commit ec0c15afb41fd9ad45b53468b60db50170e22346 Author: Linus Torvalds Date: Wed Sep 3 07:30:13 2008 -0700 Split up PIT part of TSC calibration from native_calibrate_tsc The TSC calibration function is still very complicated, but this makes it at least a little bit less so by moving the PIT part out into a helper function of its own. Tested-by: Larry Finger Signed-of-by: Linus Torvalds commit d26acd92fa990764b72608a68224f46fac377032 Merge: fbb16e2... 37b08e3... Author: Linus Torvalds Date: Tue Sep 2 21:02:14 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: ipsec: Fix deadlock in xfrm_state management. ipv: Re-enable IP when MTU > 68 net/xfrm: Use an IS_ERR test rather than a NULL test ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message. ath9k: Incorrect key used when group and pairwise ciphers are different. rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON mac80211: Fix debugfs union misuse and pointer corruption wireless/libertas/if_cs.c: fix memory leaks orinoco: Multicast to the specified addresses iwlwifi: fix 64bit platform firmware loading iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE) iwlwifi: workaround interrupt handling no some platforms iwlwifi: do not use GFP_DMA in iwl_tx_queue_init net/wireless/Kconfig: clarify the description for CONFIG_WIRELESS_EXT_SYSFS net: Unbreak userspace usage of linux/mroute.h pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock() ipv6: When we droped a packet, we should return NET_RX_DROP instead of 0 commit fbb16e243887332dd5754e48ffe5b963378f3cd2 Author: Thomas Gleixner Date: Wed Sep 3 00:54:47 2008 +0200 [x86] Fix TSC calibration issues Larry Finger reported at http://lkml.org/lkml/2008/9/1/90: An ancient laptop of mine started throwing errors from b43legacy when I started using 2.6.27 on it. This has been bisected to commit bfc0f59 "x86: merge tsc calibration". The unification of the TSC code adopted mostly the 64bit code, which prefers PMTIMER/HPET over the PIT calibration. Larrys system has an AMD K6 CPU. Such systems are known to have PMTIMER incarnations which run at double speed. This results in a miscalibration of the TSC by factor 0.5. So the resulting calibrated CPU/TSC speed is half of the real CPU speed, which means that the TSC based delay loop will run half the time it should run. That might explain why the b43legacy driver went berserk. On the other hand we know about systems, where the PIT based calibration results in random crap due to heavy SMI/SMM disturbance. On those systems the PMTIMER/HPET based calibration logic with SMI detection shows better results. According to Alok also virtualized systems suffer from the PIT calibration method. The solution is to use a more wreckage aware aproach than the current either/or decision. 1) reimplement the retry loop which was dropped from the 32bit code during the merge. It repeats the calibration and selects the lowest frequency value as this is probably the closest estimate to the real frequency 2) Monitor the delta of the TSC values in the delay loop which waits for the PIT counter to reach zero. If the maximum value is significantly different from the minimum, then we have a pretty safe indicator that the loop was disturbed by an SMI. 3) keep the pmtimer/hpet reference as a backup solution for systems where the SMI disturbance is a permanent point of failure for PIT based calibration 4) do the loop iteration for both methods, record the lowest value and decide after all iterations finished. 5) Set a clear preference to PIT based calibration when the result makes sense. The implementation does the reference calibration based on HPET/PMTIMER around the delay, which is necessary for the PIT anyway, but keeps separate TSC values to ensure the "independency" of the resulting calibration values. Tested on various 32bit/64bit machines including Geode 266Mhz, AMD K6 (affected machine with a double speed pmtimer which I grabbed out of the dump), Pentium class machines and AMD/Intel 64 bit boxen. Bisected-by: Larry Finger Signed-off-by: Thomas Gleixner Tested-by: Larry Finger Signed-off-by: Linus Torvalds commit 37b08e34a98c664bea86e3fae718ac45a46b7276 Author: David S. Miller Date: Tue Sep 2 20:14:15 2008 -0700 ipsec: Fix deadlock in xfrm_state management. Ever since commit 4c563f7669c10a12354b72b518c2287ffc6ebfb3 ("[XFRM]: Speed up xfrm_policy and xfrm_state walking") it is illegal to call __xfrm_state_destroy (and thus xfrm_state_put()) with xfrm_state_lock held. If we do, we'll deadlock since we have the lock already and __xfrm_state_destroy() tries to take it again. Fix this by pushing the xfrm_state_put() calls after the lock is dropped. Signed-off-by: David S. Miller commit 8b76f46a2db29407fed66cf4aca19d61b3dcb3e1 Author: Andrew Morton Date: Tue Sep 2 14:36:14 2008 -0700 drivers/char/random.c: fix a race which can lead to a bogus BUG() Fix a bug reported by and diagnosed by Aaron Straus. This is a regression intruduced into 2.6.26 by commit adc782dae6c4c0f6fb679a48a544cfbcd79ae3dc Author: Matt Mackall Date: Tue Apr 29 01:03:07 2008 -0700 random: simplify and rename credit_entropy_store credit_entropy_bits() does: spin_lock_irqsave(&r->lock, flags); ... if (r->entropy_count > r->poolinfo->POOLBITS) r->entropy_count = r->poolinfo->POOLBITS; so there is a time window in which this BUG_ON(): static size_t account(struct entropy_store *r, size_t nbytes, int min, int reserved) { unsigned long flags; BUG_ON(r->entropy_count > r->poolinfo->POOLBITS); /* Hold lock while accounting */ spin_lock_irqsave(&r->lock, flags); can trigger. We could fix this by moving the assertion inside the lock, but it seems safer and saner to revert to the old behaviour wherein entropy_store.entropy_count at no time exceeds entropy_store.poolinfo->POOLBITS. Reported-by: Aaron Straus Cc: Matt Mackall Cc: Theodore Ts'o Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d3593574702ae1899e23a1535da1ac71f928042 Author: John Kacur Date: Tue Sep 2 14:36:13 2008 -0700 pm_qos_requirement might sleep Make PM_QOS and CPU_IDLE play nicer when run with the RT-Preempt kernel. The purpose of the patch is to remove the spin_lock around the read in the function pm_qos_requirement - since spinlocks can sleep in -rt and this function is called from idle. CPU_IDLE polls the target_value's of some of the pm_qos parameters from the idle loop causing sleeping locking warnings. Changing the target_value to an atomic avoids this issue. Remove the spinlock in pm_qos_requirement by making target_value an atomic type. Signed-off-by: mark gross Signed-off-by: John Kacur Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74c4633da7994eddcfcd2762a448c6889cc2b5bd Author: Rafael J. Wysocki Date: Tue Sep 2 14:36:11 2008 -0700 rtc-cmos: wake again from S5 Update rtc-cmos shutdown handling to leave RTC alarms active, resolving http://bugzilla.kernel.org/show_bug.cgi?id=11411 on several boards. There are still some systems where the ACPI event handling doesn't cooperate. (Possibly related to bugid 11312, reporting the spontaneous disabling of RTC events.) Bug 11411 reported that changes to work around some ACPI event issues broke wake-from-S5 handling, as used for DVR applications. (They like to power off, then wake later to record programs.) [yakui.zhao@intel.com: add shutdown for PNP devices] [dbrownell@users.sourceforge.net: update comments] Signed-off-by: Rafael J. Wysocki Signed-off-by: Zhao Yakui Signed-off-by: Zhang Rui Signed-off-by: David Brownell Cc: Stefan Bauer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8b3a8944a9c0f2a3afc1678798b44f0442924a37 Author: Russ Anderson Date: Tue Sep 2 14:36:09 2008 -0700 sysfs: document files in /sys/firmware/sgi_uv/ Document files in /sys/firmware/sgi_uv/. Signed-off-by: Russ Anderson Cc: Jack Steiner Cc: Ingo Molnar Cc: Thomas Gleixner Acked-by: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bb8fb4e6840ecebdc61f7ebd0653187e7128dde5 Author: Mike Christie Date: Tue Sep 2 14:36:07 2008 -0700 ibft: fix target info parsing in ibft module I got this patch through Red Hat's bugzilla from the bug submitter and patch creator. I have just fixed it up so it applies without fuzz to upstream kernels. Original patch and description from Shyam kumar Iyer: The issue [ibft module not displaying targets with short names] is because of an offset calculatation error in the iscsi_ibft.c code. Due to this error directory structure for the target in /sys/firmware/ibft does not get created and so the initiator is unable to connect to the target. Note that this bug surfaced only with an name that had a short section at the end. eg: "iqn.1984-05.com.dell:dell". It did not surface when the iqn's had a longer section at the end. eg: "iqn.2001-04.com.example:storage.disk2.sys1.xyz" So, the eot_offset was calculated such that an extra 48 bytes i.e. the size of the ibft_header which has already been accounted was subtracted twice. This was not evident with longer iqn names because they would overshoot the total ibft length more than 48 bytes and thus would escape the bug. Signed-off-by: Shyam Kumar Iyer Signed-off-by: Mike Christie Cc: Konrad Rzeszutek Cc: Peter Jones Cc: James Bottomley Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 73442daf2ea85e2a779396b76b1a39b10188ecb5 Author: Jan Altenberg Date: Tue Sep 2 14:36:05 2008 -0700 rtc_time_to_tm: fix signed/unsigned arithmetic commit 945185a69daa457c4c5e46e47f4afad7dcea734f ("rtc: rtc_time_to_tm: use unsigned arithmetic") changed the some types in rtc_time_to_tm() to unsigned: void rtc_time_to_tm(unsigned long time, struct rtc_time *tm) { - register int days, month, year; + unsigned int days, month, year; This doesn't work for all cases, because days is checked for < 0 later on: if (days < 0) { year -= 1; days += 365 + LEAP_YEAR(year); } I think the correct fix would be to keep days signed and do an appropriate cast later on. Signed-off-by: Jan Altenberg Cc: Maciej W. Rozycki Cc: Alessandro Zummo Cc: David Brownell Cc: Dmitri Vorobiev Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b4a49b12e879ce79f495cc318c4b33caec6922e8 Author: Krzysztof Helt Date: Tue Sep 2 14:36:04 2008 -0700 tdfxfb: fix frame buffer name overrun If there are more then one graphics card handled by the tdfxfb driver the name of the frame buffer overruns reserved size. Signed-off-by: Krzysztof Helt Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf6910c0afb1e416a99ad5b2296e088449fbe481 Author: Krzysztof Helt Date: Tue Sep 2 14:36:03 2008 -0700 tdfxfb: fix SDRAM memory size detection Fix memory detection on Voodoo3 cards with SDRAM memory. Signed-off-by: Krzysztof Helt Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a8823aefd142d2a9c4b3661bf8712ccd2da1b220 Author: Matthew Garrett Date: Tue Sep 2 14:36:03 2008 -0700 hp-wmi: add proper hotkey support It turns out that event 0x4 merely indcates that a hotkey has been pressed, not which one. A further query is required in order to determine the actual keypress. The following patch adds support for that along with the known keycodes. Signed-off-by: Matthew Garrett Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3f6e2f137c5b83c3c2d48fae971e845c3450cc7c Author: Matthew Garrett Date: Tue Sep 2 14:36:00 2008 -0700 hp-wmi: update to match current rfkill semantics hp-wmi currently changes the RFKill state by altering the struct members rather than using the dedicated interface, meaning that update events won't be pushed to userspace. This patch fixes that, along with fixing the declared type of the WWAN kill switch. It also ensures that rfkill interfaces are only registered for hardware that exists. Signed-off-by: Matthew Garrett Acked-by: Henrique de Moraes Holschuh Cc: Ivo van Doorn Cc: Dave Young Cc: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 61e55d0576d0e7eb4fecaeb25b3618e035de5be1 Author: Nadia Derbey Date: Tue Sep 2 14:35:59 2008 -0700 ipc: document the new auto_msgmni proc file Update Documentation/filesystems/proc.txt: it describes the file auto_msgmni intoduced to enable/disable msgmni automatic recomputing upon memory add/remove (see thread http://lkml.org/lkml/2008/7/4/27). Also added a description for msgmni (this filex is only listed in Documentation/sysctl/kernel.txt). Signed-off-by: Nadia Derbey Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b954185214c3b562c3fcc651e9ec69d421d76bfa Author: KOSAKI Motohiro Date: Tue Sep 2 14:35:58 2008 -0700 mm: size of quicklists shouldn't be proportional to the number of CPUs Quicklists store pages for each CPU as caches. (Each CPU can cache node_free_pages/16 pages) It is used for page table cache. exit() will increase the cache size, while fork() consumes it. So for example if an apache-style application runs (one parent and many child model), one CPU process will fork() while another CPU will process the middleware work and exit(). At that time, the CPU on which the parent runs doesn't have page table cache at all. Others (on which children runs) have maximum caches. QList_max = (#ofCPUs - 1) x Free / 16 => QList_max / (Free + QList_max) = (#ofCPUs - 1) / (16 + #ofCPUs - 1) So, How much quicklist memory is used in the maximum case? This is proposional to # of CPUs because the limit of per cpu quicklist cache doesn't see the number of cpus. Above calculation mean Number of CPUs per node 2 4 8 16 ============================== ==================== QList_max / (Free + QList_max) 5.8% 16% 30% 48% Wow! Quicklist can spend about 50% memory at worst case. My demonstration program is here -------------------------------------------------------------------------------- #define _GNU_SOURCE #include #include #include #include #include #include #include #include #define BUFFSIZE 512 int max_cpu(void) /* get max number of logical cpus from /proc/cpuinfo */ { FILE *fd; char *ret, buffer[BUFFSIZE]; int cpu = 1; fd = fopen("/proc/cpuinfo", "r"); if (fd == NULL) { perror("fopen(/proc/cpuinfo)"); exit(EXIT_FAILURE); } while (1) { ret = fgets(buffer, BUFFSIZE, fd); if (ret == NULL) break; if (!strncmp(buffer, "processor", 9)) cpu = atoi(strchr(buffer, ':') + 2); } fclose(fd); return cpu; } void cpu_bind(int cpu) /* bind current process to one cpu */ { cpu_set_t mask; int ret; CPU_ZERO(&mask); CPU_SET(cpu, &mask); ret = sched_setaffinity(0, sizeof(mask), &mask); if (ret == -1) { perror("sched_setaffinity()"); exit(EXIT_FAILURE); } sched_yield(); /* not necessary */ } #define MMAP_SIZE (10 * 1024 * 1024) /* 10 MB */ #define FORK_INTERVAL 1 /* 1 second */ main(int argc, char *argv[]) { int cpu_max, nextcpu; long pagesize; pid_t pid; /* set max number of logical cpu */ if (argc > 1) cpu_max = atoi(argv[1]) - 1; else cpu_max = max_cpu(); /* get the page size */ pagesize = sysconf(_SC_PAGESIZE); if (pagesize == -1) { perror("sysconf(_SC_PAGESIZE)"); exit(EXIT_FAILURE); } /* prepare parent process */ cpu_bind(0); nextcpu = cpu_max; loop: /* select destination cpu for child process by round-robin rule */ if (++nextcpu > cpu_max) nextcpu = 1; pid = fork(); if (pid == 0) { /* child action */ char *p; int i; /* consume page tables */ p = mmap(0, MMAP_SIZE, PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0); i = MMAP_SIZE / pagesize; while (i-- > 0) { *p = 1; p += pagesize; } /* move to other cpu */ cpu_bind(nextcpu); /* printf("a child moved to cpu%d after mmap().\n", nextcpu); fflush(stdout); */ /* back page tables to pgtable_quicklist */ exit(0); } else if (pid > 0) { /* parent action */ sleep(FORK_INTERVAL); waitpid(pid, NULL, WNOHANG); } goto loop; } ---------------------------------------- When above program which does task migration runs, my 8GB box spends 800MB of memory for quicklist. This is not memory leak but doesn't seem good. % cat /proc/meminfo MemTotal: 7701568 kB MemFree: 4724672 kB (snip) Quicklists: 844800 kB because - My machine spec is number of numa node: 2 number of cpus: 8 (4CPU x2 node) total mem: 8GB (4GB x2 node) free mem: about 5GB - Then, 4.7GB x 16% ~= 880MB. So, Quicklist can use 800MB. So, if following spec machine run that program CPUs: 64 (8cpu x 8node) Mem: 1TB (128GB x8node) Then, quicklist can waste 300GB (= 1TB x 30%). It is too large. So, I don't like cache policies which is proportional to # of cpus. My patch changes the number of caches from: per-cpu-cache-amount = memory_on_node / 16 to per-cpu-cache-amount = memory_on_node / 16 / number_of_cpus_on_node. Signed-off-by: KOSAKI Motohiro Cc: Keiichiro Tokunaga Acked-by: Christoph Lameter Tested-by: David Miller Acked-by: Mike Travis Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b8561521dbaa3d766b198496b220e984e3bf756 Author: KOSAKI Motohiro Date: Tue Sep 2 14:35:53 2008 -0700 mm: show quicklist usage in /proc/meminfo Quicklists can consume several GB of memory. We should provide a means of monitoring this. After this patch is applied, /proc/meminfo will output the following: % cat /proc/meminfo MemTotal: 7715392 kB MemFree: 5401600 kB Buffers: 80384 kB Cached: 300800 kB SwapCached: 0 kB Active: 235584 kB Inactive: 262656 kB SwapTotal: 2031488 kB SwapFree: 2031488 kB Dirty: 3520 kB Writeback: 0 kB AnonPages: 117696 kB Mapped: 38528 kB Slab: 1589952 kB SReclaimable: 23104 kB SUnreclaim: 1566848 kB PageTables: 14656 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 5889152 kB Committed_AS: 393152 kB VmallocTotal: 17592177655808 kB VmallocUsed: 29056 kB VmallocChunk: 17592177626432 kB Quicklists: 130944 kB HugePages_Total: 0 HugePages_Free: 0 HugePages_Rsvd: 0 HugePages_Surp: 0 Hugepagesize: 262144 kB Signed-off-by: KOSAKI Motohiro Cc: Christoph Lameter Cc: Keiichiro Tokunaga Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 36fd71d293898a59b14e49da1f6e81c1a58f2035 Author: Li Zefan Date: Tue Sep 2 14:35:52 2008 -0700 devcgroup: fix race against rmdir() During the use of a dev_cgroup, we should guarantee the corresponding cgroup won't be deleted (i.e. via rmdir). This can be done through css_get(&dev_cgroup->css), but here we can just get and use the dev_cgroup under rcu_read_lock. And also remove checking NULL dev_cgroup, it won't be NULL since a task always belongs to a cgroup. Signed-off-by: Li Zefan Acked-by: Serge Hallyn Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09a2910e54646f7a334702fbafa7a6129dc072e6 Author: Krzysztof Helt Date: Tue Sep 2 14:35:51 2008 -0700 cirrusfb: check_par fixes 1. Check if virtual resolution fits into memory. Otherwise, Linux hangs during panning. 2. When selected use all available memory to maximize yres_virtual to speed up panning (previously also xres_virtual was increased). 3. Simplify memory restriction calculations. Signed-off-by: Krzysztof Helt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 950bbabb5a804690a0201190de5c22837f72f83f Author: Oleg Nesterov Date: Tue Sep 2 14:35:49 2008 -0700 pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits We don't change pid_ns->child_reaper when the main thread of the subnamespace init exits. As Robert Rex pointed out this is wrong. Yes, the re-parenting itself works correctly, but if the reparented task exits it needs ->parent->nsproxy->pid_ns in do_notify_parent(), and if the main thread is zombie its ->nsproxy was already cleared by exit_task_namespaces(). Introduce the new function, find_new_reaper(), which finds the new ->parent for the re-parenting and changes ->child_reaper if needed. Kill the now unneeded exit_child_reaper(). Also move the changing of ->child_reaper from zap_pid_ns_processes() to find_new_reaper(), this consolidates the games with ->child_reaper and makes it stable under tasklist_lock. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11391 Reported-by: Robert Rex Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Acked-by: Pavel Emelyanov Acked-by: Sukadev Bhattiprolu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit add0d4dfd660e9e4fd0af3eac3cad23583c9558f Author: Oleg Nesterov Date: Tue Sep 2 14:35:48 2008 -0700 pid_ns: zap_pid_ns_processes: fix the ->child_reaper changing zap_pid_ns_processes() sets pid_ns->child_reaper = NULL, this is wrong. Yes, we have already killed all tasks in this namespace, and sys_wait4() doesn't see any child. But this doesn't mean ->children list is empty, we may have EXIT_DEAD tasks which are not visible to do_wait(). In that case the subsequent forget_original_parent() will crash the kernel because it will try to re-parent these tasks to the NULL reaper. Even if there are no childs, it is not good that forget_original_parent() uses reaper == NULL. Change the code to set ->child_reaper = init_pid_ns.child_reaper instead. We could use pid_ns->parent->child_reaper as well, I think this does not really matter. These EXIT_DEAD tasks are not visible to the new ->parent after re-parenting, they will silently do release_task() eventually. Note that we must change ->child_reaper, otherwise forget_original_parent() will use reaper == father, and in that case we will hit the (correct) BUG_ON(!list_empty(&father->children)). Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Acked-by: Sukadev Bhattiprolu Acked-by: Pavel Emelyanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e385ea63f44b475e034a78b6d8bc6bb50caf72ca Author: David Brownell Date: Tue Sep 2 14:35:46 2008 -0700 mmc: at91_mci: don't use coherent dma buffers At91_mci is abusing dma_free_coherent(), which may not be called with IRQs disabled. I saw "mkfs.ext3" on an MMC card objecting voluminously as each write completed: WARNING: at arch/arm/mm/consistent.c:368 dma_free_coherent+0x2c/0x224() [] (dump_stack+0x0/0x14) from [] (warn_on_slowpath+0x4c/0x68) [] (warn_on_slowpath+0x0/0x68) from [] (dma_free_coherent+0x2c/0x224) r6:00008008 r5:ffc06000 r4:00000000 [] (dma_free_coherent+0x0/0x224) from [] (at91_mci_irq+0x374/0x420) [] (at91_mci_irq+0x0/0x420) from [] (handle_IRQ_event+0x2c/0x6c) ... This bug has been around for a LONG time. The MM warning is from late 2005, but the driver merged a year later ... so I'm puzzled why nobody noticed this before now. The fix involves noting that this buffer shouldn't be DMA-coherent; it's just used for normal DMA writes. So replace it with standard kmalloc() buffering and DMA mapping calls. This is the quickie fix. A better one would not rely on allocating large bounce buffers. (Note that dma_alloc_coherent could have failed too, but that case was ignored... kmalloc is a bit more likely to fail though.) Signed-off-by: David Brownell Acked-by: Pierre Ossman Cc: Andrew Victor Acked-by: Nicolas Ferre Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 363f66fe06c75270b669c88e321e6b354ba0201e Author: Will Newton Date: Tue Sep 2 14:35:44 2008 -0700 8250: improve workaround for UARTs that don't re-assert THRE correctly Recent changes to tighten the check for UARTs that don't correctly re-assert THRE (01c194d9278efc15d4785ff205643e9c0bdcef53: "serial 8250: tighten test for using backup timer") caused problems when such a UART was opened for the second time - the bug could only successfully be detected at first initialization. For users of this version of this particular UART IP it is fatal. This patch stores the information about the bug in the bugs field of the port structure when the port is first started up so subsequent opens can check this bit even if the test for the bug fails. David Brownell: "My own exposure to this is that the UART on DaVinci hardware, which TI allegedly derived from its original 16550 logic, has periodically gone from working to unusable with the mainline 8250.c ... and back and forth a bunch. Currently it's "unusable", a regression from some previous versions. With this patch from Will, it's usable." Signed-off-by: Will Newton Acked-by: Alex Williamson Cc: Alan Cox Cc: David Brownell Cc: [2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bd7aa4b2dafd8e653df265479d99c80747602a50 Author: Henrik Rydberg Date: Tue Sep 2 14:35:43 2008 -0700 MAINTAINERS: add a maintainer for the BCM5974 multitouch driver Signed-off-by: Henrik Rydberg Cc: Dmitry Torokhov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 527655835ebac8f58a8f800a10700712a4c2affd Author: Marcin Slusarz Date: Tue Sep 2 14:35:41 2008 -0700 mm/bootmem: silence section mismatch warning - contig_page_data/bootmem_node_data WARNING: vmlinux.o(.data+0x1f5c0): Section mismatch in reference from the variable contig_page_data to the variable .init.data:bootmem_node_data The variable contig_page_data references the variable __initdata bootmem_node_data If the reference is valid then annotate the variable with __init* (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, Signed-off-by: Marcin Slusarz Cc: Johannes Weiner Cc: Sean MacLennan Cc: Sam Ravnborg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39dbbb4523754df4a822c69191a848a03e556dc7 Author: Russ Dill Date: Tue Sep 2 14:35:40 2008 -0700 acer-wmi: remove debugfs entries upon unloading The exit function neglects to remove debugfs entries, leading to a BUG on reload. [akpm@linux-foundation.org: cleanups] Signed-off-by: Russ Dill Acked-by: Carlos Corbacho Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6ccfa806a9cfbbf1cd43d5b6aa47ef2c0eb518fd Author: Hisashi Hifumi Date: Tue Sep 2 14:35:40 2008 -0700 VFS: fix dio write returning EIO when try_to_release_page fails Dio write returns EIO when try_to_release_page fails because bh is still referenced. The patch commit 3f31fddfa26b7594b44ff2b34f9a04ba409e0f91 Author: Mingming Cao Date: Fri Jul 25 01:46:22 2008 -0700 jbd: fix race between free buffer and commit transaction was merged into 2.6.27-rc1, but I noticed that this patch is not enough to fix the race. I did fsstress test heavily to 2.6.27-rc1, and found that dio write still sometimes got EIO through this test. The patch above fixed race between freeing buffer(dio) and committing transaction(jbd) but I discovered that there is another race, freeing buffer(dio) and ext3/4_ordered_writepage. : background_writeout() ->write_cache_pages() ->ext3_ordered_writepage() walk_page_buffers() -> take a bh ref block_write_full_page() -> unlock_page : <- end_page_writeback : <- race! (dio write->try_to_release_page fails) walk_page_buffers() ->release a bh ref ext3_ordered_writepage holds bh ref and does unlock_page remaining taking a bh ref, so this causes the race and failure of try_to_release_page. To fix this race, I used the approach of falling back to buffered writes if try_to_release_page() fails on a page. [akpm@linux-foundation.org: cleanups] Signed-off-by: Hisashi Hifumi Cc: Chris Mason Cc: Jan Kara Cc: Mingming Cao Cc: Zach Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 344c790e3821dac37eb742ddd0b611a300f78b9a Author: Adam Litke Date: Tue Sep 2 14:35:38 2008 -0700 mm: make setup_zone_migrate_reserve() aware of overlapping nodes I have gotten to the root cause of the hugetlb badness I reported back on August 15th. My system has the following memory topology (note the overlapping node): Node 0 Memory: 0x8000000-0x44000000 Node 1 Memory: 0x0-0x8000000 0x44000000-0x80000000 setup_zone_migrate_reserve() scans the address range 0x0-0x8000000 looking for a pageblock to move onto the MIGRATE_RESERVE list. Finding no candidates, it happily continues the scan into 0x8000000-0x44000000. When a pageblock is found, the pages are moved to the MIGRATE_RESERVE list on the wrong zone. Oops. setup_zone_migrate_reserve() should skip pageblocks in overlapping nodes. Signed-off-by: Adam Litke Acked-by: Mel Gorman Cc: Dave Hansen Cc: Nishanth Aravamudan Cc: Andy Whitcroft Cc: [2.6.25.x, 2.6.26.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 169ccbd44eb20f5bb7e4352451eba25397e29749 Author: Adrian Bunk Date: Tue Sep 2 14:35:37 2008 -0700 NTFS: update homepage Update the location of the NTFS homepage in several files. Signed-off-by: Adrian Bunk Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 06770843c2f0f929a6e0c758dc433902a01aabfb Author: Breno Leitao Date: Tue Sep 2 17:28:58 2008 -0700 ipv: Re-enable IP when MTU > 68 Re-enable IP when the MTU gets back to a valid size. This patch just checks if the in_dev is NULL on a NETDEV_CHANGEMTU event and if MTU is valid (bigger than 68), then re-enable in_dev. Also a function that checks valid MTU size was created. Signed-off-by: Breno Leitao Signed-off-by: David S. Miller commit 9d7d74029e0f5fde3b88b39892b9b9cfdf4ea10a Author: Julien Brunel Date: Tue Sep 2 17:24:28 2008 -0700 net/xfrm: Use an IS_ERR test rather than a NULL test In case of error, the function xfrm_bundle_create returns an ERR pointer, but never returns a NULL pointer. So a NULL test that comes after an IS_ERR test should be deleted. The semantic match that finds this problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @match_bad_null_test@ expression x, E; statement S1,S2; @@ x = xfrm_bundle_create(...) ... when != x = E * if (x != NULL) S1 else S2 // Signed-off-by: Julien Brunel Signed-off-by: Julia Lawall Signed-off-by: David S. Miller commit 773b4e02be28220e9ead80a5fdb180031361439a Author: Senthil Balasubramanian Date: Mon Sep 1 19:58:20 2008 +0530 ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message. This patch addresses an issue with the locking order. ath_rx_flush_tid() uses spin_lock/unlock_bh when IRQs are disabled in sta_notify by mac80211. As node clean up is still pending with ath9k and this problematic portion of the code is expected to change anyway, thinking of a proper fix may not be worthwhile. So having this interim fix helps the users to get rid of the kernel warning message. Pasted the kernel warning message for reference. kernel: ath0: No ProbeResp from current AP 00:1b:11:60:7a:3d - assume out of range kernel: ------------[ cut here ]------------ kernel: WARNING: at kernel/softirq.c:136 local_bh_enable+0x3c/0xab() kernel: Pid: 1029, comm: ath9k Not tainted 2.6.27-rc4-wt-w1fi-wl kernel: kernel: Call Trace: kernel: [] warn_on_slowpath+0x51/0x77 kernel: [] check_preempt_wakeup+0xf3/0x123 kernel: [] autoremove_wake_function+0x9/0x2e kernel: [] local_bh_enable+0x3c/0xab kernel: [] ath_rx_node_cleanup+0x38/0x6e [ath9k] kernel: [] ath_node_detach+0x3b/0xb6 [ath9k] kernel: [] ath9k_sta_notify+0x12b/0x165 [ath9k] kernel: [] queue_work+0x1d/0x49 kernel: [] add_todo+0x70/0x99 [mac80211] kernel: [] __sta_info_unlink+0x16b/0x19e [mac80211] kernel: [] sta_info_unlink+0x18/0x43 [mac80211] kernel: [] ieee80211_associated+0xaa/0x16d [mac80211] kernel: [] ieee80211_sta_work+0x4fb/0x6b4 [mac80211] kernel: [] thread_return+0x30/0xa9 kernel: [] ieee80211_sta_work+0x0/0x6b4 [mac80211] kernel: [] run_workqueue+0xb1/0x17a kernel: [] worker_thread+0xd0/0xdb kernel: [] autoremove_wake_function+0x0/0x2e kernel: [] worker_thread+0x0/0xdb kernel: [] kthread+0x47/0x75 kernel: [] schedule_tail+0x18/0x50 kernel: [] child_rip+0xa/0x11 kernel: [] kthread+0x0/0x75 kernel: [] child_rip+0x0/0x11 kernel: kernel: ---[ end trace e9bb5da661055827 ]--- Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville commit 1b96175b7e5801a908718d8b5270a4f7d94fed28 Author: Senthil Balasubramanian Date: Mon Sep 1 19:45:21 2008 +0530 ath9k: Incorrect key used when group and pairwise ciphers are different. Updating sc_keytype multiple times when groupwise and pairwise ciphers are different results in incorrect pairwise key type assumed for TX control and normal ping fails. This works fine for cases where both groupwise and pairwise ciphers are same. Also use mac80211 provided enums for key length calculation. Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville commit 445df54fec7c1924f44018c4db2a9613b877f10e Author: Boaz Harrosh Date: Mon Sep 1 14:47:19 2008 +0300 rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON A "Set" to a sign-bit in an "&" operation causes a compiler warning. Make calculations unsigned. [ The warning was masked by the old definition of BUILD_BUG_ON() ] Also remove __builtin_constant_p from FIELD_CHECK since BUILD_BUG_ON no longer permits non-const values. Signed-off-by: Boaz Harrosh CC: Ingo Molnar CC: Rusty Russell Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit 2b58b209399844995ad48e421267e359e16c03db Author: Jouni Malinen Date: Thu Aug 28 15:12:06 2008 +0300 mac80211: Fix debugfs union misuse and pointer corruption debugfs union in struct ieee80211_sub_if_data is misused by including a common default_key dentry as a union member. This ends occupying the same memory area with the first dentry in other union members (structures; usually drop_unencrypted). Consequently, debugfs operations on default_key symlinks and drop_unencrypted entry are using the same dentry pointer even though they are supposed to be separate ones. This can lead to removing entries incorrectly or potentially leaving something behind since one of the dentry pointers gets lost. Fix this by moving the default_key dentry to a new struct (common_debugfs) that contains dentries (more to be added in future) that are shared by all vif types. The debugfs union must only be used for vif type-specific entries to avoid this type of pointer corruption. Signed-off-by: Jouni Malinen Acked-by: Johannes Berg Signed-off-by: John W. Linville commit 9a52028e534b0567913a4144060e774891c00a37 Author: Adrian Bunk Date: Thu Aug 28 01:05:08 2008 +0300 wireless/libertas/if_cs.c: fix memory leaks The leak in if_cs_prog_helper() is obvious. It looks a bit as if not freeing "fw" in if_cs_prog_real() was done intentionally, but I'm not seeing why it shouldn't be freed. Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Acked-by: Holger Schurig Signed-off-by: John W. Linville commit 667d41008eb8a0e1d495d6c0a6143b43fe587c98 Author: David Kilroy Date: Sat Aug 23 19:03:34 2008 +0100 orinoco: Multicast to the specified addresses When multicasting the driver sets the number of group addresses using the count from the previous set multicast command. In general this means you have to set the multicast addresses twice to get the behaviour you want. If we were multicasting, and reduce the number of addresses we are multicasting to, then the driver would write uninitialised data from the stack into the group addresses to multicast to. Only write the multicast addresses we have specifically set. Signed-off-by: David Kilroy Signed-off-by: John W. Linville commit f0b9f5cb4adcec9424142592ca7bf024fe6c91a9 Author: Tomas Winkler Date: Thu Aug 28 17:25:10 2008 +0800 iwlwifi: fix 64bit platform firmware loading This patch fixes loading firmware from memory above 32bit. Signed-off-by: Tomas Winkler Signed-off-by: Emmanuel Grumbach Signed-off-by: Zhu Yi Acked-by: Marcel Holtmann Signed-off-by: John W. Linville commit 1d3e6c61342292140dfe1b921991ee793ec1e0ae Author: Mohamed Abbas Date: Thu Aug 28 17:25:05 2008 +0800 iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE) The patch fixes CSR_GP_CNTRL_REG_FLAG_INIT_DONE was set instead of cleared which disabled moving device to D0U state. Signed-off-by: Mohamed Abbas Signed-off-by: Tomas Winkler Signed-off-by: Zhu Yi Signed-off-by: John W. Linville commit cf88c433bf64b6f7395a39f840bec88a8c58b58b Author: Tomas Winkler Date: Thu Aug 28 17:25:04 2008 +0800 iwlwifi: workaround interrupt handling no some platforms This patch adds workaround for an interrupt related hardware bug on some platforms. (Apparently these platforms boot-up w/ INTX_DISABLED set. -- JWL) Signed-off-by: Tomas Winkler Signed-off-by: Zhu Yi Signed-off-by: John W. Linville commit 49898852e6aa8a6de9a5bc0bab2cf305b3583bbf Author: John W. Linville Date: Tue Sep 2 15:07:18 2008 -0400 iwlwifi: do not use GFP_DMA in iwl_tx_queue_init GFP_DMA is not necessary for the iwlwifi hardware and it can cause allocation failures and/or invoke the OOM killer on lots of systems. For reference: https://bugzilla.redhat.com/show_bug.cgi?id=459709 Signed-off-by: John W. Linville commit d9664741e0e2216770d6e52646474d3982b8eb55 Author: Florian Mickler Date: Tue Sep 2 15:26:34 2008 +0200 net/wireless/Kconfig: clarify the description for CONFIG_WIRELESS_EXT_SYSFS Current setup with hal and NetworkManager will fail to work without newest hal version with this config option disabled. Although this will solve itself by time, at the moment it is dishonest to say that we don't know any software that uses it, if there are many many people relying on old hal versions. Signed-off-by: Florian Mickler Signed-off-by: John W. Linville commit afa153fd7b6afcd55dd6df6aea06bb53aa1d3608 Merge: ba6271e... 5a61dd9... Author: Linus Torvalds Date: Tue Sep 2 11:44:11 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: ide/Kconfig: mark ide-scsi as deprecated ide-disk: remove stale init_idedisk_capacity() documentation palm_bk3710: improve IDE registration ide: fix hwif_to_node() IDE: palm_bk3710: fix compile warning for unused variable IDE: compile fix for sff_dma_ops commit 5a61dd9ec8c5a8e14fbccda3ab042555b692b9b2 Author: Bartlomiej Zolnierkiewicz Date: Tue Sep 2 20:18:48 2008 +0200 ide/Kconfig: mark ide-scsi as deprecated Mark ide-scsi as deprecated and remove stale/bogus documentation. Signed-off-by: Bartlomiej Zolnierkiewicz commit ab1b67a6230648cf65b0342d9887fee890160ca8 Author: Bartlomiej Zolnierkiewicz Date: Tue Sep 2 20:18:47 2008 +0200 ide-disk: remove stale init_idedisk_capacity() documentation Acked-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit bfc2f01fc83f982344f09f491f7c18a6b9a16aa8 Author: David Brownell Date: Tue Sep 2 20:18:47 2008 +0200 palm_bk3710: improve IDE registration * fix device tree ... don't forget to set the parent device * let init/exit code be removed where practical Signed-off-by: David Brownell [bart: splitted it from bigger DaVinci patch, s/hw.parent/hw.dev/] Signed-off-by: Bartlomiej Zolnierkiewicz commit 96f80219b738f84f90e449385bdede90f2910521 Author: Bartlomiej Zolnierkiewicz Date: Tue Sep 2 20:18:47 2008 +0200 ide: fix hwif_to_node() hwif_to_node() incorrectly assumes that hwif->dev always belongs to a PCI device. This results in ide-cs oopsing in init_irq() after commit c56c5648a3bd15ff14c50f284b261140cd5b5472 accidentally fixed device tree registration for ide-cs. Fix it by using dev_to_node(). Thanks to Martin Michlmayr and Larry Finger for help with debugging the issue. Reported-by: Martin Michlmayr Tested-by: Martin Michlmayr Cc: Larry Finger Cc: Dominik Brodowski Signed-off-by: Bartlomiej Zolnierkiewicz commit a1aee8622293138867e7dbd1dd214dfb34cd89d2 Author: Kevin Hilman Date: Tue Sep 2 20:18:47 2008 +0200 IDE: palm_bk3710: fix compile warning for unused variable Signed-off-by: Kevin Hilman Signed-off-by: Bartlomiej Zolnierkiewicz commit 71fc9fcc70e6ad96215510c1dbcbade05cd95e41 Author: Kevin Hilman Date: Tue Sep 2 20:18:46 2008 +0200 IDE: compile fix for sff_dma_ops The sff_dma_ops struct should be wrapped by BLK_DEV_IDEDMA_SFF instead of BLK_DEV_IDEDMA_PCI. Signed-off-by: Kevin Hilman Cc: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit ba6271ea6324decab4c47c4a55de95188d930792 Merge: 99039e1... ee979a1... Author: Linus Torvalds Date: Tue Sep 2 11:05:42 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration ALSA: hda - Fix ALC663 auto-probe ALSA: ASoC: fix pxa2xx-i2s clk_get call ALSA: hda: Distortion fix for dell_m6_core_init commit 99039e1352fa451bd46e2c020dc78bcaf2a159d9 Merge: 72a8d12... c4bacef... Author: Linus Torvalds Date: Tue Sep 2 11:04:47 2008 -0700 Merge branch 'audit.b57' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current * 'audit.b57' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current: [PATCH] audit: Moved variable declaration to beginning of function commit 72a8d129cf5811b77f0d6c8acef9ac34a12bccf4 Merge: 7ed77e8... b2d2c4c... Author: Linus Torvalds Date: Tue Sep 2 11:04:09 2008 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: Fix problem with waiting while holding rcu read lock in md/bitmap.c Remove invalidate_partition call from do_md_stop. commit 7ed77e804650b9095f862a0cfeecaa955224a73e Author: Arjan van de Ven Date: Mon Sep 1 15:09:51 2008 -0700 don't diff generated firmware files With the new firmware infrastructure in 2.6.27, some files are generated and shouldn't be diffed; add these 2 to the "dontdiff" file Signed-off-by: Arjan van de Ven Signed-off-by: Linus Torvalds commit 3df8a905ed09341041a3d1c6309fdb18cc809297 Author: Dennis Jansen Date: Fri Aug 15 01:28:57 2008 +0200 ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board" This fixes a typo in commit 2a2a64714d9c40f7705c4de1e79a5b855c7211a9 "Disable MWAIT via DMI on broken Compal board". It allows the nomwait dmi check to actually detect the Acer 5220. Signed-off-by: Dennis Jansen Tested-by: Dennis Jansen Acked-by: Zhao Yakui Signed-off-by: Linus Torvalds commit 919fae1686881ed3922ea9de5b0c0a4feff3069e Merge: e77295d... b67c5f8... Author: Linus Torvalds Date: Tue Sep 2 10:59:27 2008 -0700 Merge git://git.infradead.org/users/dwmw2/random-2.6 * git://git.infradead.org/users/dwmw2/random-2.6: [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl() dabusb_fpga_download(): fix a memory leak Remove '#include ' from mm/page_isolation.c Fix modules_install on RO nfs-exported trees. commit e77295dc9e6b52281ae85af4068f13752524e9f4 Merge: 1136cf1... 91b8096... Author: Linus Torvalds Date: Tue Sep 2 10:58:11 2008 -0700 Merge branch 'for-2.6.27' of git://linux-nfs.org/~bfields/linux * 'for-2.6.27' of git://linux-nfs.org/~bfields/linux: nfsd: fix buffer overrun decoding NFSv4 acl sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports nfsd: fix compound state allocation error handling svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet commit 1136cf11066a32d4ac2a476dac302858d763703d Author: Michael Schmitz Date: Mon Sep 1 20:27:02 2008 +0200 m68k: atari_keyb_init operator precedence fix Fix operator precedence bug in atari_keyb_init, which caused a failure on CT60 Signed-off-by: Michael Schmitz Signed-off-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 2ecbf813d5e6361eb7c7520a6f5e6afa168df39a Author: Stephen Rothwell Date: Tue Sep 2 03:43:27 2008 +1000 fix typo in arch/parisc/hpux/fs.c A parisc allmodconfig build produces this: arch/parisc/hpux/fs.c:107: error: 'buffer' undeclared (first use in this function) Introduced by commit da574983de9f9283ba35662c8723627096e160de ("[PATCH] fix hpux_getdents()"). Helge Dille also reported this in bugzilla 11461: http://bugzilla.kernel.org/show_bug.cgi?id=11461 and he posted an identical patch. Signed-off-by: Stephen Rothwell Signed-off-by: Helge Deller Signed-off-by: Linus Torvalds commit cbaed698f37494b30b2449b51c728ae48630cb2b Author: Oleg Nesterov Date: Sat Aug 30 21:08:40 2008 +0400 softlockup: minor cleanup, don't check task->state twice The recent commit 16d9679f33caf7e683471647d1472bfe133d858 changed check_hung_task() to filter out the TASK_KILLABLE tasks. We can move this check to the caller which has to test t->state anyway. Signed-off-by: Oleg Nesterov Acked-by: Andi Kleen Signed-off-by: Linus Torvalds commit 6781f4ae30bbb8ebf31187b3c9304be16966f5a0 Author: Randy Dunlap Date: Sun Aug 31 20:31:55 2008 -0700 kernel/resource.c: fix new kernel-doc warning Fix kernel-doc warning for new function: Warning(linux-2.6.27-rc5-git2//kernel/resource.c:448): No description found for parameter 'root' Signed-off-by: Randy Dunlap Signed-off-by: Linus Torvalds commit 6b9886a173ff6c9ed528979c4d0a3566c1f61013 Merge: 6ffbb19... 6c7be29... Author: Linus Torvalds Date: Tue Sep 2 10:46:56 2008 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon: downgrade debug message from info to debug. commit 6ffbb1964afe1236951f7ac30aa0ed202673e374 Merge: 1586553... c76da9d... Author: Linus Torvalds Date: Tue Sep 2 10:45:59 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6: [CIFS] Turn off Unicode during session establishment for plaintext authentication [CIFS] update cifs change log cifs: fix O_APPEND on directio mounts [CIFS] Fix plaintext authentication commit 1586553bc840e17c321f244fc264ea8312678faf Merge: 44e7ed3... ddef43a... Author: Linus Torvalds Date: Tue Sep 2 10:45:01 2008 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: restore original behavior of /proc/partition when there's no partition remove blk_register_filter and blk_unregister_filter in gendisk commit 44e7ed396114a0c43bb2494877aceeb7782e084a Merge: 011fec7... dbb8c35... Author: Linus Torvalds Date: Tue Sep 2 10:43:38 2008 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: setup_valid_addr_bitmap_from_pavail() should be __init sparc: Fix resource flags for PCI children in OF device tree. sparc32: Implement smp_call_function_single(). commit 011fec7486028977e2b4012afb84235759c6ad82 Author: Linus Torvalds Date: Tue Sep 2 10:38:28 2008 -0700 Un-break printk strings in x86 PCI probing code Breaking lines due to some imaginary problem with a long line length is often stupid and wrong, but never more so when it splits a string that is printed out into multiple lines. This really ended up making it much harder to find where some error strings were printed out, because a simple 'grep' didn't work. I'm sure there is tons more of this particular idiocy hiding in other places, but this particular case hit me once more last week. So fix it. Signed-off-by: Linus Torvalds commit ee979a143cfd999adea8a9e272649a3cd9ec84bc Author: Takashi Iwai Date: Tue Sep 2 15:42:20 2008 +0200 ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration Signed-off-by: Takashi Iwai commit 24fb9173815045ab3f85a670d7df8af5af6ff3be Author: Takashi Iwai Date: Tue Sep 2 14:48:20 2008 +0200 ALSA: hda - Fix ALC663 auto-probe Fix the wrong DAC assignment for NID 0x17 mono-pin on ALC663. Signed-off-by: Takashi Iwai commit b67c5f87c13f398ec3f4d6b455cb0bbeda8d7ac0 Author: Zev Weiss Date: Mon Sep 1 05:02:12 2008 -0700 [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl() The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by overwriting more than intended, due the size of struct mtd_erase_region_info changing in commit 0ecbc81adfcb9f15f86b05ff576b342ce81bbef8 ('Support for auto locking flash on power up'). Fix avoids this by copying struct members one by one with put_user(), as there is no longer a convenient struct to use the size of as the length argument to copy_to_user(). Signed-off-by: Zev Weiss Signed-off-by: David Woodhouse commit 02c0267a40c876a4d70f2000f21fe9ff89fb988e Author: Adrian Bunk Date: Thu Aug 28 01:04:30 2008 +0300 dabusb_fpga_download(): fix a memory leak This patch fixes a memory leak in an error path. Reported-by: Adrian Bunk Signed-off-by: Adrian Bunk Signed-off-by: David Woodhouse commit 0ed97ee470c36e05bcaad36c4fb4c501f383ce63 Author: David Woodhouse Date: Mon Sep 1 11:10:28 2008 +0100 Remove '#include ' from mm/page_isolation.c Signed-off-by: David Woodhouse commit 1cede1affb3cc5a9520fdbc75b3fbaa6432cbc5a Author: David Woodhouse Date: Mon Sep 1 10:54:46 2008 +0100 Fix modules_install on RO nfs-exported trees. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=11355 by avoiding a needless rebuild of the firmware/ihex2fw tool. Signed-off-by: David Woodhouse commit c4bacefb7aaf49da11a695f29d85d40909f17693 Author: Cordelia Date: Mon Aug 18 09:45:51 2008 -0700 [PATCH] audit: Moved variable declaration to beginning of function got rid of compilation warning: ISO C90 forbids mixed declarations and code Signed-off-by: Cordelia Sam Signed-off-by: Al Viro commit 91b80969ba466ba4b915a4a1d03add8c297add3f Author: J. Bruce Fields Date: Fri Aug 29 19:18:45 2008 -0400 nfsd: fix buffer overrun decoding NFSv4 acl The array we kmalloc() here is not large enough. Thanks to Johann Dahm and David Richter for bug report and testing. Signed-off-by: J. Bruce Fields Cc: David Richter Tested-by: Johann Dahm commit 27df6f25ff218072e0e879a96beeb398a79cdbc8 Author: Cyrill Gorcunov Date: Sun Aug 31 19:25:49 2008 +0400 sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports Vegard Nossum reported ---------------------- > I noticed that something weird is going on with /proc/sys/sunrpc/transports. > This file is generated in net/sunrpc/sysctl.c, function proc_do_xprt(). When > I "cat" this file, I get the expected output: > $ cat /proc/sys/sunrpc/transports > tcp 1048576 > udp 32768 > But I think that it does not check the length of the buffer supplied by > userspace to read(). With my original program, I found that the stack was > being overwritten by the characters above, even when the length given to > read() was just 1. David Wagner added (among other things) that copy_to_user could be probably used here. Ingo Oeser suggested to use simple_read_from_buffer() here. The conclusion is that proc_do_xprt doesn't check for userside buffer size indeed so fix this by using Ingo's suggestion. Reported-by: Vegard Nossum Signed-off-by: Cyrill Gorcunov CC: Ingo Oeser Cc: Neil Brown Cc: Chuck Lever Cc: Greg Banks Cc: Tom Tucker Signed-off-by: J. Bruce Fields commit c228c24bf1138d4757dbe20615df655815446da3 Author: Andy Adamson Date: Thu Aug 21 08:42:16 2008 -0400 nfsd: fix compound state allocation error handling Move the cstate_alloc call so that if it fails, the response is setup to encode the NFS error. The out label now means that the nfsd4_compound_state has not been allocated. Signed-off-by: Andy Adamson Signed-off-by: J. Bruce Fields commit ddef43a843f620c6742a06633739887a901ec06b Author: Tejun Heo Date: Mon Sep 1 08:55:10 2008 +0200 block: restore original behavior of /proc/partition when there's no partition /proc/partitions didn't use to write out the header if there was no partition. However, recent commit 66c64afe changed the behavior. This is nothing major but there's no reason to change user visible behavior without a good rationale. Restore the original behavior. Note that 2.6.28 has clean up changes scheduled which will replace this rather hacky implementation. Signed-off-by: Tejun Heo Cc: Greg KH Cc: Kay Sievers Signed-off-by: Jens Axboe commit 6e5ea7015c62b672020ee0a7c2764942fe63fa25 Author: Dmitry Baryshkov Date: Sun Aug 31 00:45:02 2008 +0400 ALSA: ASoC: fix pxa2xx-i2s clk_get call pxa2xx-i2s: probe actual device and use it for clk_get call thus fixing error during startup hook Signed-off-by: Dmitry Baryshkov Acked-by: Mark Brown Signed-off-by: Takashi Iwai commit 20f5f95ded9cdab62c26efb146967a75e12533ec Author: Matthew Ranostay Date: Mon Sep 1 08:17:56 2008 +0200 ALSA: hda: Distortion fix for dell_m6_core_init Added the EQ distortion fix to the dell_m6_core_init. Signed-off-by: Matthew Ranostay Signed-off-by: Takashi Iwai commit b2d2c4ceaddc3098f19637a732f74b820a81a9e7 Author: NeilBrown Date: Mon Sep 1 12:48:13 2008 +1000 Fix problem with waiting while holding rcu read lock in md/bitmap.c A recent patch to protect the rdev list with rcu locking leaves us with a problem because we can sleep on memalloc while holding the rcu lock. The rcu lock is only needed while walking the linked list as uninteresting devices (failed or spares) can be removed at any time. So only take the rcu lock while actually walking the linked list. Take a refcount on the rdev during the time when we drop the lock and do the memalloc to start IO. When we return to the locked code, all the interesting devices on the list will not have moved, so we can simply use list_for_each_continue_rcu to pick up where we left off. Signed-off-by: NeilBrown commit 271f5a9b8f8ae0db95de72779d115c9d0b9d3cc5 Author: NeilBrown Date: Mon Sep 1 12:32:52 2008 +1000 Remove invalidate_partition call from do_md_stop. When stopping an md array, or just switching to read-only, we currently call invalidate_partition while holding the mddev lock. The main reason for this is probably to ensure all dirty buffers are flushed (invalidate_partition calls fsync_bdev). However if any dirty buffers are found, it will almost certainly cause a deadlock as starting writeout will require an update to the superblock, and performing that updates requires taking the mddev lock - which is already held. This deadlock can be demonstrated by running "reboot -f -n" with a root filesystem on md/raid, and some dirty buffers in memory. All other calls to stop an array should already happen after a flush. The normal sequence is to stop using the array (e.g. umount) which will cause __blkdev_put to call sync_blockdev. Then open the array and issue the STOP_ARRAY ioctl while the buffers are all still clean. So this invalidate_partition is normally a no-op, except for one case where it will cause a deadlock. So remove it. This patch possibly addresses the regression recored in http://bugzilla.kernel.org/show_bug.cgi?id=11460 and http://bugzilla.kernel.org/show_bug.cgi?id=11452 though it isn't yet clear how it ever worked. Signed-off-by: NeilBrown commit 6c7be29810dd85b4fe75588ec536446c1579d492 Author: Dave Airlie Date: Mon Sep 1 08:51:52 2008 +1000 drm/radeon: downgrade debug message from info to debug. If this triggers its bad, however some machines seem to have been triggering it for ages and we didn't know until we added the debug. So downgrade the debug now so people don't call this a regression. Signed-off-by: Dave Airlie commit dbb8c35d9063fe233626865cc836fbc102fa083b Author: David S. Miller Date: Sat Aug 30 02:04:45 2008 -0700 sparc64: setup_valid_addr_bitmap_from_pavail() should be __init Signed-off-by: David S. Miller commit bef69ea0dcce574a425feb0a5aa4c63dd108b9a6 Author: Linus Torvalds Date: Fri Aug 29 20:18:31 2008 -0700 Resource handling: add 'insert_resource_expand_to_fit()' function Not used anywhere yet, but this complements the existing plain 'insert_resource()' functionality with a version that can expand the resource we are adding in order to fix up any conflicts it has with existing resources. Signed-off-by: Linus Torvalds commit 00aeb429a0f2daeb21979873060b81095cafe4bd Merge: 316d967... df91bc2... Author: Linus Torvalds Date: Fri Aug 29 14:46:49 2008 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: oxygen: fix distorted output on AK4396-based cards Revert "ALSA: hda - Added model selection for iMac 24"" commit 316d9679f33caf7e683471647d1472bfe133d858 Author: Andi Kleen Date: Fri Aug 29 20:06:23 2008 +0200 Don't trigger softlockup detector on network fs blocked tasks Pulling the ethernet cable on a 2.6.27-rc system with NFS mounts currently leads to an ongoing flood of soft lockup detector backtraces for all tasks blocked on the NFS mounts when the hickup takes longer than 120s. I don't think NFS problems should be all that noisy. Luckily there's a reasonably easy way to distingush this case. Don't report task softlockup warnings for tasks in TASK_KILLABLE state, which is used by the network file systems. I believe this patch is a 2.6.27 candidate. Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit b4609472116bb806a95e98d04767189406c74c70 Author: Linus Torvalds Date: Fri Aug 29 14:38:03 2008 -0700 Revert "x86: fix HPET regression in 2.6.26 versus 2.6.25, check hpet against BAR, v3" This reverts commit a2bd7274b47124d2fc4dfdb8c0591f545ba749dd. It wasn't really right to begin with (there's a better fix for the problem with e820 reservations clashing with PCI BAR's pending), but it also actually causes more regressions, so it should be reverted even before the better fix is finalized. Rafael reports that this commit broke AHCI detection, and thus causes the kernel to not boot on his quad core test box. Reported-and-bisected-by: Rafael J. Wysocki Cc: Yinghai Lu Cc: David Witbrodt Cc: Ingo Molnar Signed-off-by: Linus Torvalds commit 7c19a3d280297d43ef5ff7c6b205dc208a16d3d1 Author: David S. Miller Date: Fri Aug 29 14:37:23 2008 -0700 net: Unbreak userspace usage of linux/mroute.h Nothing in linux/pim.h should be exported to userspace. This should fix the XORP build failure reported by Jose Calhariz, the debain package maintainer. Nothing originally in linux/mroute.h was exported to userspace ever, but some of this stuff started to be when it was moved into this new linux/pim.h, and that was wrong. If we didn't provide these definitions for 10 years we can reasonably expect that applications defined this stuff locally or used GLIBC headers providing the protocol definitions. And as such the only result of this can be conflict and userland build breakage. Signed-off-by: David S. Miller commit 102396ae65108b026e4e1868e30fa013f45a169e Author: Jarek Poplawski Date: Fri Aug 29 14:21:52 2008 -0700 pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock() Use qdisc_root_sleeping_lock() instead of qdisc_root_lock() where appropriate. The only difference is while dev is deactivated, when currently we can use a sleeping qdisc with the lock of noop_qdisc. This shouldn't be dangerous since after deactivation root lock could be used only by gen_estimator code, but looks wrong anyway. Signed-off-by: Jarek Poplawski Signed-off-by: David S. Miller commit 3cc76caa98b092a8fb3e7b4303c70f847db0651f Author: Yang Hongyang Date: Fri Aug 29 14:06:51 2008 -0700 ipv6: When we droped a packet, we should return NET_RX_DROP instead of 0 Signed-off-by: Yang Hongyang Signed-off-by: David S. Miller commit df91bc23dcb052ff2da71b3482bf3c5fbf4b8a53 Author: Clemens Ladisch Date: Fri Aug 29 13:08:34 2008 +0200 ALSA: oxygen: fix distorted output on AK4396-based cards When changing the sample rate, the CMI8788's master clock output becomes unstable for a short time. The AK4396 needs the master clock to do SPI writes, so writing to an AK4396 control register directly after a sample rate change will garble the value. In our case, this leads to the DACs being misconfigured to I2S sample format, which results in a wrong output level and horrible distortions on samples louder than -6 dB. To fix this, we need to wait until the new master clock signal has become stable before doing SPI writes. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit bb23b431db7405f6d79f989ad0236bf6428ba1cb Author: FUJITA Tomonori Date: Fri Aug 29 11:47:07 2008 +0200 remove blk_register_filter and blk_unregister_filter in gendisk This patch remove blk_register_filter and blk_unregister_filter in gendisk, and adds them to sd.c, sr.c. and ide-cd.c The commit abf5439370491dd6fbb4fe1a7939680d2a9bc9d4 moved cmdfilter from gendisk to request_queue. It turned out that in some subsystems multiple gendisks share a single request_queue. So we get: Using physmap partition information Creating 3 MTD partitions on "physmap-flash": 0x00000000-0x01c00000 : "User FS" 0x01c00000-0x01c40000 : "booter" kobject (8511c410): tried to init an initialized object, something is seriously wrong. Call Trace: [<8036644c>] dump_stack+0x8/0x34 [<8021f050>] kobject_init+0x50/0xcc [<8021fa18>] kobject_init_and_add+0x24/0x58 [<8021d20c>] blk_register_filter+0x4c/0x64 [<8021c194>] add_disk+0x78/0xe0 [<8027d14c>] add_mtd_blktrans_dev+0x254/0x278 [<8027c8f0>] blktrans_notify_add+0x40/0x78 [<80279c00>] add_mtd_device+0xd0/0x150 [<8027b090>] add_mtd_partitions+0x568/0x5d8 [<80285458>] physmap_flash_probe+0x2ac/0x334 [<802644f8>] driver_probe_device+0x12c/0x244 [<8026465c>] __driver_attach+0x4c/0x84 [<80263c64>] bus_for_each_dev+0x58/0xac [<802633ec>] bus_add_driver+0xc4/0x24c [<802648e0>] driver_register+0xcc/0x184 [<80100460>] _stext+0x60/0x1bc In the long term, we need to fix such subsystems but we need a quick fix now. This patch add the command filter support to only sd and sr though it might be useful for other SG_IO users (such as cciss). Signed-off-by: FUJITA Tomonori Reported-by: Manuel Lauss Signed-off-by: Jens Axboe commit e3c71a32915fabb095de7108c22672e457631a08 Author: David S. Miller Date: Thu Aug 28 21:02:58 2008 -0700 sparc: Fix resource flags for PCI children in OF device tree. When a device is under an EBUS or ISA bus, the resource flags don't get set properly. Fix this by re-evaluating the resource flags at each level of bus as we apply ranges on the way to the root. And let PCI override any existing flags setting, but don't let the default flags calculator make such overrides. Signed-off-by: David S. Miller commit c76da9da1fffa6de263486df54950eb328d58f71 Author: Steve French Date: Thu Aug 28 15:32:22 2008 +0000 [CIFS] Turn off Unicode during session establishment for plaintext authentication LANMAN session setup did not support Unicode (after session setup, unicode can still be used though). Fixes samba bug# 5319 CC: Jeff Layton CC: Stable Kernel Signed-off-by: Steve French commit 2e655021b8d50b5d90ce442f3de6bf3667729910 Author: Steve French Date: Thu Aug 28 15:30:06 2008 +0000 [CIFS] update cifs change log Signed-off-by: Steve French commit 838726c4756813576078203eb7e1e219db0da870 Author: Jeff Layton Date: Thu Aug 28 07:54:59 2008 -0400 cifs: fix O_APPEND on directio mounts The direct I/O write codepath for CIFS is done through cifs_user_write(). That function does not currently call generic_write_checks() so the file position isn't being properly set when the file is opened with O_APPEND. It's also not doing the other "normal" checks that should be done for a write call. The problem is currently that when you open a file with O_APPEND on a mount with the directio mount option, the file position is set to the beginning of the file. This makes any subsequent writes clobber the data in the file starting at the beginning. This seems to fix the problem in cursory testing. It is, however important to note that NFS disallows the combination of (O_DIRECT|O_APPEND). If my understanding is correct, the concern is races with multiple clients appending to a file clobbering each others' data. Since the write model for CIFS and NFS is pretty similar in this regard, CIFS is probably subject to the same sort of races. What's unclear to me is why this is a particular problem with O_DIRECT and not with buffered writes... Regardless, disallowing O_APPEND on an entire mount is probably not reasonable, so we'll probably just have to deal with it and reevaluate this flag combination when we get proper support for O_DIRECT. In the meantime this patch at least fixes the existing problem. Signed-off-by: Jeff Layton Cc: Stable Tree Signed-off-by: Steve French commit 66e4f8c076f8803e83879d986a7803a918b2129e Author: David S. Miller Date: Wed Aug 27 20:03:22 2008 -0700 sparc32: Implement smp_call_function_single(). Reported by Stephen Rothwell. Needed to fix the build when CONFIG_RELAY is enabled. Signed-off-by: David S. Miller commit 6405c9cd9bf7b1c35ed76ef8ee3e217056285702 Merge: bcc55c6... 4c246ed... Author: Steve French Date: Thu Aug 28 02:47:00 2008 +0000 Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6 commit bcc55c6664a90146149ba0fd93052adc94287b9f Author: Steve French Date: Wed Aug 27 21:30:22 2008 +0000 [CIFS] Fix plaintext authentication The last eight bytes of the password field were not cleared when doing lanman plaintext password authentication. This patch fixes that. I tested it with Samba by setting password encryption to no in the server's smb.conf. Other servers also can be configured to force plaintext authentication. Note that plaintexti authentication requires setting /proc/fs/cifs/SecurityFlags to 0x30030 on the client (enabling both LANMAN and also plaintext password support). Also note that LANMAN support (and thus plaintext password support) requires CONFIG_CIFS_WEAK_PW_HASH to be enabled in menuconfig. CC: Jeff Layton CC: Stable Kernel Signed-off-by: Steve French commit 93a1a5eb70be5cc14990b97ef2460212e32658dc Author: Takashi Iwai Date: Wed Aug 27 07:56:43 2008 +0200 Revert "ALSA: hda - Added model selection for iMac 24"" This reverts commit 3e0e469fa216ec70c93b1593821b759d19ee2e6b. The patch introduced a wrong detection of other intel Macs with ALC88* codec because they share the same PCI SSID (but have different codec subsystem-IDs). See http://lkml.org/lkml/2008/8/24/143 Reported-and-tested-by: Guillaume Chazarain Signed-off-by: Takashi Iwai commit 24b8b44780a2c53ecb738f4a1c08d114f5eda27c Author: Tom Tucker Date: Wed Aug 13 11:05:41 2008 -0500 svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet RDMA_READ completions are kept on a separate queue from the general I/O request queue. Since a separate lock is used to protect the RDMA_READ completion queue, a race exists between the dto_tasklet and the svc_rdma_recvfrom thread where the dto_tasklet sets the XPT_DATA bit and adds I/O to the read-completion queue. Concurrently, the recvfrom thread checks the generic queue, finds it empty and resets the XPT_DATA bit. A subsequent svc_xprt_enqueue will fail to enqueue the transport for I/O and cause the transport to "stall". The fix is to protect both lists with the same lock and set the XPT_DATA bit with this lock held. Signed-off-by: Tom Tucker Signed-off-by: J. Bruce Fields