller commit 45aec1ae72fc592f231e9e73ed9ed4d10cfbc0b5 Author: venkatesh.pallipadi@intel.com Date: Tue Mar 18 17:00:22 2008 -0700 x86: PAT export resource_wc in pci sysfs For the ranges with IORESOURCE_PREFETCH, export a new resource_wc interface in pci /sysfs along with resource (which is uncached). Signed-off-by: Venkatesh Pallipadi Signed-off-by: Suresh Siddha Acked-by: Jesse Barnes Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner commit 7afb380db43ed137b7f67e0e3c3e5afd1ecde730 Merge: a405657... 208aefa... Author: David S. Miller Date: Wed Jun 11 20:27:51 2008 -0700 Merge branch 'davem-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 commit 208aefa2451cc1f4d87622cb9b2ca4333afa8337 Author: Christophe Jaillet Date: Thu May 15 23:26:22 2008 +0200 drivers/net/r6040.c: correct bad use of round_jiffies() Compared to other places in the kernel, I think that this driver misuses the function round_jiffies. Signed-off-by: Christophe Jaillet Signed-off-by: Jeff Garzik commit 8b9835108f68938a5f7e74fd2c0fc65da2abad92 Author: Roel Kluin Date: Mon Jun 9 16:33:51 2008 -0700 fec_mpc52xx: MPC52xx_MESSAGES_DEFAULT: 2nd NETIF_MSG_IFDOWN => IFUP Duplicate NETIF_MSG_IFDOWN, 2nd should be NETIF_MSG_IFUP Signed-off-by: Roel Kluin Acked-by: Sylvain Munaut Cc: Grant Likely Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 0761248f08ccd94ddceb5454eb1ad96626b10611 Author: Roel Kluin Date: Mon Jun 9 16:33:50 2008 -0700 ipg: fix receivemode IPG_RM_RECEIVEMULTICAST{,HASH} in ipg_nic_set_multicast_list() The branches are dead code. even when dev->flag IFF_MULTICAST (defined 0x1000) is set, dev->flags & IFF_MULTICAST & [boolean] always evaluates to 0. Signed-off-by: Roel Kluin Cc: Francois Romieu Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit a4056573873dc9fc506ce9293c4d01670101a637 Merge: 5cb960a... 1717699... Author: David S. Miller Date: Wed Jun 11 18:11:16 2008 -0700 Merge branch 'net-2.6-misc-20080611a' of git://git.linux-ipv6.org/gitroot/yoshfuji/linux-2.6-fix commit 5cb960a80531211379f8f05c575725d7630098fe Merge: ceeff75... be4c798... Author: David S. Miller Date: Wed Jun 11 17:53:04 2008 -0700 Merge branch 'master' of git://eden-feed.erg.abdn.ac.uk/net-2.6 commit ceeff7541e5a4ba8e8d97ffbae32b3f283cb7a3f Author: Patrick McHardy Date: Wed Jun 11 17:51:10 2008 -0700 netfilter: nf_conntrack: fix ctnetlink related crash in nf_nat_setup_info() When creation of a new conntrack entry in ctnetlink fails after having set up the NAT mappings, the conntrack has an extension area allocated that is not getting properly destroyed when freeing the conntrack again. This means the NAT extension is still in the bysource hash, causing a crash when walking over the hash chain the next time: BUG: unable to handle kernel paging request at 00120fbd IP: [] nf_nat_setup_info+0x221/0x58a *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP Pid: 2795, comm: conntrackd Not tainted (2.6.26-rc5 #1) EIP: 0060:[] EFLAGS: 00010206 CPU: 1 EIP is at nf_nat_setup_info+0x221/0x58a EAX: 00120fbd EBX: 00120fbd ECX: 00000001 EDX: 00000000 ESI: 0000019e EDI: e853bbb4 EBP: e853bbc8 ESP: e853bb78 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process conntrackd (pid: 2795, ti=e853a000 task=f7de10f0 task.ti=e853a000) Stack: 00000000 e853bc2c e85672ec 00000008 c0561084 63c1db4a 00000000 00000000 00000000 0002e109 61d2b1c3 00000000 00000000 00000000 01114e22 61d2b1c3 00000000 00000000 f7444674 e853bc04 00000008 c038e728 0000000a f7444674 Call Trace: [] nla_parse+0x5c/0xb0 [] ctnetlink_change_status+0x190/0x1c6 [] ctnetlink_new_conntrack+0x189/0x61f [] update_curr+0x3d/0x52 [] nfnetlink_rcv_msg+0xc1/0xd8 [] nfnetlink_rcv_msg+0x18/0xd8 [] nfnetlink_rcv_msg+0x0/0xd8 [] netlink_rcv_skb+0x2d/0x71 [] nfnetlink_rcv+0x19/0x24 [] netlink_unicast+0x1b3/0x216 ... Move invocation of the extension destructors to nf_conntrack_free() to fix this problem. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=10875 Reported-and-Tested-by: Krzysztof Piotr Oledzki Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit b66985b11b8b00e1ec65b89a3112510ac9a9ec6e Author: Eric Leblond Date: Wed Jun 11 17:50:27 2008 -0700 netfilter: Make nflog quiet when no one listen in userspace. The message "nf_log_packet: can't log since no backend logging module loaded in! Please either load one, or disable logging explicitly" was displayed for each logged packet when no userspace application is listening to nflog events. The message seems to warn for a problem with a kernel module missing but as said before this is not the case. I thus propose to suppress the message (I don't see any reason to flood the log because a user application has crashed.) Signed-off-by: Eric Leblond Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 1717699cd5130009b7cd6756e883d8582c1fe706 Author: YOSHIFUJI Hideaki Date: Thu Jun 12 03:27:26 2008 +0900 ipv6: Fail with appropriate error code when setting not-applicable sockopt. IPV6_MULTICAST_HOPS, for example, is not valid for stream sockets. Since they are virtually unavailable for stream sockets, we should return ENOPROTOOPT instead of EINVAL. Signed-off-by: YOSHIFUJI Hideaki commit 28d4488216645cd71402925cffde9528b0cfdb7e Author: YOSHIFUJI Hideaki Date: Thu Jun 12 03:14:51 2008 +0900 ipv6: Check IPV6_MULTICAST_LOOP option value. Only 0 and 1 are valid for IPV6_MULTICAST_LOOP socket option, and we should return an error of EINVAL otherwise, per RFC3493. Based on patch from Shan Wei . Signed-off-by: YOSHIFUJI Hideaki commit e8766fc86b34d44a8c55a2f9d71da69e091b1ca4 Author: Shan Wei Date: Tue Jun 10 15:50:55 2008 +0800 ipv6: Check the hop limit setting in ancillary data. When specifing the outgoing hop limit as ancillary data for sendmsg(), the kernel doesn't check the integer hop limit value as specified in [RFC-3542] section 6.3. Signed-off-by: Shan Wei Signed-off-by: YOSHIFUJI Hideaki commit 36e3deae8ba84865fd9eb3f2f21bbc00d49b7544 Author: YOSHIFUJI Hideaki Date: Tue May 13 02:52:55 2008 +0900 ipv6 route: Fix route lifetime in netlink message. 1) We may have route lifetime larger than INT_MAX. In that case we had wired value in lifetime. Use INT_MAX if lifetime does not fit in s32. 2) Lifetime is valid iif RTF_EXPIRES is set. Signed-off-by: YOSHIFUJI Hideaki commit 20c61fbd8deb2ada0ac3acecf6156a986dbfff2d Author: YOSHIFUJI Hideaki Date: Mon Apr 28 14:40:55 2008 +0900 ipv6 mcast: Check address family of gf_group in getsockopt(MS_FILTER). Signed-off-by: YOSHIFUJI Hideaki commit 62cfcf4f467733a8dc218691c791804a148da887 Author: Jürgen Schindele Date: Wed Jun 11 19:56:06 2008 +0100 [ARM] 5090/1: Correct pxafb palette typo error This patch correct a typo error in pxafb vhich is relevant for 8-bit palette framebuffer configuration. Signed-off-by: Jrgen Schindele Acked-by: Eric Miao Signed-off-by: Russell King commit a4aff2233786640c10b178ad78d4dd7e375f1955 Author: Guennadi Liakhovetski Date: Thu Jun 5 10:43:14 2008 +0100 [ARM] 5077/1: spi: fix list scan success verification in PXA ssp driver The list search success check in arch/arm/mach-pxa/ssp.c is wrong: for example, it didn't recognise failure for me when I requested port 0. Signed-off-by: Guennadi Liakhovetski Acked-by: Eric Miao Signed-off-by: Russell King commit be4c798a41bf626cdaacf96c382f116ed2f7dbe9 Author: Gerrit Renker Date: Wed Jun 11 11:19:10 2008 +0100 dccp: Bug in initial acknowledgment number assignment Step 8.5 in RFC 4340 says for the newly cloned socket Initialize S.GAR := S.ISS, but what in fact the code (minisocks.c) does is Initialize S.GAR := S.ISR, which is wrong (typo?) -- fixed by the patch. Signed-off-by: Gerrit Renker commit 7deb0f851003287d7e259bf6b33548b144c0f2d5 Author: Gerrit Renker Date: Wed Jun 11 11:19:10 2008 +0100 dccp ccid-3: X truncated due to type conversion This fixes a bug in computing the inter-packet-interval t_ipi = s/X: scaled_div32(a, b) uses u32 for b, but in "scaled_div32(s, X)" the type of the sending rate `X' is u64. Since X is scaled by 2^6, this truncates rates greater than 2^26 Bps (~537 Mbps). Using full 64-bit division now. Signed-off-by: Gerrit Renker commit 1e8a287c79f64226541f5c44aa52d4698bb84cf5 Author: Gerrit Renker Date: Wed Jun 11 11:19:10 2008 +0100 dccp ccid-3: TFRC reverse-lookup Bug-Fix This fixes a bug in the reverse lookup of p: given a value f(p), instead of p, the function returned the smallest tabulated value f(p). The smallest tabulated value of 10^6 * f(p) = sqrt(2*p/3) + 12 * sqrt(3*p/8) * (32 * p^3 + p) for p=0.0001 is 8172. Since this value is scaled by 10^6, the outcome of this bug is that a loss of 8172/10^6 = 0.8172% was reported whenever the input was below the table resolution of 0.01%. This means that the value was over 80 times too high, resulting in large spikes of the initial loss interval, thus unnecessarily reducing the throughput. Also corrected the printk format (%u for u32). Signed-off-by: Gerrit Renker commit 65907a433ac0ca450c4408080f24c6e4743386b2 Author: Gerrit Renker Date: Wed Jun 11 11:19:09 2008 +0100 dccp ccid-2: Bug-Fix - Ack Vectors need to be ignored on request sockets This fixes an oversight from an earlier patch, ensuring that Ack Vectors are not processed on request sockets. The issue is that Ack Vectors must not be parsed on request sockets, since the Ack Vector feature depends on the selection of the (TX) CCID. During the initial handshake the CCIDs are undefined, and so RFC 4340, 10.3 applies: "Using CCID-specific options and feature options during a negotiation for the corresponding CCID feature is NOT RECOMMENDED [...]" And it is not even possible: when the server receives the Request from the client, the CCID and Ack vector features are undefined; when the Ack finalising the 3-way hanshake arrives, the request socket has not been cloned yet into a full socket. (This order is necessary, since otherwise the newly created socket would have to be destroyed whenever an option error occurred - a malicious hacker could simply send garbage options and exploit this.) Signed-off-by: Gerrit Renker commit 1e2f0e5e8376f2a0ada8760fc9d3104e1a81382b Author: Gerrit Renker Date: Wed Jun 11 11:19:09 2008 +0100 dccp: Fix sparse warnings This patch fixes the following sparse warnings: * nested min(max()) expression: net/dccp/ccids/ccid3.c:91:21: warning: symbol '__x' shadows an earlier one net/dccp/ccids/ccid3.c:91:21: warning: symbol '__y' shadows an earlier one * Declaration of function prototypes in .c instead of .h file, resulting in "should it be static?" warnings. * Declared "struct dccpw" static (local to dccp_probe). * Disabled dccp_delayed_ack() - not fully removed due to RFC 4340, 11.3 ("Receivers SHOULD implement delayed acknowledgement timers ..."). * Used a different local variable name to avoid net/dccp/ackvec.c:293:13: warning: symbol 'state' shadows an earlier one net/dccp/ackvec.c:238:33: originally declared here * Removed unused functions `dccp_ackvector_print' and `dccp_ackvec_print'. Signed-off-by: Gerrit Renker commit 3294f202dc1acd82223e83ef59f272bd87bb06b2 Author: Gerrit Renker Date: Wed Jun 11 11:19:09 2008 +0100 dccp ccid-3: Bug-Fix - Zero RTT is possible In commit $(825de27d9e40b3117b29a79d412b7a4b78c5d815) (from 27th May, commit message `dccp ccid-3: Fix "t_ipi explosion" bug'), the CCID-3 window counter computation was fixed to cope with RTTs < 4 microseconds. Such RTTs can be found e.g. when running CCID-3 over loopback. The fix removed a check against RTT < 4, but introduced a divide-by-zero bug. All steady-state RTTs in DCCP are filtered using dccp_sample_rtt(), which ensures non-zero samples. However, a zero RTT is possible on initialisation, when there is no RTT sample from the Request/Response exchange. The fix is to use the fallback-RTT from RFC 4340, 3.4. This is also better than just fixing update_win_count() since it allows other parts of the code to always assume that the RTT is non-zero during the time that the CCID is used. Signed-off-by: Gerrit Renker commit 738eca74d1bd3e51180de179b7b74d4e34c4e5a3 Author: Robert Reif Date: Tue Jun 10 14:13:09 2008 -0700 sparc: get leo framebuffer working This patch fixes several issues: Use the right openprom device name so the driver is actually loaded. Fix a crash due to unitialized info->pseudo_palette. Put the framebuffer in the proper mode for software rendering. checkpatch cleanups. Hardware acceleration was removed when the driver was rewritten for the new framebuffer API in 2003. Software rendering requires a different framebuffer access mode but that wasn't changed. The driver now works again but is slow. The proper fix is to reintroduce hardware acceleration. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit b7f09ae583c49d28b2796d2fa5893dcf822e3a10 Author: Miquel van Smoorenburg Date: Thu Jun 5 18:14:44 2008 +0200 x86, pci-dma.c: don't always add __GFP_NORETRY to gfp Currently arch/x86/kernel/pci-dma.c always adds __GFP_NORETRY to the allocation flags, because it wants to be reasonably sure not to deadlock when calling alloc_pages(). But really that should only be done in two cases: - when allocating memory in the lower 16 MB DMA zone. If there's no free memory there, waiting or OOM killing is of no use - when optimistically trying an allocation in the DMA32 zone when dma_mask < DMA_32BIT_MASK hoping that the allocation happens to fall within the limits of the dma_mask Also blindly adding __GFP_NORETRY to the the gfp variable might not be a good idea since we then also use it when calling dma_ops->alloc_coherent(). Clearing it might also not be a good idea, dma_alloc_coherent()'s caller might have set it on purpose. The gfp variable should not be clobbered. [ mingo@elte.hu: converted to delta patch ontop of previous version. ] Signed-off-by: Miquel van Smoorenburg Signed-off-by: Ingo Molnar commit f529626a86d61897862aa1bbbb4537773209238e Author: Pavel Machek Date: Thu May 29 00:30:21 2008 -0700 suspend-vs-iommu: prevent suspend if we could not resume iommu/gart support misses suspend/resume code, which can do bad stuff, including memory corruption on resume. Prevent system suspend in case we would be unable to resume. Signed-off-by: Pavel Machek Tested-by: Patrick Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit db9f600b96c16bb3c7f094e294fbdd370226ad86 Author: Miquel van Smoorenburg Date: Wed May 28 10:31:25 2008 +0200 x86: pci-dma.c: use __GFP_NO_OOM instead of __GFP_NORETRY On Wed, 2008-05-28 at 04:47 +0200, Andi Kleen wrote: > > So... why not just remove the setting of __GFP_NORETRY? Why is it > > wrong to oom-kill things in this case? > > When the 16MB zone overflows (which can be common in some workloads) > calling the OOM killer is pretty useless because it has barely any > real user data [only exception would be the "only 16MB" case Alan > mentioned]. Killing random processes in this case is bad. > > I think for 16MB __GFP_NORETRY is ok because there should be > nothing freeable in there so looping is useless. Only exception would be the > "only 16MB total" case again but I'm not sure 2.6 supports that at all > on x86. > > On the other hand d_a_c() does more allocations than just 16MB, especially > on 64bit and the other zones need different strategies. Okay, so how about this then ? Signed-off-by: Ingo Molnar commit 75b19b790bec3ebffbf513405b27500e22270cbc Author: Bertram Felgenhauer Date: Fri May 30 03:20:05 2008 +0200 pci, x86: add workaround for bug in ASUS A7V600 BIOS (rev 1005) This BIOS claims the VIA 8237 south bridge to be compatible with VIA 586, which it is not. Without this patch, I get the following warning while booting, among others, | PCI: Using IRQ router VIA [1106/3227] at 0000:00:11.0 | ------------[ cut here ]------------ | WARNING: at arch/x86/pci/irq.c:265 pirq_via586_get+0x4a/0x60() | Modules linked in: | Pid: 1, comm: swapper Not tainted 2.6.26-rc4-00015-g1ec7d99 #1 | [] warn_on_slowpath+0x54/0x70 | [] ? vt_console_print+0x210/0x2b0 | [] ? vt_console_print+0x0/0x2b0 | [] ? __call_console_drivers+0x43/0x60 | [] ? _call_console_drivers+0x52/0x80 | [] ? release_console_sem+0x1c9/0x200 | [] ? raw_pci_read+0x41/0x70 | [] ? pci_read+0x2f/0x40 | [] pirq_via586_get+0x4a/0x60 | [] ? pirq_via586_get+0x0/0x60 | [] pcibios_lookup_irq+0x15d/0x430 | [] pcibios_irq_init+0x17a/0x3e0 | [] ? kernel_init+0x0/0x250 | [] kernel_init+0x73/0x250 | [] ? pcibios_irq_init+0x0/0x3e0 | [] ? schedule_tail+0x10/0x40 | [] ? ret_from_fork+0x6/0x1c | [] ? kernel_init+0x0/0x250 | [] ? kernel_init+0x0/0x250 | [] kernel_thread_helper+0x7/0x1c | ======================= | ---[ end trace 4eaa2a86a8e2da22 ]--- and IRQ trouble later, | irq 10: nobody cared (try booting with the "irqpoll" option) Now that's an VIA 8237 chip, so pirq_via586_get shouldn't be called at all; adding this workaround to via_router_probe() fixes the problem for me. Amazingly I have a 2.6.23.8 kernel that somehow works fine ... I'll never understand why. Signed-off-by: Bertram Felgenhauer Acked-by: Alan Cox Signed-off-by: Ingo Molnar commit 4efeb4dd3c0bf534e431a8e7c72d0afbd4cd24aa Author: Yinghai Lu Date: Mon May 12 21:21:05 2008 +0200 PCI: use dev_to_node in pci_call_probe to make sure get one online node. Signed-off-by: Yinghai Lu Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner commit a1676072558854b95336c8f7db76b0504e909a0a Author: Tony Camuso Date: Thu May 15 14:40:14 2008 -0400 PCI: Correct last two HP entries in the bfsort whitelist Greetings. There is a code flaw in the bfsort whitelist, where there are redundant entries for the same two HP systems, DL385 G2 and DL585 G2. This patch replaces those redundant entries with the correct ones. The correct entries are for large-volume systems, the DL360 and DL380. ----------------------------------------------------------------------- commit ec69f0374c3b0ad7ea991b0e9ac00377acfe5b1a Author: Tony Camuso Date: Wed May 14 07:09:28 2008 -0400 Replace Redundant Whitelist Entries with the Correct Ones The ProLiant DL585 G2 and the DL585 G2 are entered reundantly in the dmi_system_id table. What should have been there are the DL360 and DL380. This patch simply replaces the redundant entries with the correct entries. arch/x86/pci/common.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) Signed-off-by: Tony Camuso Signed-off-by: Pat Schoeller Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner