commit cd86a536c81e9300d984327517548ca0652eebf9 Merge: ebd4c99... 2171787... Author: Linus Torvalds Date: Tue May 26 15:06:12 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: avoid back to back on_each_cpu in cpa_flush_array x86, relocs: ignore R_386_NONE in kernel relocation entries commit ebd4c994d2f917dffec882e7a77c28c6b28758ac Merge: 299297c... e4a5d54... Author: Linus Torvalds Date: Tue May 26 14:48:36 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: drm/i915: Add support for VGA load detection (pre-945). drm/i915: Use an I2C algo to do the flip to SDVO DDC bus. drm/i915: Determine type before initialising connector drm/i915: Return SDVO LVDS VBT mode if no EDID modes are detected. drm/i915: Fetch SDVO LVDS mode lines from VBT, then reserve them i915: support 8xx desktop cursors drm/i915: allocate large pointer arrays with vmalloc commit 299297c63686948aab5af1534629a0a740af6688 Merge: e2a1b9e... 54f2c84... Author: Linus Torvalds Date: Tue May 26 14:48:03 2009 -0700 Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: oprofile: fix cpu buffer size commit 2171787be2e71ff71159857bfeb21398b61eb615 Author: Pallipadi, Venkatesh Date: Tue May 26 10:33:35 2009 -0700 x86: avoid back to back on_each_cpu in cpa_flush_array Cleanup cpa_flush_array() to avoid back to back on_each_cpu() calls. [ Impact: optimizes fix 0af48f42df15b97080b450d24219dd95db7b929a ] Signed-off-by: Venkatesh Pallipadi Signed-off-by: H. Peter Anvin commit e2a1b9ee2335c35e0e34c88a024481b194b3c9cc Merge: 878a4f5... 95baa25... Author: Linus Torvalds Date: Tue May 26 12:15:35 2009 -0700 Merge branch 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 * 'bugfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: NFSv4: Fix the case where NFSv4 renewal fails nfs: fix build error in nfsroot with initconst XPRTRDMA: fix client rpcrdma FRMR registration on mlx4 devices commit 878a4f521bfe83c49694ac990058080fbe090812 Merge: 733be82... 461c6c3... Author: Linus Torvalds Date: Tue May 26 12:14:46 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Add missing check of pin vref 50 and others in Realtek codecs ALSA: hda - Add 5stack-no-fp model for STAC927x ALSA: hda - Add forced codec-slots for ASUS W5Fm commit 733be82e7d41b9f932118f021704b5289d527231 Merge: 5643462... ca446d0... Author: Linus Torvalds Date: Tue May 26 12:13:33 2009 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] powernow-k8: determine exact CPU frequency for HW Pstates [CPUFREQ] powernow-k8 cleanup msg if BIOS does not export ACPI _PSS cpufreq data [CPUFREQ] fix timer teardown in ondemand governor [CPUFREQ] fix timer teardown in conservative governor [CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call [CPUFREQ] powernow-k7 build fix when ACPI=n [CPUFREQ] add atom family to p4-clockmod commit 564346224daaa8f7222d7a92cdbb7bafde59ae6e Author: Rusty Russell Date: Tue May 26 20:54:41 2009 +0930 lguest: fix on Intel when KVM loaded (unhandled trap 13) When KVM is loaded, and hence VT set up, the vmcall instruction in an lguest guest causes a #GP, not #UD. Signed-off-by: Rusty Russell Signed-off-by: Linus Torvalds commit ab2b7ebaad16226c9a5e85c5f384d19fa58a7459 Author: Tetsuo Handa Date: Tue May 26 09:11:03 2009 +0100 kmod: Release sub_info on cred allocation failure. call_usermodehelper_setup() forgot to kfree(sub_info) when prepare_usermodehelper_creds() failed. Signed-off-by: Tetsuo Handa Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit d4a76f8a619b5d7dfd5a0f122666fee24bb3dcb9 Merge: 60a0cd5... 7682455... Author: Linus Torvalds Date: Tue May 26 12:10:19 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits) r8169: avoid losing MSI interrupts tcp: tcp_vegas ssthresh bugfix mac8390: fix regression caused during net_device_ops conversion gianfar: fix BUG under load after introduction of skb recycling wimax/i2400m: usb: fix device reset on autosuspend while not yet idle RxRPC: Error handling for rxrpc_alloc_connection() ipv4: Fix oops with FIB_TRIE pktgen: do not access flows[] beyond its length gigaset: beyond ARRAY_SIZE of iwb->data IPv6: set RTPROT_KERNEL to initial route net: fix rtable leak in net/ipv4/route.c net: fix length computation in rt_check_expire() wireless: beyond ARRAY_SIZE of intf->crypto_stats iwlwifi: update 5000 ucode support to version 2 of API cfg80211: fix race between core hint and driver's custom apply airo: fix airo_get_encode{,ext} buffer overflow like I mean it... ath5k: fix interpolation with equal power levels iwlwifi: do not cancel delayed work inside spin_lock_irqsave ath5k: fix exp off-by-one when computing OFDM delta slope wext: verify buffer size for SIOCSIWENCODEEXT ... commit 60a0cd528d761c50d3a0a49e8fbaf6a87e64254a Merge: e25e092... 8e35961... Author: Linus Torvalds Date: Tue May 26 12:09:32 2009 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/mm: Fix broken MMU PID stealing on !SMP commit e25e0920b5f0f2d46d16f14f7f51ccbfd0773671 Merge: b18f1e2... b492b85... Author: Linus Torvalds Date: Tue May 26 12:09:03 2009 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: don't use locked_ioctl. md: don't update curr_resync_completed without also updating reshape_position. md: raid5: avoid sector values going negative when testing reshape progress. md: export 'frozen' resync state through sysfs md: bitmap: improve bitmap maintenance code. md: improve errno return when setting array_size md: always update level / chunk_size / layout when writing v1.x metadata. commit 95baa25c7321eb8613246acbf61b97911cc748d3 Author: Trond Myklebust Date: Tue May 26 14:51:00 2009 -0400 NFSv4: Fix the case where NFSv4 renewal fails If the asynchronous lease renewal fails (usually due to a soft timeout), then we _must_ schedule state recovery in order to ensure that we don't lose the lease unnecessarily or, if the lease is already lost, that we recover the locking state promptly... Signed-off-by: Trond Myklebust commit d0367a508af9cf97beb202935bb9ad8883d30cd1 Author: Sam Ravnborg Date: Tue May 26 14:51:00 2009 -0400 nfs: fix build error in nfsroot with initconst fix build error with latest kbuild adjustments to initconst. The commit a447c0932445f92ce6f4c1bd020f62c5097a7842 ("vfs: Use const for kernel parser table") changed: static match_table_t __initdata tokens = { to static match_table_t __initconst tokens = { But the missing const causes popwerpc to fail with latest updates to __initconst like this: fs/nfs/nfsroot.c:400: error: __setup_str_nfs_root_setup causes a section type conflict fs/nfs/nfsroot.c:400: error: __setup_str_nfs_root_setup causes a section type conflict The bug is only present with kbuild-next. Following patch has been build tested. Signed-off-by: Sam Ravnborg Cc: Steven Whitehouse Cc: Stephen Rothwell Acked-by: Jan Beulich Signed-off-by: Trond Myklebust commit 68743082b560067e3e93eab8b2568f238e486865 Author: Vu Pham Date: Tue May 26 14:51:00 2009 -0400 XPRTRDMA: fix client rpcrdma FRMR registration on mlx4 devices mlx4/connectX FRMR requires local write enable together with remote rdma write enable. This fixes NFS/RDMA operation over the ConnectX Infiniband HCA in the default memreg mode. Signed-off-by: Vu Pham Signed-off-by: Tom Talpey Signed-off-by: Trond Myklebust commit e4a5d54f924ea5ce2913d9d0687d034004816465 Author: Ma Ling Date: Tue May 26 11:31:00 2009 +0800 drm/i915: Add support for VGA load detection (pre-945). Two approaches for VGA detections: hot plug detection for 945G onwards and load pipe detection for Pre-945G. Load pipe detection will get one free pipe, set border color as red and blue, then check CRT status by swf register. This is a sync-up with the 2D driver. Signed-off-by: Ma Ling Signed-off-by: Eric Anholt commit ca446d06351992e4f1a7c1e5e99870ab4ec5188f Author: Andreas Herrmann Date: Wed Apr 22 13:48:33 2009 +0200 [CPUFREQ] powernow-k8: determine exact CPU frequency for HW Pstates Slightly modified by trenn@suse.de -> only do this on fam 10h and fam 11h. Currently powernow-k8 determines CPU frequency from ACPI PSS objects, but according to AMD family 11h BKDG this frequency is just a rounded value: "CoreFreq (MHz) = The CPU COF specified by MSRC001_00[6B:64][CpuFid] rounded to the nearest 100 Mhz." As a consequnce powernow-k8 reports wrong CPU frequency on some systems, e.g. on Turion X2 Ultra: powernow-k8: Found 1 AMD Turion(tm)X2 Ultra DualCore Mobile ZM-82 processors (2 cpu cores) (version 2.20.00) powernow-k8: 0 : pstate 0 (2200 MHz) powernow-k8: 1 : pstate 1 (1100 MHz) powernow-k8: 2 : pstate 2 (600 MHz) But this is wrong as frequency for Pstate2 is 550 MHz. x86info reports it correctly: #x86info -a |grep Pstate ... Pstate-0: fid=e, did=0, vid=24 (2200MHz) Pstate-1: fid=e, did=1, vid=30 (1100MHz) Pstate-2: fid=e, did=2, vid=3c (550MHz) (current) Solution is to determine the frequency directly from Pstate MSRs instead of using rounded values from ACPI table. Signed-off-by: Andreas Herrmann Signed-off-by: Thomas Renninger Signed-off-by: Dave Jones commit df1829770db415dc5a5ed5ada3bd70176c6f0a01 Author: Thomas Renninger Date: Wed Apr 22 13:48:32 2009 +0200 [CPUFREQ] powernow-k8 cleanup msg if BIOS does not export ACPI _PSS cpufreq data - Make the message shorter and easier to grep for - Use printk_once instead of WARN_ONCE (functionality of these was mixed) Signed-off-by: Thomas Renninger Cc: Langsdorf, Mark Signed-off-by: Dave Jones commit b14893a62c73af0eca414cfed505b8c09efc613c Author: Mathieu Desnoyers Date: Sun May 17 10:30:45 2009 -0400 [CPUFREQ] fix timer teardown in ondemand governor * Rafael J. Wysocki (rjw@sisk.pl) wrote: > This message has been generated automatically as a part of a report > of regressions introduced between 2.6.28 and 2.6.29. > > The following bug entry is on the current list of known regressions > introduced between 2.6.28 and 2.6.29. Please verify if it still should > be listed and let me know (either way). > > > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=13186 > Subject : cpufreq timer teardown problem > Submitter : Mathieu Desnoyers > Date : 2009-04-23 14:00 (24 days old) > References : http://marc.info/?l=linux-kernel&m=124049523515036&w=4 > Handled-By : Mathieu Desnoyers > Patch : http://patchwork.kernel.org/patch/19754/ > http://patchwork.kernel.org/patch/19753/ > (updated changelog) cpufreq fix timer teardown in ondemand governor The problem is that dbs_timer_exit() uses cancel_delayed_work() when it should use cancel_delayed_work_sync(). cancel_delayed_work() does not wait for the workqueue handler to exit. The ondemand governor does not seem to be affected because the "if (!dbs_info->enable)" check at the beginning of the workqueue handler returns immediately without rescheduling the work. The conservative governor in 2.6.30-rc has the same check as the ondemand governor, which makes things usually run smoothly. However, if the governor is quickly stopped and then started, this could lead to the following race : dbs_enable could be reenabled and multiple do_dbs_timer handlers would run. This is why a synchronized teardown is required. The following patch applies to, at least, 2.6.28.x, 2.6.29.1, 2.6.30-rc2. Depends on patch cpufreq: remove rwsem lock from CPUFREQ_GOV_STOP call Signed-off-by: Mathieu Desnoyers CC: Andrew Morton CC: gregkh@suse.de CC: stable@kernel.org CC: cpufreq@vger.kernel.org CC: Ingo Molnar CC: rjw@sisk.pl CC: Ben Slusky Signed-off-by: Dave Jones commit b253d2b2d28ead6fed012feb54694b3d0562839a Author: Mathieu Desnoyers Date: Sun May 17 10:29:33 2009 -0400 [CPUFREQ] fix timer teardown in conservative governor * Rafael J. Wysocki (rjw@sisk.pl) wrote: > This message has been generated automatically as a part of a report > of regressions introduced between 2.6.28 and 2.6.29. > > The following bug entry is on the current list of known regressions > introduced between 2.6.28 and 2.6.29. Please verify if it still should > be listed and let me know (either way). > > > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=13186 > Subject : cpufreq timer teardown problem > Submitter : Mathieu Desnoyers > Date : 2009-04-23 14:00 (24 days old) > References : http://marc.info/?l=linux-kernel&m=124049523515036&w=4 > Handled-By : Mathieu Desnoyers > Patch : http://patchwork.kernel.org/patch/19754/ > http://patchwork.kernel.org/patch/19753/ > (re-send with updated changelog) cpufreq fix timer teardown in conservative governor The problem is that dbs_timer_exit() uses cancel_delayed_work() when it should use cancel_delayed_work_sync(). cancel_delayed_work() does not wait for the workqueue handler to exit. The ondemand governor does not seem to be affected because the "if (!dbs_info->enable)" check at the beginning of the workqueue handler returns immediately without rescheduling the work. The conservative governor in 2.6.30-rc has the same check as the ondemand governor, which makes things usually run smoothly. However, if the governor is quickly stopped and then started, this could lead to the following race : dbs_enable could be reenabled and multiple do_dbs_timer handlers would run. This is why a synchronized teardown is required. Depends on patch cpufreq: remove rwsem lock from CPUFREQ_GOV_STOP call The following patch applies to 2.6.30-rc2. Stable kernels have a similar issue which should also be fixed, but the code changed between 2.6.29 and 2.6.30, so this patch only applies to 2.6.30-rc. Signed-off-by: Mathieu Desnoyers CC: Andrew Morton CC: gregkh@suse.de CC: stable@kernel.org CC: cpufreq@vger.kernel.org CC: Ingo Molnar CC: rjw@sisk.pl CC: Ben Slusky Signed-off-by: Dave Jones commit 42a06f2166f2f6f7bf04f32b4e823eacdceafdc9 Author: Mathieu Desnoyers Date: Sun May 17 10:23:52 2009 -0400 [CPUFREQ] remove rwsem lock from CPUFREQ_GOV_STOP call * Rafael J. Wysocki (rjw@sisk.pl) wrote: > This message has been generated automatically as a part of a report > of regressions introduced between 2.6.28 and 2.6.29. > > The following bug entry is on the current list of known regressions > introduced between 2.6.28 and 2.6.29. Please verify if it still should > be listed and let me know (either way). > > > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=13186 > Subject : cpufreq timer teardown problem > Submitter : Mathieu Desnoyers > Date : 2009-04-23 14:00 (24 days old) > References : http://marc.info/?l=linux-kernel&m=124049523515036&w=4 > Handled-By : Mathieu Desnoyers > Patch : http://patchwork.kernel.org/patch/19754/ > http://patchwork.kernel.org/patch/19753/ The patches linked above depend on the following patch to remove circular locking dependency : cpufreq: remove rwsem lock from CPUFREQ_GOV_STOP call (the following issue was faced when using cancel_delayed_work_sync() in the timer teardown (which fixes a race). * KOSAKI Motohiro (kosaki.motohiro@jp.fujitsu.com) wrote: > Hi > > my box output following warnings. > it seems regression by commit 7ccc7608b836e58fbacf65ee4f8eefa288e86fac. > > A: work -> do_dbs_timer() -> cpu_policy_rwsem > B: store() -> cpu_policy_rwsem -> cpufreq_governor_dbs() -> work > > Hrm, I think it must be due to my attempt to fix the timer teardown race in ondemand governor mixed with new locking behavior in 2.6.30-rc. The rwlock seems to be taken around the whole call to cpufreq_governor_dbs(), when it should be only taken around accesses to the locked data, and especially *not* around the call to dbs_timer_exit(). Reverting my fix attempt would put the teardown race back in place (replacing the cancel_delayed_work_sync by cancel_delayed_work). Instead, a proper fix would imply modifying this critical section : cpufreq.c: __cpufreq_remove_dev() ... if (cpufreq_driver->target) __cpufreq_governor(data, CPUFREQ_GOV_STOP); unlock_policy_rwsem_write(cpu); To make sure the __cpufreq_governor() callback is not called with rwsem held. This would allow execution of cancel_delayed_work_sync() without being nested within the rwsem. Applies on top of the 2.6.30-rc5 tree. Required to remove circular dep in teardown of both conservative and ondemande governors so they can use cancel_delayed_work_sync(). CPUFREQ_GOV_STOP does not modify the policy, therefore this locking seemed unneeded. Signed-off-by: Mathieu Desnoyers CC: KOSAKI Motohiro Cc: Greg KH CC: Ingo Molnar CC: "Rafael J. Wysocki" CC: Ben Slusky CC: Chris Wright CC: Andrew Morton Signed-off-by: Dave Jones commit d38e73e8dad454a5916f446b0d3523c1161ae95a Author: Dave Jones Date: Thu Apr 23 13:36:12 2009 -0400 [CPUFREQ] powernow-k7 build fix when ACPI=n arch/x86/kernel/cpu/cpufreq/powernow-k7.c:172: warning: 'invalidate_entry' defined but not used Reported-by: Toralf Förster Signed-off-by: Dave Jones commit 4319503779060120fa5de9b8fde056603bb6e0fd Author: Jarod Wilson Date: Fri Mar 6 20:24:57 2009 +0000 [CPUFREQ] add atom family to p4-clockmod Some atom procs don't do freq scaling (such as the atom 330 on my own littlefalls2 board). By adding the atom family here, we at least get the benefit of passive cooling in a thermal emergency. Not sure how to see that its actually helping any, but the driver does bind and claim its functioning on my atom 330. Signed-off-by: Jarod Wilson Signed-off-by: Dave Jones commit 7682455ec36fce70bdbad9f739de05060dedfa27 Merge: f11a377... e069c0c... Author: David S. Miller Date: Mon May 25 22:56:11 2009 -0700 Merge branch 'linux-2.6.30.y' of git://git.kernel.org/pub/scm/linux/kernel/git/inaky/wimax commit f11a377b3f4e897d11f0e8d1fc688667e2f19708 Author: David Dillow Date: Fri May 22 15:29:34 2009 +0000 r8169: avoid losing MSI interrupts The 8169 chip only generates MSI interrupts when all enabled event sources are quiescent and one or more sources transition to active. If not all of the active events are acknowledged, or a new event becomes active while the existing ones are cleared in the handler, we will not see a new interrupt. The current interrupt handler masks off the Rx and Tx events once the NAPI handler has been scheduled, which opens a race window in which we can get another Rx or Tx event and never ACK'ing it, stopping all activity until the link is reset (ifconfig down/up). Fix this by always ACK'ing all event sources, and loop in the handler until we have all sources quiescent. Signed-off-by: David Dillow Tested-by: Michael Buesch Signed-off-by: David S. Miller commit 46176b4f6bac19454b7b5c35f68594b85850a600 Author: Tejun Heo Date: Tue May 26 14:42:40 2009 +0900 x86, relocs: ignore R_386_NONE in kernel relocation entries For relocatable 32bit kernels, boot/compressed/relocs.c processes relocation entries in the kernel image and appends it to the kernel image such that boot/compressed/head_32.S can relocate the kernel. The kernel image is one statically linked object and only uses two relocation types - R_386_PC32 and R_386_32, of the two only the latter needs massaging during kernel relocation and thus handled by relocs. R_386_PC32 is ignored and all other relocation types are considered error. When the target of a relocation resides in a discarded section, binutils doesn't throw away the relocation record but nullifies it by changing it to R_386_NONE, which unfortunately makes relocs fail. The problem was triggered by yet out-of-tree x86 stack unwind patches but given the binutils behavior, ignoring R_386_NONE is the right thing to do. The problem has been tracked down to binutils behavior by Jan Beulich. [ Impact: fix build with certain binutils by ignoring R_386_NONE ] Signed-off-by: Tejun Heo Cc: Jan Beulich Cc: Ingo Molnar LKML-Reference: <4A1B8150.40702@kernel.org> Signed-off-by: H. Peter Anvin commit c80a5cdfc5ca6533cb893154f546370da1fdb8f0 Author: Doug Leith Date: Mon May 25 22:44:59 2009 -0700 tcp: tcp_vegas ssthresh bugfix This patch fixes ssthresh accounting issues in tcp_vegas when cwnd decreases Signed-off-by: Doug Leith Signed-off-by: David S. Miller commit 217cbfa856dc1cbc2890781626c4032d9e3ec59f Author: Finn Thain Date: Mon May 25 22:43:49 2009 -0700 mac8390: fix regression caused during net_device_ops conversion Changeset ca17584bf2ad1b1e37a5c0e4386728cc5fc9dabc ("mac8390: update to net_device_ops") broke mac8390 by adding 8390.o to the link. That meant that lib8390.c was included twice, once in mac8390.c and once in 8390.c, subject to different macros. This patch reverts that by avoiding the wrappers in 8390.c. They seem to be of no value since COMPAT_NET_DEV_OPS is going away soon. Tested with a Kinetics EtherPort card. Signed-off-by: Finn Thain Signed-off-by: David S. Miller commit 8e35961b57da14cb64cb0e4e1b7e3aabda6396fe Author: Hideo Saito Date: Sun May 24 15:33:34 2009 +0000 powerpc/mm: Fix broken MMU PID stealing on !SMP The recent rework of the MMU PID handling for non-hash CPUs has a subtle bug in the !SMP "optimized" variant of the PID stealing function. It clears the PID in the mm context before it calls local_flush_tlb_mm(). However, the later will not flush anything if the PID in the context is clear... Signed-off-by: Hideo Saito Signed-off-by: Benjamin Herrenschmidt commit b492b852cd8c99505708152c29a5e09a787af9de Author: NeilBrown Date: Tue May 26 12:57:36 2009 +1000 md: don't use locked_ioctl. md has no need for the BKL - it does its own locking. So md_ioctl doesn't need to be a locked_ioctl. Signed-off-by: NeilBrown commit 7a91ee1f628ef6bfe3f13067c0ddf9db520cb86b Author: NeilBrown Date: Tue May 26 12:57:21 2009 +1000 md: don't update curr_resync_completed without also updating reshape_position. In order for the metadata to always be consistent, we mustn't updated curr_resync_completed without also updating reshape_position. The reshape code updates both at the same time. However since commit 97e4f42d62badb0f9fbc27c013e89bc1336a03bc the common md_do_sync will sometimes update curr_resync_completed but is not in a position to update reshape_position. So if MD_RECOVERY_RESHAPE is set (indicating that a reshape is happening, so reshape_position might change), don't update curr_resync_completed in md_do_sync, leave it to the per-personality reshape code. Signed-off-by: NeilBrown commit 848b3182365fdf5a05bcd5ed949071cac2c894b3 Author: NeilBrown Date: Tue May 26 12:41:08 2009 +1000 md: raid5: avoid sector values going negative when testing reshape progress. As sector_t in unsigned, we cannot afford to let 'safepos' etc go negative. So replace a -= b; by a -= min(b,a); Signed-off-by: NeilBrown commit b6a9ce688f613e2ee5f15e6720e0bb8520efc36e Author: NeilBrown Date: Tue May 26 09:41:17 2009 +1000 md: export 'frozen' resync state through sysfs The md resync engine has a 'frozen' state which ensures that no resync/recovery. This is used to avoid races. Export this state through the 'sync_action' sysfs attribute so that user-space can benefit and also avoid some races. Signed-off-by: NeilBrown commit be512691036cc989c11d0f418187efbbf14468e6 Author: NeilBrown Date: Tue May 26 09:41:17 2009 +1000 md: bitmap: improve bitmap maintenance code. The code for checking which bits in the bitmap can be cleared has 2 problems: 1/ it repeatedly takes and drops a spinlock, where it would make more sense to just hold on to it most of the time. 2/ it doesn't make use of some opportunities to skip large sections of the bitmap This patch fixes those. It will only affect CPU consumption, not correctness. Signed-off-by: NeilBrown commit 2b69c83924396ad1eda36fdd267c9d2f360f5555 Author: NeilBrown Date: Tue May 26 09:41:17 2009 +1000 md: improve errno return when setting array_size Instead of always returns EINVAL if anything goes wrong when setting the array size, add the option of E2BIG if the size requested is too large. This makes it easier for user-space to be sure what went wrong. Signed-off-by: NeilBrown commit 62e1e389f87a8839ad83b08c44691d1df8320846 Author: NeilBrown Date: Tue May 26 09:40:59 2009 +1000 md: always update level / chunk_size / layout when writing v1.x metadata. We previously didn't update these fields when writing the metadata because they could never change. They can now, so we better write them. v0.90 metadata always updated these fields. Signed-off-by: NeilBrown commit b18f1e21993f73f072b1e0859f942fb11afddcb1 Merge: a0c1af1... a2edf57... Author: Linus Torvalds Date: Mon May 25 15:51:27 2009 -0700 Merge branch 'kvm-updates/2.6.30' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.30' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Fix PDPTR reloading on CR4 writes KVM: Make paravirt tlb flush also reload the PAE PDPTRs commit a0c1af135a93ee25b07cbc61762fb957fd2f3733 Merge: 93c3248... 71c9d8b... Author: Linus Torvalds Date: Mon May 25 15:50:32 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Remove remap percpu allocator for the time being x86: cpa_flush_array wbinvd should be done on all CPUs x86: bugfix wbinvd() model check instead of family check x86: introduce noxsave boot parameter x86, setup: revert ACPI 3 E820 extended attributes support x86: DMI match for the Sony VGN-Z540N as it needs BIOS reboot commit a2edf57f510cce6a389cc14e58c6ad0a4296d6f9 Author: Avi Kivity Date: Sun May 24 22:19:00 2009 +0300 KVM: Fix PDPTR reloading on CR4 writes The processor is documented to reload the PDPTRs while in PAE mode if any of the CR4 bits PSE, PGE, or PAE change. Linux relies on this behaviour when zapping the low mappings of PAE kernels during boot. The code already handled changes to CR4.PAE; augment it to also notice changes to PSE and PGE. This triggered while booting an F11 PAE kernel; the futex initialization code runs before any CR3 reloads and writes to a NULL pointer; the futex subsystem ended up uninitialized, killing PI futexes and pulseaudio which uses them. Cc: stable@kernel.org Signed-off-by: Avi Kivity commit a8cd0244e9cebcf9b358d24c7e7410062f3665cb Author: Avi Kivity Date: Sun May 24 22:15:25 2009 +0300 KVM: Make paravirt tlb flush also reload the PAE PDPTRs The paravirt tlb flush may be used not only to flush TLBs, but also to reload the four page-directory-pointer-table entries, as it is used as a replacement for reloading CR3. Change the code to do the entire CR3 reloading dance instead of simply flushing the TLB. Cc: stable@kernel.org Signed-off-by: Avi Kivity commit 4e2fd555199977c5994d1a4d2d3b8761b20ca4c7 Author: Lennert Buytenhek Date: Mon May 25 00:42:34 2009 -0700 gianfar: fix BUG under load after introduction of skb recycling Since commit 0fd56bb5be6455d0d42241e65aed057244665e5e ("gianfar: Add support for skb recycling"), gianfar puts skbuffs that are in the rx ring back onto the recycle list as-is in case there was a receive error, but this breaks the following invariant: that all skbuffs on the recycle list have skb->data = skb->head + NET_SKB_PAD. The RXBUF_ALIGNMENT realignment done in gfar_new_skb() will be done twice on skbuffs recycled in this way, causing there not to be enough room in the skb anymore to receive a full packet, eventually leading to an skb_over_panic from gfar_clean_rx_ring() -> skb_put(). Resetting the skb->data pointer to skb->head + NET_SKB_PAD before putting the skb back onto the recycle list restores the mentioned invariant, and should fix this issue. Reported-by: Michael Guntsche Tested-by: Michael Guntsche Signed-off-by: Lennert Buytenhek Signed-off-by: David S. Miller commit 461c6c3a0a23a8fac1a4b636e93ff5dfe599a241 Author: Takashi Iwai Date: Mon May 25 08:06:02 2009 +0200 ALSA: hda - Add missing check of pin vref 50 and others in Realtek codecs Some Realtek codecs like ALC861 seem to support only VREF50 while the current driver assumes it's only VREF80. Check other VREF bits to set the correct value. Signed-off-by: Takashi Iwai commit 71c9d8b68b299bef614afc7907393564a9f1476f Author: Tejun Heo Date: Mon May 25 12:01:59 2009 +0900 x86: Remove remap percpu allocator for the time being Remap percpu allocator has subtle bug when combined with page attribute changing. Remap percpu allocator aliases PMD pages for the first chunk and as pageattr doesn't know about the alias it ends up updating page attributes of the original mapping thus leaving the alises in inconsistent state which might lead to subtle data corruption. Please read the following threads for more information: http://thread.gmane.org/gmane.linux.kernel/835783 The following is the proposed fix which teaches pageattr about percpu aliases. http://thread.gmane.org/gmane.linux.kernel/837157 However, the above changes are deemed too pervasive for upstream inclusion for 2.6.30 release, so this patch essentially disables the remap allocator for the time being. Signed-off-by: Tejun Heo LKML-Reference: <4A1A0A27.4050301@kernel.org> Signed-off-by: Ingo Molnar commit 93c32483808c5d82c9bd1eef2208854a6d1326db Merge: d5a877e... 32bdfac... Author: Linus Torvalds Date: Sun May 24 19:38:25 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/suspend-2.6: PM: Do not hold dpm_list_mtx while disabling/enabling nonboot CPUs commit d5a877e8dd409d8c702986d06485c374b705d340 Author: James Bottomley Date: Sun May 24 13:03:43 2009 -0700 async: make sure independent async domains can't accidentally entangle The problem occurs when async_synchronize_full_domain() is called when the async_pending list is not empty. This will cause lowest_running() to return the cookie of the first entry on the async_pending list, which might be nothing at all to do with the domain being asked for and thus cause the domain synchronization to wait for an unrelated domain. This can cause a deadlock if domain synchronization is used from one domain to wait for another. Fix by running over the async_pending list to see if any pending items actually belong to our domain (and return their cookies if they do). Signed-off-by: James Bottomley Signed-off-by: Arjan van de Ven Signed-off-by: Linus Torvalds commit 32bdfac5462d777f35b00838893c4f87baf23efe Author: Rafael J. Wysocki Date: Sun May 24 21:15:07 2009 +0200 PM: Do not hold dpm_list_mtx while disabling/enabling nonboot CPUs We shouldn't hold dpm_list_mtx while executing [disable|enable]_nonboot_cpus(), because theoretically this may lead to a deadlock as shown by the following example (provided by Johannes Berg): CPU 3 CPU 2 CPU 1 suspend/hibernate something: rtnl_lock() device_pm_lock() -> mutex_lock(&dpm_list_mtx) mutex_lock(&dpm_list_mtx) linkwatch_work -> rtnl_lock() disable_nonboot_cpus() -> flush CPU 3 workqueue Fortunately, device drivers are supposed to stop any activities that might lead to the registration of new device objects way before disable_nonboot_cpus() is called, so it shouldn't be necessary to hold dpm_list_mtx over the entire late part of device suspend and early part of device resume. Thus, during the late suspend and the early resume of devices acquire dpm_list_mtx only when dpm_list is going to be traversed and release it right after that. This patch is reported to fix the regressions tracked as http://bugzilla.kernel.org/show_bug.cgi?id=13245. Signed-off-by: Rafael J. Wysocki Acked-by: Alan Stern Reported-by: Miles Lane Tested-by: Ming Lei commit 657cafa6b0f5296424d6f43f6f6eeb4a3222117e Author: Alex Riesen Date: Sun May 24 15:30:48 2009 +0200 Use a format for linux_banner There is no format specifiers left in the linux_banner, and gcc-4.3 complains seeing the printk. Signed-off-by: Alex Riesen Signed-off-by: Linus Torvalds commit 679d92ed1403b6cf9a19aa42ec62b81cae1aa017 Author: Takashi Iwai Date: Sun May 24 19:00:08 2009 +0200 ALSA: hda - Add 5stack-no-fp model for STAC927x The recent fix for the headphone volume control on IDT/STAC codecs resulted in the removal of invalid "Side" volume eventually. But, if the front panel doesn't exist, this setup could be regarded as a sort of regression, as reported in kernel bug #13250. Now as a workaround, a new model 5stack-no-fp is added so that the user without the front panel can choose this one explicitly. Reference: bko#13250 http://bugzilla.kernel.org/show_bug.cgi?id=13250 Signed-off-by: Takashi Iwai commit 93574844bc3906941b89d6b6f72e01e87413f3c4 Author: Ozan Çağlayan Date: Sat May 23 15:00:04 2009 +0300 ALSA: hda - Add forced codec-slots for ASUS W5Fm ASUS W5Fm needs the fixed codec-slots to probe to override the BIOS problem like W5F. Tested-by: Alp Kılıç Signed-off-by: Ozan Çağlayan Signed-off-by: Takashi Iwai commit 0af48f42df15b97080b450d24219dd95db7b929a Author: venkatesh.pallipadi@intel.com Date: Fri May 22 13:23:38 2009 -0700 x86: cpa_flush_array wbinvd should be done on all CPUs cpa_flush_array seems to prefer wbinvd() over clflush at 4M threshold. clflush needs to be done on only one CPU as per instruction definition. wbinvd() however, should be done on all CPUs. [ Impact: fix missing flush which could cause data corruption ] Signed-off-by: Venkatesh Pallipadi Signed-off-by: Suresh Siddha Signed-off-by: H. Peter Anvin commit 0b827537e339c084ac9384df588969d400be9e0d Author: venkatesh.pallipadi@intel.com Date: Fri May 22 13:23:37 2009 -0700 x86: bugfix wbinvd() model check instead of family check wbinvd is supported on all CPUs 486 or later. But, pageattr.c is checking x86_model >= 4 before wbinvd(), which looks like an oversight bug. It was first introduced at one place by changeset d7c8f21a8cad0228c7c5ce2bb6dbd95d1ee49d13 and got copied over to second place in the same file later. [ Impact: fix missing cache flush on early-model CPUs, potential data corruption ] Signed-off-by: Venkatesh Pallipadi Signed-off-by: H. Peter Anvin commit 619ac3b75a1e9b2df66857f6a0fb466f1da5fa9e Author: Ma Ling Date: Mon May 18 16:12:46 2009 +0800 drm/i915: Use an I2C algo to do the flip to SDVO DDC bus. Previously, we would set the control bus switch before calls were made to request EDID information over DDC. But recently the DDC code started doing multiple I2C transfers to get the EDID extensions as well. This tripped up SDVO, because the control bus switch is only in effect until the next STOP after a START. By doing our own algo, we can wrap each i2c transaction on the DDC I2C bus with the control bus switch it requires. freedesktop.org bug #21042 Signed-off-by: Ma Ling [anholt: Hand application for conflict, fixed error path] Signed-off-by: Eric Anholt commit 0c752a93353d9b17dbe148312d732fbe06d235e1 Author: Suresh Siddha Date: Fri May 22 12:17:45 2009 -0700 x86: introduce noxsave boot parameter Introduce "noxsave" boot parameter which will disable the cpu's xsave/xrstor capabilities. Useful for debugging and working around xsave related issues. [ Impact: make it possible to debug problems in the field ] Signed-off-by: Suresh Siddha Signed-off-by: H. Peter Anvin commit ad5b2a6db3eddc41358d8a73f5cfe1c38e7e3a19 Author: Jonas Bonn Date: Fri May 15 09:10:41 2009 +0200 drm/i915: Determine type before initialising connector drm_connector_init sets both the connector type and the connector type_id on the newly initialised connector. As the connector type_id is coupled to the connector type, the connector type cannot simply be modified on an initialised connector. This patch changes the order of operations on intel_sdvo_init so that the type is determined before the connector is intialised. This fixes a bug whereby the name card0-VGA-1 would be allocted to both a CRT and an SDVO connector since the SDVO connector would be initialised with type 'unknown' and hence have its type_id assigned from the wrong pool. Signed-off-by: Jonas Bonn Signed-off-by: Eric Anholt commit 7086c87fb1446ceb37918ffa0941359a7c2ec6cf Author: Ma Ling Date: Wed May 13 11:20:06 2009 +0800 drm/i915: Return SDVO LVDS VBT mode if no EDID modes are detected. Some new SDVO LVDS hardware doesn't have DDC available, and this should fix the display on it. Signed-off-by: Ma Ling Signed-off-by: Eric Anholt commit 8863170628da4b0b461eb96bf797df1dca0bd03e Author: Ma Ling Date: Wed May 13 11:19:55 2009 +0800 drm/i915: Fetch SDVO LVDS mode lines from VBT, then reserve them Signed-off-by: Ma Ling Signed-off-by: Eric Anholt commit 14b60391587ab9b2207c4fb6281763a93ae85e0f Author: Jesse Barnes Date: Wed May 20 16:47:08 2009 -0400 i915: support 8xx desktop cursors For some reason we never added 8xx desktop cursor support to the kernel. This patch fixes that. [krh: Also set the size on pre-i915 hw.] Tested-by: Kristian Høgsberg Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt commit bca23dba760d6705c013f89113c46570378fb626 Author: H. Peter Anvin Date: Thu May 21 11:46:16 2009 -0700 x86, setup: revert ACPI 3 E820 extended attributes support Remove ACPI 3 E820 extended memory attributes support. At least one vendor actively set all the flags to zero, but left ECX on return at 24. This bug may be present in other BIOSes. The breakage functionally means the ACPI 3 flags are probably completely useless, and that no OS any time soon is going to rely on their existence. Therefore, drop support completely. We may want to revisit this question in the future, if we find ourselves actually needing the flags. This reverts all or part of the following checkins: cd670599b7b00d9263f6f11a05c0edeb9cbedaf3 c549e71d073a6e9a4847497344db28a784061455 However, retain the part from the latter commit that copies e820 into a temporary buffer; that is an unrelated BIOS workaround. Put in a comment to explain that part. See https://bugzilla.redhat.com/show_bug.cgi?id=499396 for some additional information. [ Impact: detect all memory on affected machines ] Reported-by: Thomas J. Baker Signed-off-by: H. Peter Anvin Acked-by: Len Brown Cc: Chuck Ebbert Cc: Kyle McMartin Cc: Matt Domsch commit e069c0cf7c169ae5a8bfdc8d083a5d66fbef73d8 Author: Inaky Perez-Gonzalez Date: Fri May 8 15:51:44 2009 -0700 wimax/i2400m: usb: fix device reset on autosuspend while not yet idle When the i2400m is connected to a network, the host interface (USB) cannot be suspended. For that to happen, the device has to have negotiated with the basestation to put the link on IDLE state. If the host tries to put the device in standby while it is connected but not idle, the device resets, as the driver should not do that. To avoid triggering that, when the USB susbsytem requires the driver to autosuspend the device, the driver checks if the device is not yet idle. If it is not, the request is rejected (will be retried again later on after the autosuspend timeout). At some point the device will enter idle and the request will succeed (unless of course, there is network traffic, but at that point, there is no idle neither in the link or the host interface). Signed-off-by: Inaky Perez-Gonzalez commit 88dff4936c0a5fa53080cca68dc963a8a2a674b0 Author: Zhang Rui Date: Fri May 22 11:35:50 2009 +0800 x86: DMI match for the Sony VGN-Z540N as it needs BIOS reboot x86: DMI match for the Sony VGN-Z540N as it needs BIOS reboot, see: http://bugzilla.kernel.org/show_bug.cgi?id=12901 [ Impact: fix hung reboot on certain systems ] Signed-off-by: Zhang Rui Cc: Len Brown LKML-Reference: <1242963350.32574.53.camel@rzhang-dt> Signed-off-by: Ingo Molnar commit 0975ecba3b670df7c488a5e0e6fe9f1f370a8ad8 Author: Dan Carpenter Date: Thu May 21 15:22:02 2009 -0700 RxRPC: Error handling for rxrpc_alloc_connection() rxrpc_alloc_connection() doesn't return an error code on failure, it just returns NULL. IS_ERR(NULL) is false. Signed-off-by: Dan Carpenter Signed-off-by: David Howells Signed-off-by: David S. Miller commit 3ed18d76d959e5cbfa5d70c8f7ba95476582a556 Author: Robert Olsson Date: Thu May 21 15:20:59 2009 -0700 ipv4: Fix oops with FIB_TRIE It seems we can fix this by disabling preemption while we re-balance the trie. This is with the CONFIG_CLASSIC_RCU. It's been stress-tested at high loads continuesly taking a full BGP table up/down via iproute -batch. Note. fib_trie is not updated for CONFIG_PREEMPT_RCU Reported-by: Andrei Popa Signed-off-by: Robert Olsson Signed-off-by: David S. Miller commit 5b5f792a6a9a2f9ae812d151ed621f72e99b1725 Author: Florian Westphal Date: Thu May 21 15:07:12 2009 -0700 pktgen: do not access flows[] beyond its length typo -- pkt_dev->nflows is for stats only, the number of concurrent flows is stored in cflows. Reported-By: Vladimir Ivashchenko Signed-off-by: Florian Westphal Signed-off-by: David S. Miller commit c40499e04b2005e61f989824251f9343b55f96bb Author: Roel Kluin Date: Thu May 21 15:04:15 2009 -0700 gigaset: beyond ARRAY_SIZE of iwb->data Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit 4f72427998b105392e60bae7a6798a0c96fe4f0a Author: Jean-Mickael Guerin Date: Wed May 20 17:38:59 2009 -0700 IPv6: set RTPROT_KERNEL to initial route The use of unspecified protocol in IPv6 initial route prevents quagga to install IPv6 default route: # show ipv6 route S ::/0 [1/0] via fe80::1, eth1_0 K>* ::/0 is directly connected, lo, rej C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto none metric -1 error -101 hoplimit 255 The attached patch ensures RTPROT_KERNEL to the default initial route and fixes the problem for quagga. This is similar to "ipv6: protocol for address routes" f410a1fba7afa79d2992620e874a343fdba28332. # show ipv6 route S>* ::/0 [1/0] via fe80::1, eth1_0 C>* ::1/128 is directly connected, lo C>* fe80::/64 is directly connected, eth1_0 # ip -6 route fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 fe80::/64 dev eth1_0 proto kernel metric 256 mtu 1500 advmss 1440 hoplimit -1 ff00::/8 dev eth1_0 metric 256 mtu 1500 advmss 1440 hoplimit -1 default via fe80::1 dev eth1_0 proto zebra metric 1024 mtu 1500 advmss 1440 hoplimit -1 unreachable default dev lo proto kernel metric -1 error -101 hoplimit 255 Signed-off-by: Jean-Mickael Guerin Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 86c2fe1e3adacec9204c03f2b056b49534ecf0ed Merge: 1ddbcb0... a6c6733... Author: David S. Miller Date: Wed May 20 17:31:25 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 1ddbcb005c395518c2cd0df504cff3d4b5c85853 Author: Eric Dumazet Date: Tue May 19 20:14:28 2009 +0000 net: fix rtable leak in net/ipv4/route.c Alexander V. Lukyanov found a regression in 2.6.29 and made a complete analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339 Quoted here because its a perfect one : begin_of_quotation 2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the patch has at least one critical flaw, and another problem. rt_intern_hash calculates rthi pointer, which is later used for new entry insertion. The same loop calculates cand pointer which is used to clean the list. If the pointers are the same, rtable leak occurs, as first the cand is removed then the new entry is appended to it. This leak leads to unregister_netdevice problem (usage count > 0). Another problem of the patch is that it tries to insert the entries in certain order, to facilitate counting of entries distinct by all but QoS parameters. Unfortunately, referencing an existing rtable entry moves it to list beginning, to speed up further lookups, so the carefully built order is destroyed. For the first problem the simplest patch it to set rthi=0 when rthi==cand, but it will also destroy the ordering. end_of_quotation Problematic commit is 1080d709fb9d8cd4392f93476ee46a9d6ea05a5b (net: implement emergency route cache rebulds when gc_elasticity is exceeded) Trying to keep dst_entries ordered is too complex and breaks the fact that order should depend on the frequency of use for garbage collection. A possible fix is to make rt_intern_hash() simpler, and only makes rt_check_expire() a litle bit smarter, being able to cope with an arbitrary entries order. The added loop is running on cache hot data, while cpu is prefetching next object, so should be unnoticied. Reported-and-analyzed-by: Alexander V. Lukyanov Signed-off-by: Eric Dumazet Acked-by: Neil Horman Signed-off-by: David S. Miller commit cf8da764fc6959b7efb482f375dfef9830e98205 Author: Eric Dumazet Date: Tue May 19 18:54:22 2009 +0000 net: fix length computation in rt_check_expire() rt_check_expire() computes average and standard deviation of chain lengths, but not correclty reset length to 0 at beginning of each chain. This probably gives overflows for sum2 (and sum) on loaded machines instead of meaningful results. Signed-off-by: Eric Dumazet Acked-by: Neil Horman Signed-off-by: David S. Miller commit a6c67339784db5763d6f20ae1881aeebe8c5a9f4 Author: Roel Kluin Date: Wed May 20 02:12:56 2009 +0200 wireless: beyond ARRAY_SIZE of intf->crypto_stats Do not go beyond ARRAY_SIZE of intf->crypto_stats Signed-off-by: Roel Kluin Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit c9d2fbf36df5e04efa226614093bb1bacc6fe131 Author: Jay Sternberg Date: Tue May 19 14:56:36 2009 -0700 iwlwifi: update 5000 ucode support to version 2 of API enable iwl driver to support 5000 ucode having version 2 of API Signed-off-by: Jay Sternberg Signed-off-by: Reinette Chatre Signed-off-by: John W. Linville commit 5078b2e32ad4b1f753b1c837c15892202f753c97 Author: Luis R. Rodriguez Date: Wed May 13 17:04:42 2009 -0400 cfg80211: fix race between core hint and driver's custom apply Its possible for cfg80211 to have scheduled the work and for the global workqueue to not have kicked in prior to a cfg80211 driver's regulatory hint or wiphy_apply_custom_regulatory(). Although this is very unlikely its possible and should fix this race. When this race would happen you are expected to have hit a null pointer dereference panic. Cc: stable@kernel.org Signed-off-by: Luis R. Rodriguez Tested-by: Alan Jenkins Signed-off-by: John W. Linville commit 267d493b322b05984048aef8ea9b5b213490bbe0 Author: John W. Linville Date: Wed May 20 10:51:41 2009 -0400 airo: fix airo_get_encode{,ext} buffer overflow like I mean it... "airo: airo_get_encode{,ext} potential buffer overflow" was actually a no-op, due to an unrecognized type overflow in an assignment. Oddly, gcc only seems to tell me about it when using -Wextra...grrr... Signed-off-by: John W. Linville commit 875690c378d64d9ee2de15cad8206d3f11ae5096 Author: Fabio Rossi Date: Wed Apr 1 20:37:50 2009 +0200 ath5k: fix interpolation with equal power levels When the EEPROM contains weird values for the power levels we have to fix the interpolation process. Signed-off-by: Fabio Rossi Acked-by: Nick Kossifidis Signed-off-by: John W. Linville commit fbc9f97bbf5e1eaee562eba93dc60faaff3f3bfa Author: Reinette Chatre Date: Fri May 15 16:13:46 2009 -0700 iwlwifi: do not cancel delayed work inside spin_lock_irqsave Calling cancel_delayed_work() from inside spin_lock_irqsave, introduces a potential deadlock. As explained by Johannes Berg A - lock T - timer phase CPU 1 CPU 2 --------------------------------------------- some place that calls cancel_timer_sync() (which is the | code) lock-irq(A) | "lock-irq"(T) | "unlock"(T) | wait(T) unlock(A) timer softirq "lock"(T) run(T) "unlock"(T) irq handler lock(A) unlock(A) Now all that again, interleaved, leading to deadlock: lock-irq(A) "lock"(T) run(T) IRQ during or maybe before run(T) --> lock(A) "lock-irq"(T) wait(T) We fix this by moving the call to cancel_delayed_work() into workqueue. There are cases where the work may not actually be queued or running at the time we are trying to cancel it, but cancel_delayed_work() is able to deal with this. Also cleanup iwl_set_mode related to this call. This function (iwl_set_mode) is only called when bringing interface up and there will thus not be any scanning done. No need to try to cancel scanning. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13224, which was also reported at http://marc.info/?l=linux-wireless&m=124081921903223&w=2 . Tested-by: Miles Lane Signed-off-by: Reinette Chatre Acked-by: Zhu Yi Signed-off-by: John W. Linville commit a54be5d43aa2d6febc5a4f8dd3b87b9429b60437 Author: Forrest Zhang Date: Wed May 13 11:14:39 2009 -0400 ath5k: fix exp off-by-one when computing OFDM delta slope Commit e8f055f0c3b ("ath5k: Update reset code") subtly changed the code that computes floating point values for the PHY3_TIMING register such that the exponent is off by a decimal point, which can cause problems with OFDM channel operation. get_bitmask_order() actually returns the highest bit set plus one, whereas the previous code wanted the highest bit set. Instead, use ilog2 which is what this code is really calculating. Also check coef_scaled to handle the (invalid) case where we need log2(0). Signed-off-by: Bob Copeland Signed-off-by: John W. Linville commit 88f16db7a2fa63b9242e8a0fbc40d51722f2e2f9 Author: Johannes Berg Date: Wed May 13 12:04:30 2009 +0200 wext: verify buffer size for SIOCSIWENCODEEXT Another design flaw in wireless extensions (is anybody surprised?) in the way it handles the iw_encode_ext structure: The structure is part of the 'extra' memory but contains the key length explicitly, instead of it just being the length of the extra buffer - size of the struct and using the explicit key length only for the get operation (which only writes it). Therefore, we have this layout: extra: +-------------------------+ | struct iw_encode_ext { | | ... | | u16 key_len; | | u8 key[0]; | | }; | +-------------------------+ | key material | +-------------------------+ Now, all drivers I checked use ext->key_len without checking that both key_len and the struct fit into the extra buffer that has been copied from userspace. This leads to a buffer overrun while reading that buffer, depending on the driver it may be possible to specify arbitrary key_len or it may need to be a proper length for the key algorithm specified. Thankfully, this is only exploitable by root, but root can actually cause a segfault or use kernel memory as a key (which you can even get back with siocgiwencode or siocgiwencodeext from the key buffer). Fix this by verifying that key_len fits into the buffer along with struct iw_encode_ext. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 2b611cb6eed04062d0a9861c82248e02c844ba3f Author: Pavel Roskin Date: Fri Mar 27 17:47:27 2009 -0400 ath5k: fix scanning in AR2424 AR5K_PHY_PLL_40MHZ_5413 should not be ORed with AR5K_PHY_MODE_RAD_RF5112 for 5 GHz channels. The incorrect PLL value breaks scanning in the countries where 5 GHz channels are allowed. Signed-off-by: Pavel Roskin Acked-by: Nick Kossifidis Signed-off-by: John W. Linville commit 8e7d2b2c6ecd3c21a54b877eae3d5be48292e6b5 Author: Jesse Barnes Date: Fri May 8 16:13:25 2009 -0700 drm/i915: allocate large pointer arrays with vmalloc For awhile now, many of the GEM code paths have allocated page or object arrays with the slab allocator. This is nice and fast, but won't work well if memory is fragmented, since the slab allocator works with physically contiguous memory (i.e. order > 2 allocations are likely to fail fairly early after booting and doing some work). This patch works around the issue by falling back to vmalloc for >PAGE_SIZE allocations. This is ugly, but much less work than chaining a bunch of pages together by hand (suprisingly there's not a bunch of generic kernel helpers for this yet afaik). vmalloc space is somewhat precious on 32 bit kernels, but our allocations shouldn't be big enough to cause problems, though they're routinely more than a page. Note that this patch doesn't address the unchecked alloc-based-on-ioctl-args in GEM; that needs to be fixed in a separate patch. Also, I've deliberately ignored the DRM's "area" junk. I don't think anyone actually uses it anymore and I'm hoping it gets ripped out soon. [Updated: removed size arg to new free function. We could unify the free functions as well once the DRM mem tracking is ripped out.] fd.o bug #20152 (part 1/3) Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt commit 54f2c841fa0007e5fee3b7d01a911c774f0a6cda Author: Robert Richter Date: Thu May 7 17:28:59 2009 +0200 oprofile: fix cpu buffer size The unit of oprofile_cpu_buffer_size is in samples, but was allocated in bytes. This led to the allocation of too small cpu buffers. This patch recalculates the buffer size in bytes taking also the ring_buffer_event header size into account. Reported-by: Suravee Suthikulpanit Signed-off-by: Robert Richter