commit f4b23cc2d5dc78ef5acbc529eb1219cc41eb5b96 Merge: e095937 c42750b Author: Linus Torvalds Date: Tue Jul 20 18:29:25 2010 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/r600: fix possible NULL pointer derefernce drm/radeon/kms: add quirk for ASUS HD 3600 board include/linux/vgaarb.h: add missing part of include guard drm/nouveau: Fix crashes during fbcon init on single head cards. drm/nouveau: fix pcirom vbios shadow breakage from acpi rom patch drm/radeon/kms: fix shared ddc harder drm/i915: enable low power render writes on GEN3 hardware. drm/i915: Define MI_ARB_STATE bits vmwgfx: return -EFAULT if copy_to_user fails fb: handle allocation failure in alloc_apertures() drm: radeon: check kzalloc() result drm/ttm: Fix build on architectures without AGP drm/radeon/kms: fix gtt MC base alignment on rs4xx/rs690/rs740 asics drm/radeon/kms: fix possible mis-detection of sideport on rs690/rs740 drm/radeon/kms: fix legacy tv-out pal mode commit c42750b0261274107ae85c894c088e618a3e38b9 Author: Alex Deucher Date: Wed Jul 21 10:29:32 2010 +1000 drm/r600: fix possible NULL pointer derefernce Reported-by: Alexander Y. Fomichev Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit e153b70b89770968a704eda0b55707c6066b2d44 Author: Alex Deucher Date: Tue Jul 20 18:07:22 2010 -0400 drm/radeon/kms: add quirk for ASUS HD 3600 board Connector is actually DVI rather than HDMI. Reported-by: trapDoor Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit a6a1a095ec8ace2912fc280d371eee8ff5da5736 Author: Doug Goldstein Date: Tue Jul 20 15:22:25 2010 -0700 include/linux/vgaarb.h: add missing part of include guard vgaarb.h was missing the #define of the #ifndef at the top for the guard to prevent multiple #include's from causing re-define errors Signed-off-by: Doug Goldstein Cc: Dave Airlie Cc: Jesse Barnes Signed-off-by: Andrew Morton Signed-off-by: Dave Airlie commit e0959371b4aaddb9b986019d5cfef93f9801d0ff Merge: 83ba371 e979cf5 Author: Linus Torvalds Date: Tue Jul 20 16:27:58 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: ceph: do not include cap/dentry releases in replayed messages ceph: reuse request message when replaying against recovering mds ceph: fix creation of ipv6 sockets ceph: fix parsing of ipv6 addresses ceph: fix printing of ipv6 addrs ceph: add kfree() to error path ceph: fix leak of mon authorizer ceph: fix message revocation commit 83ba37105e262d374b9092a572b8ee6e30aa9f70 Merge: 516bd66 9fe41e4 Author: Linus Torvalds Date: Tue Jul 20 16:27:34 2010 -0700 Merge branch 'linuxdocs' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs * 'linuxdocs' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs: documentation: fix almost duplicate filenames (IO/io-mapping.txt) commit 516bd664153d76f5c814633cee6500e2ff8e861b Merge: 844b9a8 573201f Author: Linus Torvalds Date: Tue Jul 20 16:26:42 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (24 commits) bridge: Partially disable netpoll support tcp: fix crash in tcp_xmit_retransmit_queue IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input()) ibmveth: lost IRQ while closing/opening device leads to service loss rt2x00: Fix lockdep warning in rt2x00lib_probe_dev() vhost: avoid pr_err on condition guest can trigger ipmr: Don't leak memory if fib lookup fails. vhost-net: avoid flush under lock net: fix problem in reading sock TX queue net/core: neighbour update Oops net: skb_tx_hash() fix relative to skb_orphan_try() rfs: call sock_rps_record_flow() in tcp_splice_read() xfrm: do not assume that template resolving always returns xfrms hostap_pci: set dev->base_addr during probe axnet_cs: use spin_lock_irqsave in ax_interrupt dsa: Fix Kconfig dependencies. act_nat: not all of the ICMP packets need an IP header payload r8169: incorrect identifier for a 8168dp Phonet: fix skb leak in pipe endpoint accept() Bluetooth: Update sec_level/auth_type for already existing connections ... commit 844b9a8707f1fcf0482e0c52f44a555e799ccda6 Author: Paul E. McKenney Date: Tue Jul 20 13:24:34 2010 -0700 vfs: fix RCU-lockdep false positive due to /proc If a single-threaded process does a file-descriptor operation, and some other process accesses that same file descriptor via /proc, the current rcu_dereference_check_fdtable() can give a false-positive RCU-lockdep splat due to the reference count being increased by the /proc access after the reference-count check in fget_light() but before the check in rcu_dereference_check_fdtable(). This commit prevents this false positive by checking for a single-threaded process. To avoid #include hell, this commit uses the wrapper for thread_group_empty(current) defined by rcu_my_thread_group_empty() provided in a separate commit. Located-by: Miles Lane Located-by: Eric Dumazet Signed-off-by: Paul E. McKenney Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9d51a6b2487724e8713cd2794cf09ffeee5f6932 Author: Marek Szyprowski Date: Tue Jul 20 13:24:33 2010 -0700 sdhci-s3c: add missing remove function System will crash sooner or later once the memory with the code of the s3c-sdhci.ko module is reused for something else. I really have no idea how the lack of remove function went unnoticed into the mainline code. Signed-off-by: Marek Szyprowski Signed-off-by: Kyungmin Park Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d45840d9f04be4d8c0288066f37bca3a448f7471 Author: Andres Salomon Date: Tue Jul 20 13:24:32 2010 -0700 Andres has moved My Collabora address is no longer enabled - update the MODULE_AUTHOR fields of drivers to my current email address. Signed-off-by: Andres Salomon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b8ab9f82025adea77864115da73e70026fa4f540 Author: Yinghai Lu Date: Tue Jul 20 13:24:31 2010 -0700 x86,nobootmem: make alloc_bootmem_node fall back to other node when 32bit numa is used Borislav Petkov reported his 32bit numa system has problem: [ 0.000000] Reserving total of 4c00 pages for numa KVA remap [ 0.000000] kva_start_pfn ~ 32800 max_low_pfn ~ 375fe [ 0.000000] max_pfn = 238000 [ 0.000000] 8202MB HIGHMEM available. [ 0.000000] 885MB LOWMEM available. [ 0.000000] mapped low ram: 0 - 375fe000 [ 0.000000] low ram: 0 - 375fe000 [ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 1000 1000 => 34e7000 [ 0.000000] alloc (nid=8 100000 - 7ee00000) (1000000 - ffffffff) 200 40 => 34c9d80 [ 0.000000] alloc (nid=0 100000 - 7ee00000) (1000000 - ffffffffffffffff) 180 40 => 34e6140 [ 0.000000] alloc (nid=1 80000000 - c7e60000) (1000000 - ffffffffffffffff) 240 40 => 80000000 [ 0.000000] BUG: unable to handle kernel paging request at 40000000 [ 0.000000] IP: [] __alloc_memory_core_early+0x147/0x1d6 [ 0.000000] *pdpt = 0000000000000000 *pde = f000ff53f000ff00 ... [ 0.000000] Call Trace: [ 0.000000] [] ? __alloc_bootmem_node+0x216/0x22f [ 0.000000] [] ? sparse_early_usemaps_alloc_node+0x5a/0x10b [ 0.000000] [] ? sparse_init+0x1dc/0x499 [ 0.000000] [] ? paging_init+0x168/0x1df [ 0.000000] [] ? native_pagetable_setup_start+0xef/0x1bb looks like it allocates too much high address for bootmem. Try to cut limit with get_max_mapped() Reported-by: Borislav Petkov Tested-by: Conny Seidel Signed-off-by: Yinghai Lu Cc: [2.6.34.x] Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Thomas Gleixner Cc: Johannes Weiner Cc: Lee Schermerhorn Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9aebbdb637a73a6092e1456ebb4a2df32cc1f611 Author: Yinghai Lu Date: Tue Jul 20 13:24:30 2010 -0700 x86, numa: fix boot without RAM on node0 again Commit e534c7c5f8d6 ("numa: x86_64: use generic percpu var numa_node_id() implementation") broke numa systems that don't have ram on node0 when MEMORY_HOTPLUG is enabled, because cpu_up() will call cpu_to_node() before per_cpu(numa_node) is setup for APs. When Node0 doesn't have RAM, on x86, cpus already round it to nearest node with RAM in x86_cpu_to_node_map. and per_cpu(numa_node) is not set up until in c_init for APs. When later cpu_up() calling cpu_to_node() will get 0 again, and make it online even there is no RAM on node0. so later all APs can not booted up, and later will have panic. [ 1.611101] On node 0 totalpages: 0 ......... [ 2.608558] On node 0 totalpages: 0 [ 2.612065] Brought up 1 CPUs [ 2.615199] Total of 1 processors activated (3990.31 BogoMIPS). ... 93.225341] calling loop_init+0x0/0x1a4 @ 1 [ 93.229314] PERCPU: allocation failed, size=80 align=8, failed to populate [ 93.246539] Pid: 1, comm: swapper Tainted: G W 2.6.35-rc4-tip-yh-04371-gd64e6c4-dirty #354 [ 93.264621] Call Trace: [ 93.266533] [] pcpu_alloc+0x83a/0x8e7 [ 93.270710] [] __alloc_percpu+0x10/0x12 [ 93.285849] [] alloc_disk_node+0x94/0x16d [ 93.291811] [] alloc_disk+0x11/0x13 [ 93.306157] [] loop_alloc+0xa7/0x180 [ 93.310538] [] loop_init+0x9b/0x1a4 [ 93.324909] [] ? loop_init+0x0/0x1a4 [ 93.329650] [] do_one_initcall+0x57/0x136 [ 93.345197] [] kernel_init+0x184/0x20e [ 93.348146] [] kernel_thread_helper+0x4/0x10 [ 93.365194] [] ? restore_args+0x0/0x30 [ 93.369305] [] ? kernel_init+0x0/0x20e [ 93.386011] [] ? kernel_thread_helper+0x0/0x10 [ 93.392047] loop: out of memory ... Try to assign per_cpu(numa_node) early [akpm@linux-foundation.org: tidy up code comment] Signed-off-by: Yinghai Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Tejun Heo Cc: Denys Vlasenko Acked-by: Lee Schermerhorn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5528e229f0f709e4f3d61dab73e553eea10758a9 Author: Anton Vorontsov Date: Tue Jul 20 13:24:28 2010 -0700 edac: mpc85xx: add support for MPC8569 EDAC controllers Simply add a proper ID into the device table. Signed-off-by: Anton Vorontsov Cc: Doug Thompson Cc: Peter Tyser Cc: Dave Jiang Cc: Kumar Gala Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1cd8521e7d77def75fdb1cb35ecd135385e4be4f Author: Anton Vorontsov Date: Tue Jul 20 13:24:27 2010 -0700 edac: mpc85xx: fix MPC85xx dependency Since commit 5753c082f66eca5be81f6bda85c1718c5eea6ada ("powerpc/85xx: Kconfig cleanup"), there is no MPC85xx Kconfig symbol anymore, so the driver became non-selectable. This patch fixes the issue by switching to PPC_85xx symbol. Signed-off-by: Anton Vorontsov Cc: Doug Thompson Cc: Peter Tyser Cc: Dave Jiang Cc: Kumar Gala Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a6aa62a0909b9ccb1f8b0d2653920ba071037972 Author: Nick Piggin Date: Tue Jul 20 13:24:25 2010 -0700 mm/vmscan.c: fix mapping use after free We need lock_page_nosync() here because we have no reference to the mapping when taking the page lock. Signed-off-by: Nick Piggin Reviewed-by: Johannes Weiner Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c61284e99191b2284fb74dae6961d4d09e4e59e8 Author: Manfred Spraul Date: Tue Jul 20 13:24:23 2010 -0700 ipc/sem.c: bugfix for semop() not reporting successful operation The last change to improve the scalability moved the actual wake-up out of the section that is protected by spin_lock(sma->sem_perm.lock). This means that IN_WAKEUP can be in queue.status even when the spinlock is acquired by the current task. Thus the same loop that is performed when queue.status is read without the spinlock acquired must be performed when the spinlock is acquired. Thanks to kamezawa.hiroyu@jp.fujitsu.com for noticing lack of the memory barrier. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16255 [akpm@linux-foundation.org: clean up kerneldoc, checkpatch warning and whitespace] Signed-off-by: Manfred Spraul Reported-by: Luca Tettamanti Tested-by: Luca Tettamanti Reported-by: Christoph Lameter Cc: Maciej Rutecki Cc: KAMEZAWA Hiroyuki Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7173aeff025a7fed3fa903e362bf773e6258dd47 Author: Francisco Jerez Date: Sat Jul 10 17:37:00 2010 +0200 drm/nouveau: Fix crashes during fbcon init on single head cards. this fixes a regression since the fbcon rework. Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie commit 14d7ec11d165fe11c2bce5b412773af70b7c8e1b Author: Ben Skeggs Date: Mon Jul 12 13:15:44 2010 +1000 drm/nouveau: fix pcirom vbios shadow breakage from acpi rom patch On nv50 it became impossible to attempt a PCI ROM shadow of the VBIOS, which will break some setups. This patch also removes the different ordering of shadow methods for pre-nv50 chipsets. The reason for the different ordering was paranoia, but it should hopefully be OK to try shadowing PRAMIN first. Signed-off-by: Ben Skeggs Signed-off-by: Dave Airlie commit 42f14c4b454946650cf0bf66e0b631d02e328f61 Author: Alex Deucher Date: Tue Jul 20 11:27:54 2010 -0400 drm/radeon/kms: fix shared ddc harder This fixes a regression caused by b2ea4aa67bfd084834edd070e0a4a47857d6db59 due to the way shared ddc with multiple digital connectors was handled. You generally have two cases where DDC lines are shared: - HDMI + VGA - HDMI + DVI-D HDMI + VGA is easy to deal with because you can check the EDID for the to see if the attached monitor is digital. A shared DDC line with two digital connectors is more complex. You can't use the hdmi bits in the EDID since they may not be there with DVI<->HDMI adapters. In this case all we can do is check the HPD pins to see which is connected as we have no way of knowing using the EDID. Reported-by: trapdoor6@gmail.com Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit 9fe41e4197f351bc78547ab2d8808e1aca30d87c Author: Randy Dunlap Date: Mon Jul 19 22:20:27 2010 +0000 documentation: fix almost duplicate filenames (IO/io-mapping.txt) Having both IO-mapping.txt and io-mapping.txt in Documentation/ was confusing and/or bothersome to some people, so rename IO-mapping.txt to bus-virt-phys-mapping.txt. Also update Documentation/00-INDEX for both of these files. Signed-off-by: Randy Dunlap Cc: Kees Bakker Cc: Keith Packard commit 19f0f0af097ba3138ae2780b471180512763a78f Merge: 620d0be 2d31757 Author: Linus Torvalds Date: Tue Jul 20 08:22:15 2010 -0700 Merge git://git.infradead.org/users/cbou/battery-2.6.35 * git://git.infradead.org/users/cbou/battery-2.6.35: ds2782_battery: Fix ds2782_get_capacity return value commit 573201f36fd9c7c6d5218cdcd9948cee700b277d Author: Herbert Xu Date: Mon Jul 19 19:26:45 2010 +0000 bridge: Partially disable netpoll support The new netpoll code in bridging contains use-after-free bugs that are non-trivial to fix. This patch fixes this by removing the code that uses skbs after they're freed. As a consequence, this means that we can no longer call bridge from the netpoll path, so this patch also removes the controller function in order to disable netpoll. Signed-off-by: Herbert Xu Thanks, Signed-off-by: David S. Miller commit 944001201ca0196bcdb088129e5866a9f379d08c Author: Dave Airlie Date: Tue Jul 20 13:15:31 2010 +1000 drm/i915: enable low power render writes on GEN3 hardware. A lot of 945GMs have had stability issues for a long time, this manifested as X hangs, blitter engine hangs, and lots of crashes. one such report is at: https://bugs.freedesktop.org/show_bug.cgi?id=20560 along with numerous distro bugzillas. This only took a week of digging and hair ripping to figure out. Tracked down and tested on a 945GM Lenovo T60, previously running x11perf -copypixwin500 or x11perf -copywinpix500 repeatedly would cause the GPU to wedge within 4 or 5 tries, with random busy bits set. After this patch no hangs were observed. cc: stable@kernel.org Signed-off-by: Dave Airlie commit 45503ded966c98e604c9667c0b458d40666b9ef3 Author: Keith Packard Date: Mon Jul 19 21:12:35 2010 -0700 drm/i915: Define MI_ARB_STATE bits The i915 memory arbiter has a register full of configuration bits which are currently not defined in the driver header file. Signed-off-by: Keith Packard cc: stable@kernel.org Signed-off-by: Dave Airlie commit 4ede00c96632bcf8a21dd69ac0248f4c40b4cd0e Author: Dan Carpenter Date: Sat Jul 10 16:30:04 2010 +0200 vmwgfx: return -EFAULT if copy_to_user fails copy_to_user() returns the number of bytes remaining to be copied, but we want to return a negative error code. This gets copied to user space. Signed-off-by: Dan Carpenter Signed-off-by: Dave Airlie commit 772a2f9b488f4d27c314da5eeabde750b9ead41b Author: Dan Carpenter Date: Thu Jul 15 10:39:47 2010 +0200 fb: handle allocation failure in alloc_apertures() If the kzalloc() fails we should return NULL. All the places that call alloc_apertures() check for this already. Signed-off-by: Dan Carpenter Acked-by: James Simmons Acked-by: Marcin Slusarz Signed-off-by: Dave Airlie commit bbb642f9c9a43dbe45ffe14935397a2a34100263 Author: Kulikov Vasiliy Date: Fri Jul 16 20:13:33 2010 +0400 drm: radeon: check kzalloc() result If kzalloc() fails exit with -ENOMEM. Signed-off-by: Kulikov Vasiliy Signed-off-by: Dave Airlie commit 1e8655f87333def92bb8215b423adc65403b08a5 Author: Ben Hutchings Date: Sun Jul 18 21:51:42 2010 +0100 drm/ttm: Fix build on architectures without AGP Make inclusion of conditional on TTM_HAS_AGP. The use of the functions declared in it is already conditional. Reported-by: Geert Stappers Signed-off-by: Ben Hutchings Tested-by: Geert Stappers Signed-off-by: Dave Airlie commit 620d0be88188cd3dc79db3f5eab1420d6f97c70c Merge: ee10393 16fd536 Author: Linus Torvalds Date: Mon Jul 19 20:18:24 2010 -0700 Merge branch 'shrinker' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/xfsdev * 'shrinker' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/xfsdev: xfs: track AGs with reclaimable inodes in per-ag radix tree xfs: convert inode shrinker to per-filesystem contexts mm: add context argument to shrinker callback commit ee1039307a8a64b038f9b8cdc6f9120ecd9dfe9b Merge: d0c6f62 2ebc346 Author: Linus Torvalds Date: Mon Jul 19 19:33:02 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE Btrfs: fix CLONE ioctl destination file size expansion to block boundary Btrfs: fix split_leaf double split corner case commit 16fd5367370099b59d96e30bb7d9de8d419659f2 Author: Dave Chinner Date: Tue Jul 20 09:43:39 2010 +1000 xfs: track AGs with reclaimable inodes in per-ag radix tree https://bugzilla.kernel.org/show_bug.cgi?id=16348 When the filesystem grows to a large number of allocation groups, the summing of recalimable inodes gets expensive. In many cases, most AGs won't have any reclaimable inodes and so we are wasting CPU time aggregating over these AGs. This is particularly important for the inode shrinker that gets called frequently under memory pressure. To avoid the overhead, track AGs with reclaimable inodes in the per-ag radix tree so that we can find all the AGs with reclaimable inodes via a simple gang tag lookup. This involves setting the tag when the first reclaimable inode is tracked in the AG, and removing the tag when the last reclaimable inode is removed from the tree. Then the summation process becomes a loop walking the radix tree summing AGs with the reclaim tag set. This significantly reduces the overhead of scanning - a 6400 AG filesystea now only uses about 25% of a cpu in kswapd while slab reclaim progresses instead of being permanently stuck at 100% CPU and making little progress. Clean filesystems filesystems will see no overhead and the overhead only increases linearly with the number of dirty AGs. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig commit 70e60ce71516c3a9e882edb70a09f696a05961db Author: Dave Chinner Date: Tue Jul 20 08:07:02 2010 +1000 xfs: convert inode shrinker to per-filesystem contexts Now the shrinker passes us a context, wire up a shrinker context per filesystem. This allows us to remove the global mount list and the locking problems that introduced. It also means that a shrinker call does not need to traverse clean filesystems before finding a filesystem with reclaimable inodes. This significantly reduces scanning overhead when lots of filesystems are present. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig commit 2ebc3464781ad24474abcbd2274e6254689853b5 Author: Dan Rosenberg Date: Mon Jul 19 16:58:20 2010 -0400 Btrfs: fix checks in BTRFS_IOC_CLONE_RANGE 1. The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check whether the donor file is append-only before writing to it. 2. The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around). I haven't been able to successfully exploit this, but I'd imagine that a clever attacker could use this to read things he shouldn't. Even if it's not exploitable, it couldn't hurt to be safe. Signed-off-by: Dan Rosenberg cc: stable@kernel.org Signed-off-by: Chris Mason commit d0c6f6258478e1dba532bf7c28e2cd6e1047d3a4 Merge: 46ac0cc f82c3d7 Author: Linus Torvalds Date: Mon Jul 19 13:19:32 2010 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain x86: Fix x2apic preenabled system with kexec x86: Force HPET readback_cmp for all ATI chipsets commit 46ac0cc92eedf92f7909e563ffcd2dbc4b914bc3 Merge: 2decd5a 9078370 Author: Linus Torvalds Date: Mon Jul 19 13:18:34 2010 -0700 Merge branch 'kmemleak' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-2.6-cm * 'kmemleak' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-2.6-cm: kmemleak: Add support for NO_BOOTMEM configurations kmemleak: Annotate false positive in init_section_page_cgroup() commit 2decd5a7cea2c1dae6418fe778857d43680a91aa Merge: b4fd4f8 878c495 Author: Linus Torvalds Date: Mon Jul 19 13:18:05 2010 -0700 Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6 * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6: [S390] cio: fix potential overflow in chpid descriptor [S390] add missing device put [S390] dasd: use correct label location for diag fba disks commit b4fd4f890bca2291a12bb0807027db40f929a82d Author: Sreedhara DS Date: Mon Jul 19 09:37:42 2010 +0100 intel_scu_ipc: Oops/crash fixes - fix reversing of command/sub arguments - fix a crash if the i2c interface is called before the device is found Signed-off-by: Sreedhara DS Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds commit b5384d48f4e74edec3ca1887cb65e378a72af9a1 Author: Sage Weil Date: Sat Jun 12 22:31:14 2010 +0000 Btrfs: fix CLONE ioctl destination file size expansion to block boundary The CLONE and CLONE_RANGE ioctls round up the range of extents being cloned to the block size when the range to clone extends to the end of file (this is always the case with CLONE). It was then using that offset when extending the destination file's i_size. Fix this by not setting i_size beyond the originally requested ending offset. This bug was introduced by a22285a6 (2.6.35-rc1). Signed-off-by: Sage Weil Signed-off-by: Chris Mason commit 99d8f83c98930100cd70437b0c81a935e7a14b0b Author: Chris Mason Date: Wed Jul 7 10:51:48 2010 -0400 Btrfs: fix split_leaf double split corner case split_leaf was not properly balancing leaves when it was forced to split a leaf twice. This commit adds an extra push left and right before forcing the double split in hopes of getting the slot where we want to insert at either the start or end of the leaf. If the extra pushes do work, then we are able to avoid splitting twice and we keep the tree properly balanced. Signed-off-by: Chris Mason commit 45e77d314585869dfe43c82679f7e08c9b35b898 Author: Ilpo Järvinen Date: Mon Jul 19 01:16:18 2010 +0000 tcp: fix crash in tcp_xmit_retransmit_queue It can happen that there are no packets in queue while calling tcp_xmit_retransmit_queue(). tcp_write_queue_head() then returns NULL and that gets deref'ed to get sacked into a local var. There is no work to do if no packets are outstanding so we just exit early. This oops was introduced by 08ebd1721ab8fd (tcp: remove tp->lost_out guard to make joining diff nicer). Signed-off-by: Ilpo Järvinen Reported-by: Lennart Schulte Tested-by: Lennart Schulte Signed-off-by: David S. Miller commit b508998f665ee6d6a15eae11be258c3e94c33562 Merge: d9a9dc6 9acd56d Author: David S. Miller Date: Mon Jul 19 12:38:51 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 9078370c0d2cfe4a905aa34f398bbb0d65921a2b Author: Catalin Marinas Date: Mon Jul 19 11:54:15 2010 +0100 kmemleak: Add support for NO_BOOTMEM configurations With commits 08677214 and 59be5a8e, alloc_bootmem()/free_bootmem() and friends use the early_res functions for memory management when NO_BOOTMEM is enabled. This patch adds the kmemleak calls in the corresponding code paths for bootmem allocations. Signed-off-by: Catalin Marinas Acked-by: Pekka Enberg Acked-by: Yinghai Lu Cc: H. Peter Anvin Cc: stable@kernel.org commit 7952f98818d561ed0e11434a7a16acd9a7bae859 Author: Catalin Marinas Date: Mon Jul 19 11:54:14 2010 +0100 kmemleak: Annotate false positive in init_section_page_cgroup() The pointer to the page_cgroup table allocated in init_section_page_cgroup() is stored in section->page_cgroup as (base - pfn). Since this value does not point to the beginning or inside the allocated memory block, kmemleak reports a false positive. This was reported in bugzilla.kernel.org as #16297. Signed-off-by: Catalin Marinas Reported-by: Adrien Dessemond Reviewed-by: KAMEZAWA Hiroyuki Cc: Pekka Enberg Cc: Andrew Morton commit 878c495644be28cc881e7ee792f00fd879a1ebf9 Author: Sebastian Ott Date: Mon Jul 19 09:22:37 2010 +0200 [S390] cio: fix potential overflow in chpid descriptor The length filed in the chsc response block (if valid) has a value of n*(sizeof(chp_desc))+8 (for the response block header). When we memcopied from the response block to the actual descriptor we copied 8 bytes too much. The bug was not revealed since the descriptor is embedded in struct channel_path. Since we only write one descriptor at a time ignore the length value and use sizeof(*desc). Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 0abccf77402af44855da739b439d01cfb65b4bfd Author: Stefan Haberland Date: Mon Jul 19 09:22:36 2010 +0200 [S390] add missing device put The dasd_alias_show function does not return a device reference in case the device is an alias. Signed-off-by: Stefan Haberland Signed-off-by: Martin Schwidefsky commit cffab6bc5511cd6f67a60bf16b62de4267b68c4c Author: Peter Oberparleiter Date: Mon Jul 19 09:22:35 2010 +0200 [S390] dasd: use correct label location for diag fba disks Partition boundary calculation fails for DASD FBA disks under the following conditions: - disk is formatted with CMS FORMAT with a blocksize of more than 512 bytes - all of the disk is reserved to a single CMS file using CMS RESERVE - the disk is accessed using the DIAG mode of the DASD driver Under these circumstances, the partition detection code tries to read the CMS label block containing partition-relevant information from logical block offset 1, while it is in fact located at physical block offset 1. Fix this problem by using the correct CMS label block location depending on the device type as determined by the DASD SENSE ID information. Signed-off-by: Peter Oberparleiter Signed-off-by: Martin Schwidefsky commit 7f8275d0d660c146de6ee3017e1e2e594c49e820 Author: Dave Chinner Date: Mon Jul 19 14:56:17 2010 +1000 mm: add context argument to shrinker callback The current shrinker implementation requires the registered callback to have global state to work from. This makes it difficult to shrink caches that are not global (e.g. per-filesystem caches). Pass the shrinker structure to the callback so that users can embed the shrinker structure in the context the shrinker needs to operate on and get back to it in the callback via container_of(). Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig commit a9f7f2e74ae0e6a801a2433dc8e9124d73da0cb4 Merge: 2044f22 a197479 Author: Linus Torvalds Date: Sun Jul 18 15:13:30 2010 -0700 Merge branch 'x86/kprobes' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland * 'x86/kprobes' of git://git.kernel.org/pub/scm/linux/kernel/git/frob/linux-2.6-roland: x86: kprobes: fix swapped segment registers in kretprobe commit a197479848a2f1a2a5c07cffa6c31ab5e8c82797 Author: Roland McGrath Date: Fri Jul 16 18:17:12 2010 -0700 x86: kprobes: fix swapped segment registers in kretprobe In commit f007ea26, the order of the %es and %ds segment registers got accidentally swapped, so synthesized 'struct pt_regs' frames have the two values inverted. It's almost sure that these values never matter, and that they also never differ. But wrong is wrong. Signed-off-by: Roland McGrath commit 2044f2282d7558c765270d78e19dbdcf6190ca71 Merge: bea9a6d 58c84ed Author: Linus Torvalds Date: Sun Jul 18 15:05:22 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: fall back to original BIOS BAR addresses commit d9a9dc66eb8a8fd85c8546247e7e1d6023d0eb0f Author: Arnaud Ebalard Date: Fri Jul 16 00:38:44 2010 +0000 IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input()) The input handler for Type 2 Routing Header (mip6_rthdr_input()) checks if the CoA in the packet matches the CoA in the XFRM state. Current check is buggy: it compares the adddress in the Type 2 Routing Header, i.e. the HoA, against the expected CoA in the state. The comparison should be made against the address in the destination field of the IPv6 header. The bug remained unnoticed because the main (and possibly only current) user of the code (UMIP MIPv6 Daemon) initializes the XFRM state with the unspecified address, i.e. explicitly allows everything. Yoshifuji-san, can you ack that one? Signed-off-by: Arnaud Ebalard Signed-off-by: David S. Miller commit bea9a6d239cb2aa2ced4dcb0a05e1827ce61fa3d Merge: cd9f040 5453258 Author: Linus Torvalds Date: Sun Jul 18 10:09:25 2010 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2: Silence gcc warning in ocfs2_write_zero_page(). jbd2/ocfs2: Fix block checksumming when a buffer is used in several transactions ocfs2/dlm: Remove BUG_ON from migration in the rare case of a down node ocfs2: Don't duplicate pages past i_size during CoW. ocfs2: tighten up strlen() checking ocfs2: Make xattr reflink work with new local alloc reservation. ocfs2: make xattr extension work with new local alloc reservation. ocfs2: Remove the redundant cpu_to_le64. ocfs2/dlm: don't access beyond bitmap size ocfs2: No need to zero pages past i_size. ocfs2: Zero the tail cluster when extending past i_size. ocfs2: When zero extending, do it by page. ocfs2: Limit default local alloc size within bitmap range. ocfs2: Move orphan scan work to ocfs2_wq. fs/ocfs2/dlm: Add missing spin_unlock commit cd9f040df6ce46573760a507cb88192d05d27d86 Author: Linus Torvalds Date: Sun Jul 18 09:44:37 2010 -0700 drm/i915: add 'reclaimable' to i915 self-reclaimable page allocations The hibernate issues that got fixed in commit 985b823b9192 ("drm/i915: fix hibernation since i915 self-reclaim fixes") turn out to have been incomplete. Vefa Bicakci tested lots of hibernate cycles, and without the __GFP_RECLAIMABLE flag the system eventually fails to resume. With the flag added, Vefa can apparently hibernate forever (or until he gets bored running his automated scripts, whichever comes first). The reclaimable flag was there originally, and was one of the flags that were dropped (unintentionally) by commit 4bdadb978569 ("drm/i915: Selectively enable self-reclaim") that introduced all these problems, but I didn't want to just blindly add back all the flags in commit 985b823b9192, and it looked like __GFP_RECLAIM wasn't necessary. It clearly was. I still suspect that there is some subtle reason we're missing that causes the problems, but __GFP_RECLAIMABLE is certainly not wrong to use in this context, and is what the code historically used. And we have no idea what the causes the corruption without it. Reported-and-tested-by: M. Vefa Bicakci Cc: Dave Airlie Cc: Chris Wilson Cc: KOSAKI Motohiro Cc: Hugh Dickins Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit f82c3d71d6fd2e6a3e3416f09099e29087e39abf Author: Jacob Pan Date: Fri Jul 16 11:58:26 2010 -0700 x86, pci, mrst: Add extra sanity check in walking the PCI extended cap chain The fixed bar capability structure is searched in PCI extended configuration space. We need to make sure there is a valid capability ID to begin with otherwise, the search code may stuck in a infinite loop which results in boot hang. This patch adds additional check for cap ID 0, which is also invalid, and indicates end of chain. End of chain is supposed to have all fields zero, but that doesn't seem to always be the case in the field. Suggested-by: "H. Peter Anvin" Signed-off-by: Jacob Pan Reviewed-by: Jesse Barnes LKML-Reference: <1279306706-27087-1-git-send-email-jacob.jun.pan@linux.intel.com> Signed-off-by: H. Peter Anvin commit fd19dce7ac07973f700b0f13fb7f94b951414a4c Author: Yinghai Lu Date: Thu Jul 15 00:00:59 2010 -0700 x86: Fix x2apic preenabled system with kexec Found one x2apic system kexec loop test failed when CONFIG_NMI_WATCHDOG=y (old) or CONFIG_LOCKUP_DETECTOR=y (current tip) first kernel can kexec second kernel, but second kernel can not kexec third one. it can be duplicated on another system with BIOS preenabled x2apic. First kernel can not kexec second kernel. It turns out, when kernel boot with pre-enabled x2apic, it will not execute disable_local_APIC on shutdown path. when init_apic_mappings() is called in setup_arch, it will skip setting of apic_phys when x2apic_mode is set. ( x2apic_mode is much early check_x2apic()) Then later, disable_local_APIC() will bail out early because !apic_phys. So check !x2apic_mode in x2apic_mode in disable_local_APIC with !apic_phys. another solution could be updating init_apic_mappings() to set apic_phys even for preenabled x2apic system. Actually even for x2apic system, that lapic address is mapped already in early stage. BTW: is there any x2apic preenabled system with apicid of boot cpu > 255? Signed-off-by: Yinghai Lu LKML-Reference: <4C3EB22B.3000701@kernel.org> Acked-by: Suresh Siddha Cc: stable@kernel.org Signed-off-by: H. Peter Anvin commit 5453258d532e72731b0829e4fefd36dd611a2fff Author: Joel Becker Date: Fri Jul 16 13:32:33 2010 -0700 ocfs2: Silence gcc warning in ocfs2_write_zero_page(). ocfs2_write_zero_page() has a loop that won't ever be skipped, but gcc doesn't know that. Set ret=0 just to make gcc happy. Signed-off-by: Joel Becker commit ee2e6114de3bdb1c34f3910b690f990483e981ab Author: Robert Jennings Date: Fri Jul 16 04:57:25 2010 +0000 ibmveth: lost IRQ while closing/opening device leads to service loss The order of freeing the IRQ and freeing the device in firmware in ibmveth_close can cause the adapter to become unusable after a subsequent ibmveth_open. Only a reboot of the OS will make the network device usable again. This is seen when cycling the adapter up and down while there is network activity. There is a window where an IRQ will be left unserviced (H_EOI will not be called). The solution is to make a VIO_IRQ_DISABLE h_call, free the device with firmware, and then call free_irq. Signed-off-by: Robert Jennings Signed-off-by: David S. Miller commit 0f6142fa96a4ce799ccaa4cdb38fc4a715eb9d35 Merge: e40dbc5 95c0ec6 Author: David S. Miller Date: Fri Jul 16 12:41:44 2010 -0700 Merge branch 'vhost-net' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost commit 58c84eda07560a6b75b03e8d3b26d6eddfc14011 Author: Bjorn Helgaas Date: Thu Jul 15 09:41:42 2010 -0600 PCI: fall back to original BIOS BAR addresses If we fail to assign resources to a PCI BAR, this patch makes us try the original address from BIOS rather than leaving it disabled. Linux tries to make sure all PCI device BARs are inside the upstream PCI host bridge or P2P bridge apertures, reassigning BARs if necessary. Windows does similar reassignment. Before this patch, if we could not move a BAR into an aperture, we left the resource unassigned, i.e., at address zero. Windows leaves such BARs at the original BIOS addresses, and this patch makes Linux do the same. This is a bit ugly because we disable the resource long before we try to reassign it, so we have to keep track of the BIOS BAR address somewhere. For lack of a better place, I put it in the struct pci_dev. I think it would be cleaner to attempt the assignment immediately when the claim fails, so we could easily remember the original address. But we currently claim motherboard resources in the middle, after attempting to claim PCI resources and before assigning new PCI resources, and changing that is a fairly big job. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16263 Reported-by: Andrew Tested-by: Andrew Signed-off-by: Bjorn Helgaas Signed-off-by: Jesse Barnes commit f469461df6ff822f71b8737bda86eea20f16ff93 Merge: 79140bc 44a54f7 Author: Linus Torvalds Date: Fri Jul 16 11:26:33 2010 -0700 Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: tracing: Add alignment to syscall metadata declarations perf: Sync callchains with period based hits perf: Resurrect flat callchains perf: Version String fix, for fallback if not from git perf: Version String fix, using kernel version commit 9acd56d3f2a05191ee369cbdd8c37dd547aa19b8 Author: Stephen Boyd Date: Fri Jul 16 09:50:10 2010 -0700 rt2x00: Fix lockdep warning in rt2x00lib_probe_dev() The rt2x00dev->intf_work workqueue is never initialized when a driver is probed for a non-existent device (in this case rt2500usb). On such a path we call rt2x00lib_remove_dev() to free any resources initialized during the probe before we use INIT_WORK to initialize the workqueue. This causes lockdep to get confused since the lock used in the workqueue hasn't been initialized yet but is now being acquired during cancel_work_sync() called by rt2x00lib_remove_dev(). Fix this by initializing the workqueue first before we attempt to probe the device. This should make lockdep happy and avoid breaking any assumptions about how the library cleans up after a probe fails. phy0 -> rt2x00lib_probe_dev: Error - Failed to allocate device. INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. Pid: 2027, comm: modprobe Not tainted 2.6.35-rc5+ #60 Call Trace: [] register_lock_class+0x152/0x31f [] ? usb_control_msg+0xd5/0x111 [] __lock_acquire+0xce/0xcf4 [] ? trace_hardirqs_off+0xd/0xf [] ? _raw_spin_unlock_irqrestore+0x33/0x41 [] lock_acquire+0xd1/0xf7 [] ? __cancel_work_timer+0x99/0x17e [] __cancel_work_timer+0xd0/0x17e [] ? __cancel_work_timer+0x99/0x17e [] cancel_work_sync+0xb/0xd [] rt2x00lib_remove_dev+0x25/0xb0 [rt2x00lib] [] rt2x00lib_probe_dev+0x380/0x3ed [rt2x00lib] [] ? __raw_spin_lock_init+0x31/0x52 [] ? T.676+0xe/0x10 [rt2x00usb] [] rt2x00usb_probe+0x121/0x15e [rt2x00usb] [] usb_probe_interface+0x151/0x19e [] driver_probe_device+0xa7/0x136 [] __driver_attach+0x4a/0x66 [] ? __driver_attach+0x0/0x66 [] bus_for_each_dev+0x54/0x89 [] driver_attach+0x19/0x1b [] bus_add_driver+0xb4/0x204 [] driver_register+0x98/0x109 [] usb_register_driver+0xb2/0x173 [] ? rt2500usb_init+0x0/0x20 [rt2500usb] [] rt2500usb_init+0x1e/0x20 [rt2500usb] [] do_one_initcall+0x6d/0x17a [] sys_init_module+0x9c/0x1e0 [] system_call_fastpath+0x16/0x1b Signed-off-by: Stephen Boyd Signed-off-by: John W. Linville commit e979cf50395e24c4bdd489f60e2d5dd5ae66d255 Author: Sage Weil Date: Thu Jul 15 14:58:39 2010 -0700 ceph: do not include cap/dentry releases in replayed messages Strip the cap and dentry releases from replayed messages. They can cause the shared state to get out of sync because they were generated (with the request message) earlier, and no longer reflect the current client state. Signed-off-by: Sage Weil commit 01a92f174f8a3b99dbb5e02c86e7ee1e576737af Author: Sage Weil Date: Thu Jul 15 13:24:32 2010 -0700 ceph: reuse request message when replaying against recovering mds Replayed rename operations (after an mds failure/recovery) were broken because the request paths were regenerated from the dentry names, which get mangled when d_move() is called. Instead, resend the previous request message when replaying completed operations. Just make sure the REPLAY flag is set and the target ino is filled in. This fixes problems with workloads doing renames when the MDS restarts, where the rename operation appears to succeed, but on mds restart then fails (leading to client confusion, app breakage, etc.). Signed-off-by: Sage Weil commit 79140bc486fac016249f3d1d67ec9a39ebed9ad9 Merge: cc10b6f 728a756 Author: Linus Torvalds Date: Fri Jul 16 08:23:10 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: rename causes kernel Oops GFS2: BUG in gfs2_adjust_quota GFS2: Fix kernel NULL pointer dereference by dlm_astd GFS2: recovery stuck on transaction lock GFS2: O_TRUNC not working on stuffed files across cluster commit cc10b6ffd39ef982f86de68d95e5811df82cf819 Merge: 042bd1f 5b39187 Author: Linus Torvalds Date: Fri Jul 16 08:22:40 2010 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: w90p910_ts - fix call to setup_timer() Input: synaptics - fix wrong dimensions check Input: i8042 - mark stubs in i8042.h "static inline" commit 95c0ec6a97ae82d39a6e13fc01aa76861a4a76d0 Author: Michael S. Tsirkin Date: Thu Jun 24 17:10:25 2010 +0300 vhost: avoid pr_err on condition guest can trigger Guest can trigger packet truncation by posting a very short buffer and disabling buffer merging. Convert pr_err to pr_debug to avoid log from filling up when this happens. Signed-off-by: Michael S. Tsirkin commit 5b39187fad6faefae5ce1a1e997651d4e382b135 Author: Wan ZongShun Date: Thu Jul 15 23:28:57 2010 -0700 Input: w90p910_ts - fix call to setup_timer() No need to take address, w90p910_ts is already a pointer. Signed-off-by: Wan ZongShun Signed-off-by: Dmitry Torokhov commit e40dbc51fbcc3281bb52ecf0f5bec693d36e2aea Author: Ben Greear Date: Thu Jul 15 13:22:33 2010 +0000 ipmr: Don't leak memory if fib lookup fails. This was detected using two mcast router tables. The pimreg for the second interface did not have a specific mrule, so packets received by it were handled by the default table, which had nothing configured. This caused the ipmr_fib_lookup to fail, causing the memory leak. Signed-off-by: Ben Greear Signed-off-by: David S. Miller commit 042bd1ff6cf255e71689db913786dbb6bb79542d Merge: 2f7989e 2716fbf Author: Linus Torvalds Date: Thu Jul 15 20:25:44 2010 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: skcipher - avoid NULL dereference commit 8d369bb196f1f9111cb7ab839d4f420378fa7b30 Author: Alex Deucher Date: Thu Jul 15 10:51:10 2010 -0400 drm/radeon/kms: fix gtt MC base alignment on rs4xx/rs690/rs740 asics The asics in question have the following requirements with regard to their gart setups: 1. The GART aperture size has to be in the form of 2^X bytes, where X is from 25 to 31 2. The GART aperture MC base has to be aligned to a boundary equal to the size of the aperture. 3. The GART page table has to be aligned to the boundary equal to the size of the table. 4. The GART page table size is: table_entry_size * (aperture_size / page_size) 5. The GART page table has to be allocated in non-paged, non-cached, contiguous system memory. This patch takes care 2. The rest should already be handled properly. This fixes a regression noticed by: Torsten Kaiser Tested-by: Torsten Kaiser Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 13ceef099edd2b70c5a6f3a9ef5d6d97cda2e096 Author: Jan Kara Date: Wed Jul 14 07:56:33 2010 +0200 jbd2/ocfs2: Fix block checksumming when a buffer is used in several transactions OCFS2 uses t_commit trigger to compute and store checksum of the just committed blocks. When a buffer has b_frozen_data, checksum is computed for it instead of b_data but this can result in an old checksum being written to the filesystem in the following scenario: 1) transaction1 is opened 2) handle1 is opened 3) journal_access(handle1, bh) - This sets jh->b_transaction to transaction1 4) modify(bh) 5) journal_dirty(handle1, bh) 6) handle1 is closed 7) start committing transaction1, opening transaction2 8) handle2 is opened 9) journal_access(handle2, bh) - This copies off b_frozen_data to make it safe for transaction1 to commit. jh->b_next_transaction is set to transaction2. 10) jbd2_journal_write_metadata() checksums b_frozen_data 11) the journal correctly writes b_frozen_data to the disk journal 12) handle2 is closed - There was no dirty call for the bh on handle2, so it is never queued for any more journal operation 13) Checkpointing finally happens, and it just spools the bh via normal buffer writeback. This will write b_data, which was never triggered on and thus contains a wrong (old) checksum. This patch fixes the problem by calling the trigger at the moment data is frozen for journal commit - i.e., either when b_frozen_data is created by do_get_write_access or just before we write a buffer to the log if b_frozen_data does not exist. We also rename the trigger to t_frozen as that better describes when it is called. Signed-off-by: Jan Kara Signed-off-by: Mark Fasheh Signed-off-by: Joel Becker commit a39953dd95ff10e311083d94f4f95c348cb22464 Author: Wengang Wang Date: Wed Jul 14 22:38:21 2010 +0800 ocfs2/dlm: Remove BUG_ON from migration in the rare case of a down node For migration, we are waiting for DLM_LOCK_RES_MIGRATING flag to be set before sending DLM_MIG_LOCKRES_MSG message to the target. We are using dlm_migration_can_proceed() for that purpose. However, if the node is down, dlm_migration_can_proceed() will also return "go ahead". In this rare case, the DLM_LOCK_RES_MIGRATING flag might not be set yet. Remove the BUG_ON() that trips over this condition. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker commit f5e27b6ddfbafdd9c9c2f06bbf28af12581409bc Author: Tao Ma Date: Wed Jul 14 11:19:32 2010 +0800 ocfs2: Don't duplicate pages past i_size during CoW. During CoW, the pages after i_size don't contain valid data, so there's no need to read and duplicate them. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 08be97962bf338161325d4901642f956ce8c1adb Author: Thomas Gleixner Date: Wed Jul 14 21:36:27 2010 +0200 x86: Force HPET readback_cmp for all ATI chipsets commit 30a564be (x86, hpet: Restrict read back to affected ATI chipset) restricted the workaround for the HPET bug to SMX00 chipsets. This was reasonable as those were the only ones against which we ever got a bug report. Stephan Wolf reported now that this patch breaks his IXP400 based machine. Though it's confirmed to work on other IXP400 based systems. To error out on the safe side, we force the HPET readback workaround for all ATI SMbus class chipsets. Reported-by: Stephan Wolf LKML-Reference: Signed-off-by: Thomas Gleixner Tested-by: Stephan Wolf Acked-by: Borislav Petkov commit 1680e9063ea28099a1efa8ca11cee069cc7a9bc3 Author: Michael S. Tsirkin Date: Thu Jul 15 15:19:12 2010 +0300 vhost-net: avoid flush under lock We flush under vq mutex when changing backends. This creates a deadlock as workqueue being flushed needs this lock as well. https://bugzilla.redhat.com/show_bug.cgi?id=612421 Drop the vq mutex before flush: we have the device mutex which is sufficient to prevent another ioctl from touching the vq. Signed-off-by: Michael S. Tsirkin commit 728a756b8fcd22d80e2dbba8117a8a3aafd3f203 Author: Bob Peterson Date: Wed Jul 14 18:12:26 2010 -0400 GFS2: rename causes kernel Oops This patch fixes a kernel Oops in the GFS2 rename code. The problem was in the way the gfs2 directory code was trying to re-use sentinel directory entries. In the failing case, gfs2's rename function was renaming a file to another name that had the same non-trivial length. The file being renamed happened to be the first directory entry on the leaf block. First, the rename code (gfs2_rename in ops_inode.c) found the original directory entry and decided it could do its job by simply replacing the directory entry with another. Therefore it determined correctly that no block allocations were needed. Next, the rename code deleted the old directory entry prior to replacing it with the new name. Therefore, the soon-to-be replaced directory entry was temporarily made into a directory entry "sentinel" or a place holder at the start of a leaf block. Lastly, it went to re-add the replacement directory entry in that leaf block. However, when gfs2_dirent_find_space was looking for space in the leaf block, it used the wrong value for the sentinel. That threw off its calculations so later it decides it can't really re-use the sentinel and therefore must allocate a new leaf block. But because it previously decided to re-use the directory entry, it didn't waste the time to grab a new block allocation for the inode. Therefore, the inode's i_alloc pointer was still NULL and it crashes trying to reference it. In the case of sentinel directory entries, the entire dirent is reused, not just the "free space" portion of it, and therefore the function gfs2_dirent_find_space should use the value 0 rather than GFS2_DIRENT_SIZE(0) for the actual dirent size. Fixing this calculation enables the reproducer programs to work properly. Signed-off-by: Bob Peterson Signed-off-by: Steven Whitehouse commit 8b4216018bdbfbb1b76150d202b15ee68c38e991 Author: Abhijith Das Date: Sun Jul 4 01:33:24 2010 -0400 GFS2: BUG in gfs2_adjust_quota HighMem pages on i686 do not get mapped to the buffer_heads and this was causing a NULL pointer dereference when we were trying to memset page buffers to zero. We now use zero_user() that kmaps the page and directly manipulates page data. This patch also fixes a boundary condition that was incorrect. Signed-off-by: Abhi Das Signed-off-by: Steven Whitehouse commit b1becbdee776b447f203aa8da9a40488d5a75e1d Author: Bob Peterson Date: Thu Jun 17 16:45:37 2010 -0400 GFS2: Fix kernel NULL pointer dereference by dlm_astd This patch fixes a problem in an error path when looking up dinodes. There are two sister-functions, gfs2_inode_lookup and gfs2_process_unlinked_inode. Both functions acquire and hold the i_iopen glock for the dinode being looked up. The last thing they try to do is hold the i_gl glock for the dinode. If that glock fails for some reason, the error path was incorrectly calling gfs2_glock_put for the i_iopen glock twice. This resulted in the glock being prematurely freed. The "minimum hold time" usually kept the glock in memory, but the lock interface to dlm (aka lock_dlm) freed its memory for the glock. In some circumstances, it would cause dlm's dlm_astd daemon to try to call the bast function for the freed lock_dlm memory, which resulted in a NULL pointer dereference. Signed-off-by: Bob Peterson Signed-off-by: Steven Whitehouse commit b7dc2df5725fe7355fd76000ead7e39728e1b8a9 Author: Bob Peterson Date: Wed Jun 23 11:44:47 2010 -0400 GFS2: recovery stuck on transaction lock This patch fixes bugzilla bug #590878: GFS2: recovery stuck on transaction lock. We set the frozen flag on the glock when we receive a completion that cannot be delivered due to blocked locks. At that point we check to see whether the first waiting holder has the noexp flag set. If the noexp lock is queued later, then we need to unfreeze the glock at that point in time, namely, in the glock work function. This patch was originally written by Steve Whitehouse, but since he's on holiday, I'm submitting it. It's been well tested with a complex recovery test called revolver. Signed-off-by: Steve Whitehouse Signed-off-by: Bob Peterson commit a8bf2bc212e129dd59a8b06cdbc15079cc3bd876 Author: Bob Peterson Date: Thu Jun 24 19:15:09 2010 -0400 GFS2: O_TRUNC not working on stuffed files across cluster This patch replaces a statement that got dropped out by accident. Without the patch, truncates on stuffed (very small) files cause those files to have an unpredictable size. Signed-off-by: Bob Peterson Signed-off-by: Steven Whitehouse commit b0f77d0eae0c58a5a9691a067ada112ceeae2d00 Author: Tom Herbert Date: Wed Jul 14 20:50:29 2010 -0700 net: fix problem in reading sock TX queue Fix problem in reading the tx_queue recorded in a socket. In dev_pick_tx, the TX queue is read by doing a check with sk_tx_queue_recorded on the socket, followed by a sk_tx_queue_get. The problem is that there is not mutual exclusion across these calls in the socket so it it is possible that the queue in the sock can be invalidated after sk_tx_queue_recorded is called so that sk_tx_queue get returns -1, which sets 65535 in queue_index and thus dev_pick_tx returns 65536 which is a bogus queue and can cause crash in dev_queue_xmit. We fix this by only calling sk_tx_queue_get which does the proper checks. The interface is that sk_tx_queue_get returns the TX queue if the sock argument is non-NULL and TX queue is recorded, else it returns -1. sk_tx_queue_recorded is no longer used so it can be completely removed. Signed-off-by: Tom Herbert Signed-off-by: David S. Miller commit 91a72a70594e5212c97705ca6a694bd307f7a26b Author: Doug Kehn Date: Wed Jul 14 18:02:16 2010 -0700 net/core: neighbour update Oops When configuring DMVPN (GRE + openNHRP) and a GRE remote address is configured a kernel Oops is observed. The obserseved Oops is caused by a NULL header_ops pointer (neigh->dev->header_ops) in neigh_update_hhs() when void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *) = neigh->dev->header_ops->cache_update; is executed. The dev associated with the NULL header_ops is the GRE interface. This patch guards against the possibility that header_ops is NULL. This Oops was first observed in kernel version 2.6.26.8. Signed-off-by: Doug Kehn Acked-by: Eric Dumazet Signed-off-by: David S. Miller commit 2f7989efd4398d92b8adffce2e07dd043a0895fe Merge: 6f7dd68 0ebe25f Author: Linus Torvalds Date: Wed Jul 14 17:28:13 2010 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: ARM: 6226/1: fix kprobe bug in ldr instruction emulation ARM: Update mach-types ARM: lockdep: fix unannotated irqs-on ARM: 6184/2: ux500: use neutral PRCMU base ARM: 6212/1: atomic ops: add memory constraints to inline asm ARM: 6211/1: atomic ops: fix register constraints for atomic64_add_unless ARM: 6210/1: Do not rely on reset defaults of L2X0_AUX_CTRL commit 6f7dd68b755b215deda5188a2c13c00f4776ea66 Merge: ea4c1a7 95f72d1 Author: Linus Torvalds Date: Wed Jul 14 17:27:44 2010 -0700 Merge branch 'lmb-to-memblock' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'lmb-to-memblock' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: lmb: rename to memblock commit ea4c1a7e14051e2ba81fc7dc02e3d55bfb2d7548 Merge: bcefc8d 77154a2 Author: Linus Torvalds Date: Wed Jul 14 17:27:29 2010 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/fsl-booke: Fix address issue when using relocatable kernels powerpc/cpm1: Mark micropatch code/data static and __init powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue) commit 87fd308cfc6b2e880bf717a740bd5c58d2aed10c Author: Eric Dumazet Date: Tue Jul 13 05:24:20 2010 +0000 net: skb_tx_hash() fix relative to skb_orphan_try() commit fc6055a5ba31e2 (net: Introduce skb_orphan_try()) added early orphaning of skbs. This unfortunately added a performance regression in skb_tx_hash() in case of stacked devices (bonding, vlans, ...) Since skb->sk is now NULL, we cannot access sk->sk_hash anymore to spread tx packets to multiple NIC queues on multiqueue devices. skb_tx_hash() in this case only uses skb->protocol, same value for all flows. skb_orphan_try() can copy sk->sk_hash into skb->rxhash and skb_tx_hash() can use this saved sk_hash value to compute its internal hash value. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 0ebe25f90cd99bb1bcf622ec8a841421d48380d6 Author: Nicolas Pitre Date: Wed Jul 14 05:21:22 2010 +0100 ARM: 6226/1: fix kprobe bug in ldr instruction emulation From: Bin Yang Cc: stable@kernel.org Signed-off-by: Bin Yang Signed-off-by: Nicolas Pitre Signed-off-by: Russell King commit 3a047bf87b1b6f69c62ab9fb28072c639cb7e2fa Author: Changli Gao Date: Mon Jul 12 21:00:12 2010 +0000 rfs: call sock_rps_record_flow() in tcp_splice_read() rfs: call sock_rps_record_flow() in tcp_splice_read() call sock_rps_record_flow() in tcp_splice_read(), so the applications using splice(2) or sendfile(2) can utilize RFS. Signed-off-by: Changli Gao ---- net/ipv4/tcp.c | 1 + 1 file changed, 1 insertion(+) Signed-off-by: David S. Miller commit d809ec895505e6f35fb1965f0946381ab4eaa474 Author: Timo Teräs Date: Mon Jul 12 21:29:42 2010 +0000 xfrm: do not assume that template resolving always returns xfrms xfrm_resolve_and_create_bundle() assumed that, if policies indicated presence of xfrms, bundle template resolution would always return some xfrms. This is not true for 'use' level policies which can result in no xfrm's being applied if there is no suitable xfrm states. This fixes a crash by this incorrect assumption. Reported-by: George Spelvin Bisected-by: George Spelvin Tested-by: George Spelvin Signed-off-by: Timo Teräs Signed-off-by: David S. Miller commit 0f4da2d77e1bf424ac36424081afc22cbfc3ff2b Author: John W. Linville Date: Tue Jul 13 14:06:32 2010 -0400 hostap_pci: set dev->base_addr during probe "hostap: Protect against initialization interrupt" (which reinstated "wireless: hostap, fix oops due to early probing interrupt") reintroduced Bug 16111. This is because hostap_pci wasn't setting dev->base_addr, which is now checked in prism2_interrupt. As a result, initialization was failing for PCI-based hostap devices. This corrects that oversight. Signed-off-by: John W. Linville commit bbddd199995ff55f1bb0336cadff4ee3d02b5a2c Author: Takashi Iwai Date: Wed Jul 14 09:32:46 2010 -0700 Input: synaptics - fix wrong dimensions check The commit 83ba9ea8a04b72dfee2515428c15e7414ba4fc61 ommitted the return line for the old synaptics model accidentally. This resulted in a wrong check, namely, the dimensions are checked for the old devices that don't support the query properly. This patch adds the return line back. Signed-off-by: Takashi Iwai Signed-off-by: Dmitry Torokhov commit 95f72d1ed41a66f1c1c29c24d479de81a0bea36f Author: Yinghai Lu Date: Mon Jul 12 14:36:09 2010 +1000 lmb: rename to memblock via following scripts FILES=$(find * -type f | grep -vE 'oprofile|[^K]config') sed -i \ -e 's/lmb/memblock/g' \ -e 's/LMB/MEMBLOCK/g' \ $FILES for N in $(find . -name lmb.[ch]); do M=$(echo $N | sed 's/lmb/memblock/g') mv $N $M done and remove some wrong change like lmbench and dlmb etc. also move memblock.c from lib/ to mm/ Suggested-by: Ingo Molnar Acked-by: "H. Peter Anvin" Acked-by: Benjamin Herrenschmidt Acked-by: Linus Torvalds Signed-off-by: Yinghai Lu Signed-off-by: Benjamin Herrenschmidt commit bcefc8d0d3a0cba9078f519d69f138b93ad30e39 Merge: 177dd7e 5cdfa1c Author: Linus Torvalds Date: Tue Jul 13 17:31:11 2010 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: input: i8042 - add runtime check in x86's i8042_platform_init Revert "Input: fixup X86_MRST selects" Revert "Input: do not force selecting i8042 on Moorestown" x86, mrst: Add i8042_detect API for Moorestwon platform x86: Add i8042 pre-detection hook to x86_platform_ops x86, platform: Export x86_platform to modules commit 177dd7e1ebac9420636f155e8d429bc4f809c724 Merge: 1c5474a 9154635 Author: Linus Torvalds Date: Tue Jul 13 17:30:49 2010 -0700 Merge branch 'kvm-updates/2.6.35' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.35' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: MMU: flush remote tlbs when overwriting spte with different pfn KVM: VMX: Fix host MSR_KERNEL_GS_BASE corruption commit 5099fa7f23d3711538cbe9fe072b4ce1ba814035 Author: Alex Deucher Date: Mon Jul 12 17:33:50 2010 -0400 drm/radeon/kms: fix possible mis-detection of sideport on rs690/rs740 Check ulBootUpMemoryClock on AMD IGPs. Fix regression noticed by Torsten Kaiser Signed-off-by: Alex Deucher Cc: stable@kernel.org Signed-off-by: Dave Airlie commit ab83a38958ae7e419f18fabe9b2954a6087bfe0d Author: Ken Kawasaki Date: Sat Jul 10 01:18:13 2010 +0000 axnet_cs: use spin_lock_irqsave in ax_interrupt Use spin_lock_irqsave instead of spin_lock in ax_interrupt because the interrupt handler can also be invoked from ei_watchdog. Signed-off-by: Ken Kawasaki Signed-off-by: David S. Miller commit 336a283b9cbe47748ccd68fd8c5158f67cee644b Author: David S. Miller Date: Mon Jul 12 20:03:42 2010 -0700 dsa: Fix Kconfig dependencies. Based upon a report by Randy Dunlap. DSA needs PHYLIB, but PHYLIB needs NET_ETHERNET. So, in order to select PHYLIB we have to make DSA depend upon NET_ETHERNET. Signed-off-by: David S. Miller commit 70c2efa5a32a7d38e66224844032160317fa7887 Author: Changli Gao Date: Fri Jul 9 15:33:25 2010 +0000 act_nat: not all of the ICMP packets need an IP header payload not all of the ICMP packets need an IP header payload, so we check the length of the skbs only when the packets should have an IP header payload. Based upon analysis and initial patch by Rodrigo Partearroyo González. Signed-off-by: Changli Gao Acked-by: Herbert Xu ---- net/sched/act_nat.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) Signed-off-by: David S. Miller commit ff3f011cd859072b5d6e64c0b968cff9bfdc0b37 Author: Alex Deucher Date: Sat Mar 6 09:43:41 2010 -0500 drm/radeon/kms: fix legacy tv-out pal mode fixes fdo bug 26915 Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit c4363d6acd8d2ec9156f6469c742351e5d122489 Merge: 17c9929 f803696 Author: David S. Miller Date: Mon Jul 12 15:17:29 2010 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit e372357ba55ae89307af15cd680467d8f0db4f01 Author: Dan Carpenter Date: Sat Jul 10 16:33:36 2010 +0200 ocfs2: tighten up strlen() checking This function is only called from one place and it's like this: dlm_register_domain(conn->cc_name, dlm_key, &fs_version); The "conn->cc_name" is 64 characters long. If strlen(conn->cc_name) were equal to O2NM_MAX_NAME_LEN (64) that would be a bug because strlen() doesn't count the NULL character. In fact, if you look how O2NM_MAX_NAME_LEN is used, it mostly describes 64 character buffers. The only exception is nd_name from struct o2nm_node. Anyway I looked into it and in this case the domain string comes from osb->uuid_str in ocfs2_setup_osb_uuid(). That's 32 characters and NULL which easily fits into O2NM_MAX_NAME_LEN. This patch doesn't change how the code works, but I think it makes the code a little cleaner. Signed-off-by: Dan Carpenter Signed-off-by: Joel Becker commit 121a39bb00b421211f4f590c440a8f636d3ae807 Author: Tao Ma Date: Fri Jul 9 14:53:12 2010 +0800 ocfs2: Make xattr reflink work with new local alloc reservation. The new reservation code in local alloc has add the limitation that the caller should handle the case that the local alloc doesn't give use enough contiguous clusters. It make the old xattr reflink code broken. So this patch udpate the xattr reflink code so that it can handle the case that local alloc give us one cluster at a time. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit a78f9f4668949a6588b8872f162e86685c63d023 Author: Tao Ma Date: Fri Jul 9 14:53:11 2010 +0800 ocfs2: make xattr extension work with new local alloc reservation. The old ocfs2_xattr_extent_allocation is too optimistic about the clusters we can get. So actually if the file system is too fragmented, ocfs2_add_clusters_in_btree will return us with EGAIN and we need to allocate clusters once again. So this patch change it to a while loop so that we can allocate clusters until we reach clusters_to_add. Signed-off-by: Tao Ma Signed-off-by: Joel Becker Cc: stable@kernel.org commit 0a463b74e7e6856b24e613de2b85237c6e11890b Author: Tao Ma Date: Thu Jul 8 11:11:11 2010 +0800 ocfs2: Remove the redundant cpu_to_le64. In ocfs2_block_group_alloc, we set c_blkno by bg->bg_blkno. But actually bg->bg_blkno is already changed to little endian in ocfs2_block_group_fill. So remove the extra cpu_to_le64. Reported-by: Marcos Matsunaga Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit f471c9df922a80ca9af1d9a490b4aab3f990ec19 Author: Wengang Wang Date: Wed Jun 30 20:23:30 2010 +0800 ocfs2/dlm: don't access beyond bitmap size dlm->recovery_map is defined as unsigned long recovery_map[BITS_TO_LONGS(O2NM_MAX_NODES)]; We should treat O2NM_MAX_NODES as the bit map size in bits. This patches fixes a bit operation that takes O2NM_MAX_NODES + 1 as bitmap size. Signed-off-by: Wengang Wang Signed-off-by: Joel Becker commit 693c241a5f6aa01417f5f4caf9f82e60e316398d Author: Joel Becker Date: Fri Jul 2 17:20:27 2010 -0700 ocfs2: No need to zero pages past i_size. When ocfs2 fills a hole, it does so by allocating clusters. When a cluster is larger than the write, ocfs2 must zero the portions of the cluster outside of the write. If the clustersize is smaller than a pagecache page, this is handled by the normal pagecache mechanisms, but when the clustersize is larger than a page, ocfs2's write code will zero the pages adjacent to the write. This makes sure the entire cluster is zeroed correctly. Currently ocfs2 behaves exactly the same when writing past i_size. However, this means ocfs2 is writing zeroed pages for portions of a new cluster that are beyond i_size. The page writeback code isn't expecting this. It treats all pages past the one containing i_size as left behind due to a previous truncate operation. Thankfully, ocfs2 calculates the number of pages it will be working on up front. The rest of the write code merely honors the original calculation. We can simply trim the number of pages to only cover the actual file data. Signed-off-by: Joel Becker Cc: stable@kernel.org commit d8495378e25b3ffd40d7a78effba2566f1fe65cf Author: Russell King Date: Mon Jul 12 21:10:16 2010 +0100 ARM: Update mach-types Signed-off-by: Russell King commit 91546356d0e550fa23abf7f4b04a903c2855761f Author: Xiao Guangrong Date: Wed Jun 30 16:04:06 2010 +0800 KVM: MMU: flush remote tlbs when overwriting spte with different pfn After remove a rmap, we should flush all vcpu's tlb Signed-off-by: Xiao Guangrong Signed-off-by: Marcelo Tosatti commit 17c99297212a2d1b1779a08caf4b0d83a85545df Author: Francois Romieu Date: Sun Jul 11 17:10:09 2010 -0700 r8169: incorrect identifier for a 8168dp Merge error. See CFG_METHOD_8 (0x3c800000 + 0x00300000) since version 8.002.00 of Realtek's driver. Signed-off-by: Francois Romieu Cc: Hayes Signed-off-by: David S. Miller commit 77154a2026ee5cb2ce05a7d370c16e4c123028e5 Author: Matthew McClintock Date: Tue Jun 29 14:42:07 2010 -0500 powerpc/fsl-booke: Fix address issue when using relocatable kernels When booting a relocatable kernel it needs to jump to the correct start address, which for BookE parts is usually unchanged regardless of the physical memory offset. Recent changes cause problems with how we calculate the start address, it was always adding the RMO into the start address which is incorrect. This patch only adds in the RMO offset if we are in the kexec code path, as it needs the RMO to work correctly. Instead of adding the RMO offset in in the common code path, we can just set r6 to the RMO offset in the kexec code path instead of to zero, and finally perform the masking in the common code path Signed-off-by: Matthew McClintock Signed-off-by: Kumar Gala commit af71bcfeaaaad92147922282341d394093a4fc9b Author: Anton Vorontsov Date: Thu Jul 8 21:16:16 2010 +0400 powerpc/cpm1: Mark micropatch code/data static and __init This saves runtime memory and fixes lots of sparse warnings like this: CHECK arch/powerpc/sysdev/micropatch.c arch/powerpc/sysdev/micropatch.c:27:6: warning: symbol 'patch_2000' was not declared. Should it be static? arch/powerpc/sysdev/micropatch.c:146:6: warning: symbol 'patch_2f00' was not declared. Should it be static? ... Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala commit 2069a6ae19a34d96cc9cb284eb645b165138e03f Author: Anton Vorontsov Date: Thu Jul 8 21:16:14 2010 +0400 powerpc/cpm1: Fix build with various CONFIG_*_UCODE_PATCH combinations Warnings are treated as errors for arch/powerpc code, so build fails with CONFIG_I2C_SPI_UCODE_PATCH=y: CC arch/powerpc/sysdev/micropatch.o cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': arch/powerpc/sysdev/micropatch.c:630: warning: unused variable 'smp' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 And with CONFIG_USB_SOF_UCODE_PATCH=y: CC arch/powerpc/sysdev/micropatch.o cc1: warnings being treated as errors arch/powerpc/sysdev/micropatch.c: In function 'cpm_load_patch': arch/powerpc/sysdev/micropatch.c:629: warning: unused variable 'spp' arch/powerpc/sysdev/micropatch.c:628: warning: unused variable 'iip' make[1]: *** [arch/powerpc/sysdev/micropatch.o] Error 1 This patch fixes these issues by introducing proper #ifdefs. Cc: [ .33, .34 ] Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala commit 56825c88ff438f4dbb51a44591cc29e707fe783a Author: Anton Vorontsov Date: Thu Jul 8 21:16:10 2010 +0400 powerpc/cpm: Reintroduce global spi_pram struct (fixes build issue) spi_t was removed in commit 644b2a680ccc51a9ec4d6beb12e9d47d2dee98e2 ("powerpc/cpm: Remove SPI defines and spi structs"), the commit assumed that spi_t isn't used anywhere outside of the spi_mpc8xxx driver. But it appears that the struct is needed for micropatch code. So, let's reintroduce the struct. Fixes the following build issue: CC arch/powerpc/sysdev/micropatch.o micropatch.c: In function 'cpm_load_patch': micropatch.c:629: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token micropatch.c:629: error: 'spp' undeclared (first use in this function) micropatch.c:629: error: (Each undeclared identifier is reported only once micropatch.c:629: error: for each function it appears in.) Reported-by: LEROY Christophe Reported-by: Tony Breeds Cc: [ .33, .34 ] Signed-off-by: Anton Vorontsov Signed-off-by: Kumar Gala commit ac78884e6d89714d18b32b5b7d574116ecfb7c88 Author: Russell King Date: Sat Jul 10 10:10:18 2010 +0100 ARM: lockdep: fix unannotated irqs-on CPU: Testing write buffer coherency: ok ------------[ cut here ]------------ WARNING: at kernel/lockdep.c:3145 check_flags+0xcc/0x1dc() Modules linked in: [] (unwind_backtrace+0x0/0xf8) from [] (dump_stack+0x20/0x24) [] (dump_stack+0x20/0x24) from [] (warn_slowpath_common+0x58/0x70) [] (warn_slowpath_common+0x58/0x70) from [] (warn_slowpath_null+0x20/0x24) [] (warn_slowpath_null+0x20/0x24) from [] (check_flags+0xcc/0x1dc) [] (check_flags+0xcc/0x1dc) from [] (lock_acquire+0x50/0x140) [] (lock_acquire+0x50/0x140) from [] (_raw_spin_lock+0x50/0x88) [] (_raw_spin_lock+0x50/0x88) from [] (set_task_comm+0x2c/0x60) [] (set_task_comm+0x2c/0x60) from [] (kthreadd+0x30/0x108) [] (kthreadd+0x30/0x108) from [] (kernel_thread_exit+0x0/0x8) ---[ end trace 1b75b31a2719ed1c ]--- possible reason: unannotated irqs-on. irq event stamp: 3 hardirqs last enabled at (2): [] finish_task_switch+0x48/0xb0 hardirqs last disabled at (3): [] ret_slow_syscall+0xc/0x1c softirqs last enabled at (0): [] copy_process+0x394/0xe5c softirqs last disabled at (0): [<(null)>] (null) Fix this by ensuring that the lockdep interrupt state is manipulated in the appropriate places. We essentially treat userspace as an entirely separate environment which isn't relevant to lockdep (lockdep doesn't monitor userspace.) We don't tell lockdep that IRQs will be enabled in that environment. Instead, when creating kernel threads (which is a rare event compared to entering/leaving userspace) we have to update the lockdep state. Do this by starting threads with IRQs disabled, and in the kthread helper, tell lockdep that IRQs are enabled, and enable them. This provides lockdep with a consistent view of the current IRQ state in kernel space. This also revert portions of 0d928b0b616d1c5c5fe76019a87cba171ca91633 which didn't fix the problem. Tested-by: Ming Lei Signed-off-by: Russell King commit f91d3471ccf1ca9a795f46c94b1ded8dd219940c Author: Sage Weil Date: Thu Jul 1 15:18:31 2010 -0700 ceph: fix creation of ipv6 sockets Use the address family from the peer address instead of assuming IPv4. Signed-off-by: Sage Weil commit 39139f64e14684cf2370770deb79d929d27cfd9b Author: Sage Weil Date: Thu Jul 8 09:54:52 2010 -0700 ceph: fix parsing of ipv6 addresses Check for brackets around the ipv6 address to avoid ambiguity with the port number. Signed-off-by: Sage Weil commit 44a54f787c0abcf75a2ed49b8ec8b2b512468f73 Author: Steven Rostedt Date: Fri Jul 9 15:41:44 2010 -0400 tracing: Add alignment to syscall metadata declarations For some reason if we declare a static variable and then assign it later, and the assignment contains a __attribute__((__aligned__(#))), some versions of gcc will ignore it. This caused the syscall meta data to not be compact in its section and caused a kernel oops when the section was being read. The fix for these versions of gcc seems to be to add the aligned attribute to the declaration as well. This fixes the BZ regression: https://bugzilla.kernel.org/show_bug.cgi?id=16353 Reported-by: Zeev Tarantov Tested-by: Zeev Tarantov Acked-by: Frederic Weisbecker LKML-Reference: Signed-off-by: Steven Rostedt commit d9e38040ccf9eb06b9b41c393c512ceb23f51a7f Author: Linus Walleij Date: Wed Jun 23 07:59:48 2010 +0100 ARM: 6184/2: ux500: use neutral PRCMU base The MTU wallclock timing fix-up patch was hardwired to the DB8500 causing a regression. This makes it work on the DB5500 as well. Signed-off-by: Linus Walleij Signed-off-by: Russell King commit 398aa66827155ef52bab58bebd24597d90968929 Author: Will Deacon Date: Thu Jul 8 10:59:16 2010 +0100 ARM: 6212/1: atomic ops: add memory constraints to inline asm Currently, the 32-bit and 64-bit atomic operations on ARM do not include memory constraints in the inline assembly blocks. In the case of barrier-less operations [for example, atomic_add], this means that the compiler may constant fold values which have actually been modified by a call to an atomic operation. This issue can be observed in the atomic64_test routine in /lib/atomic64_test.c: 00000000 : 0: e1a0c00d mov ip, sp 4: e92dd830 push {r4, r5, fp, ip, lr, pc} 8: e24cb004 sub fp, ip, #4 c: e24dd008 sub sp, sp, #8 10: e24b3014 sub r3, fp, #20 14: e30d000d movw r0, #53261 ; 0xd00d 18: e3011337 movw r1, #4919 ; 0x1337 1c: e34c0001 movt r0, #49153 ; 0xc001 20: e34a1aa3 movt r1, #43683 ; 0xaaa3 24: e16300f8 strd r0, [r3, #-8]! 28: e30c0afe movw r0, #51966 ; 0xcafe 2c: e30b1eef movw r1, #48879 ; 0xbeef 30: e34d0eaf movt r0, #57007 ; 0xdeaf 34: e34d1ead movt r1, #57005 ; 0xdead 38: e1b34f9f ldrexd r4, [r3] 3c: e1a34f90 strexd r4, r0, [r3] 40: e3340000 teq r4, #0 44: 1afffffb bne 38 48: e59f0004 ldr r0, [pc, #4] ; 54 4c: e3a0101e mov r1, #30 50: ebfffffe bl 0 <__bug> 54: 00000000 .word 0x00000000 The atomic64_set (0x38-0x44) writes to the atomic64_t, but the compiler doesn't see this, assumes the test condition is always false and generates an unconditional branch to __bug. The rest of the test is optimised away. This patch adds suitable memory constraints to the atomic operations on ARM to ensure that the compiler is informed of the correct data hazards. We have to use the "Qo" constraints to avoid hitting the GCC anomaly described at http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44492 , where the compiler makes assumptions about the writeback in the addressing mode used by the inline assembly. These constraints forbid the use of auto{inc,dec} addressing modes, so it doesn't matter if we don't use the operand exactly once. Cc: stable@kernel.org Reviewed-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit 068de8d1be48a04b92fd97f76bb7e113b7be82a8 Author: Will Deacon Date: Thu Jul 8 10:58:06 2010 +0100 ARM: 6211/1: atomic ops: fix register constraints for atomic64_add_unless The atomic64_add_unless function compares an atomic variable with a given value and, if they are not equal, adds another given value to the atomic variable. The function returns zero if the addition did not occur and non-zero otherwise. On ARM, the return value is initialised to 1 in C code. Inline assembly code then performs the atomic64_add_unless operation, setting the return value to 0 iff the addition does not occur. This means that when the addition *does* occur, the value of ret must be preserved across the inline assembly and therefore requires a "+r" constraint rather than the current one of "=&r". Thanks to Nicolas Pitre for helping to spot this. Cc: stable@kernel.org Reviewed-by: Nicolas Pitre Signed-off-by: Will Deacon Signed-off-by: Russell King commit 4082cfa77680a70e407efdfb207c743107bd8fe4 Author: Sascha Hauer Date: Thu Jul 8 08:36:21 2010 +0100 ARM: 6210/1: Do not rely on reset defaults of L2X0_AUX_CTRL On i.MX35 the L2X0_AUX_CTRL register does not have sensible reset default values. Allow them to be overwritten with the aux_val/aux_mask arguments passed to l2x0_init(). Signed-off-by: Sascha Hauer Acked-by: Catalin Marinas Signed-off-by: Russell King commit 635f081541edef7644073f9be50ee5bf7c57ce63 Author: Rémi Denis-Courmont Date: Wed Jul 7 20:56:53 2010 +0000 Phonet: fix skb leak in pipe endpoint accept() Signed-off-by: Rémi Denis-Courmont Signed-off-by: David S. Miller commit d06dbaf6c2c7187938f3f6745d9e4938a2d0ec47 Author: Sage Weil Date: Thu Jul 8 10:47:16 2010 -0700 ceph: fix printing of ipv6 addrs The buffer was too small. Make it bigger, use snprintf(), put brackets around the ipv6 address to avoid mixing it up with the :port, and use the ever-so-handy %pI[46] formats. Signed-off-by: Sage Weil commit 045309820afe047920a50de25634dab46a1e851d Author: Ville Tervo Date: Tue Jun 15 15:56:05 2010 +0300 Bluetooth: Update sec_level/auth_type for already existing connections Update auth level for already existing connections if it is lower than required by new connection. Signed-off-by: Ville Tervo Reviewed-by: Emeltchenko Andrei Signed-off-by: Luciano Coelho Signed-off-by: Andrei Emeltchenko Signed-off-by: Marcel Holtmann commit da213f41cdd445d3df468f8fe7f24fe4f4c48508 Author: Johan Hedberg Date: Fri Jun 18 11:08:56 2010 +0300 Bluetooth: Reset the security level after an authentication failure When authentication fails for a connection the assumed security level should be set back to BT_SECURITY_LOW so that subsequent connect attempts over the same link don't falsely assume that security is adequate enough. Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann commit e501d0553a7580fcc6654d7f58a5f061d31d00af Author: Andrei Emeltchenko Date: Thu Jul 8 12:14:41 2010 +0300 Bluetooth: Check L2CAP pending status before sending connect request Due to race condition in L2CAP state machine L2CAP Connection Request may be sent twice for SDP with the same source channel id. Problems reported connecting to Apple products, some carkit, Blackberry phones. ... 2010-06-07 21:18:03.651031 < ACL data: handle 1 flags 0x02 dlen 12 L2CAP(s): Connect req: psm 1 scid 0x0040 2010-06-07 21:18:03.653473 > HCI Event: Number of Completed Packets (0x13) plen 5 handle 1 packets 1 2010-06-07 21:18:03.653808 > HCI Event: Auth Complete (0x06) plen 3 status 0x00 handle 1 2010-06-07 21:18:03.653869 < ACL data: handle 1 flags 0x02 dlen 12 L2CAP(s): Connect req: psm 1 scid 0x0040 ... Patch uses L2CAP_CONF_CONNECT_PEND flag to mark that L2CAP Connection Request has been sent already. Modified version of patch from Ville Tervo. Signed-off-by: Andrei Emeltchenko Signed-off-by: Marcel Holtmann commit 5693486bad2bc2ac585a2c24f7e2f3964b478df9 Author: Joel Becker Date: Thu Jul 1 15:13:31 2010 -0700 ocfs2: Zero the tail cluster when extending past i_size. ocfs2's allocation unit is the cluster. This can be larger than a block or even a memory page. This means that a file may have many blocks in its last extent that are beyond the block containing i_size. There also may be more unwritten extents after that. When ocfs2 grows a file, it zeros the entire cluster in order to ensure future i_size growth will see cleared blocks. Unfortunately, block_write_full_page() drops the pages past i_size. This means that ocfs2 is actually leaking garbage data into the tail end of that last cluster. This is a bug. We adjust ocfs2_write_begin_nolock() and ocfs2_extend_file() to detect when a write or truncate is past i_size. They will use ocfs2_zero_extend() to ensure the data is properly zeroed. Older versions of ocfs2_zero_extend() simply zeroed every block between i_size and the zeroing position. This presumes three things: 1) There is allocation for all of these blocks. 2) The extents are not unwritten. 3) The extents are not refcounted. (1) and (2) hold true for non-sparse filesystems, which used to be the only users of ocfs2_zero_extend(). (3) is another bug. Since we're now using ocfs2_zero_extend() for sparse filesystems as well, we teach ocfs2_zero_extend() to check every extent between i_size and the zeroing position. If the extent is unwritten, it is ignored. If it is refcounted, it is CoWed. Then it is zeroed. Signed-off-by: Joel Becker Cc: stable@kernel.org commit a4bfb4cf11fd2211b788af59dc8a8b4394bca227 Author: Joel Becker Date: Tue Jul 6 14:36:06 2010 -0700 ocfs2: When zero extending, do it by page. ocfs2_zero_extend() does its zeroing block by block, but it calls a function named ocfs2_write_zero_page(). Let's have ocfs2_write_zero_page() handle the page level. From ocfs2_zero_extend()'s perspective, it is now page-at-a-time. Signed-off-by: Joel Becker Cc: stable@kernel.org commit b0bbb0be8f7fbf6d366b359e034c78a96c4e274d Author: Dan Carpenter Date: Thu Jul 8 14:49:38 2010 +0200 ceph: add kfree() to error path We leak a "pi" on this error path. Signed-off-by: Dan Carpenter Signed-off-by: Sage Weil commit 108553e1f3c45a92d23681a378ad9e4c3230eebc Author: Frederic Weisbecker Date: Thu Jul 8 03:41:46 2010 +0200 perf: Sync callchains with period based hits Hists have their hits increased by the event period. And this period based counting is the foundation of all the stats in perf report. But callchains still use the raw number of hits, without taking the period into account. So when we compute the percentage, absolute based percentages are totally broken, and relative ones too in the first parent level. Because we pass the number of events muliplied by their period as the total number of hits to the callchain filtering, while callchains expect this number to be the number of raw hits. perf report -g graph was simply not working, showing no graph unless the min percent was zero. And even there the percentage of the branches was always 0. And may be fractal filtering was broken on the first branch level too. flat also was broken, but it was hidden because of other breakages. Anyway fix this by counting using periods on callchains. Signed-off-by: Frederic Weisbecker Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras commit 97aa1052739c6a06cb6b0467dbf410613d20bc97 Author: Frederic Weisbecker Date: Thu Jul 8 06:06:17 2010 +0200 perf: Resurrect flat callchains Initialize the callchain radix tree root correctly. When we walk through the parents, we must stop after the root, but since it wasn't well initialized, its parent pointer was random. Also the number of hits was random because uninitialized, hence it was part of the callchain while the root doesn't contain anything. This fixes segfaults and percentages followed by empty callchains while running: perf report -g flat Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Paul Mackerras Cc: 2.6.31.x-2.6.34.x commit 5cdfa1c3bbabb809ef3134f741a63e13373a8cad Author: Feng Tang Date: Wed Jul 7 13:02:16 2010 -0700 input: i8042 - add runtime check in x86's i8042_platform_init Then it will first check x86_platforms's i8042 detection result, then go on with normal probe. Signed-off-by: Feng Tang LKML-Reference: <4c34dd482753bb8f1@agluck-desktop.sc.intel.com> Signed-off-by: Tony Luck Acked-by: Dmitry Torokhov Signed-off-by: H. Peter Anvin commit c9d46f63f8e89fd70f97b83fdc4e5d2e37d92aeb Author: Feng Tang Date: Mon Jul 5 23:03:21 2010 +0800 Revert "Input: fixup X86_MRST selects" This reverts commit 0b28bac5aef7bd1ab213723df031e61db9ff151a. After adding x86_platform's detection for i8042 controller, we don't need the force dependency on !X86_MRST any more Cc: Randy Dunlap Signed-off-by: Feng Tang LKML-Reference: <1278342202-10973-5-git-send-email-feng.tang@intel.com> Acked-by: Dmitry Torokhov Signed-off-by: H. Peter Anvin commit 44631ac64d06d2f7ce006c2a6f2c8e003a9c6ace Author: Feng Tang Date: Mon Jul 5 23:03:20 2010 +0800 Revert "Input: do not force selecting i8042 on Moorestown" This reverts commit 685afae02557a178185a4be36f58332976e79f63. After adding x86_platform's detection for i8042 controller, we don't need the force dependency on !X86_MRST any more Cc: Jacob Pan Signed-off-by: Feng Tang LKML-Reference: <1278342202-10973-4-git-send-email-feng.tang@intel.com> Acked-by: Dmitry Torokhov Signed-off-by: H. Peter Anvin commit 6d2cce62017efe957e34cfcbba23861b7671980b Author: Feng Tang Date: Mon Jul 5 23:03:19 2010 +0800 x86, mrst: Add i8042_detect API for Moorestwon platform It will just return 0 as there is no i8042 controller Signed-off-by: Feng Tang LKML-Reference: <1278342202-10973-3-git-send-email-feng.tang@intel.com> Acked-by: Dmitry Torokhov Signed-off-by: H. Peter Anvin commit c516ac583973196162b1ba7e4d597d6f6892dac0 Author: Feng Tang Date: Mon Jul 5 23:03:18 2010 +0800 x86: Add i8042 pre-detection hook to x86_platform_ops Some x86 platforms like Intel MID platforms don't have i8042 controllers, and i8042 driver's probe to some legacy IO ports may hang the MID processor. With this hook, i8042 driver can runtime check and skip the probe when the pretection fail which also saves some probe time [ hpa note: this is currently a compile-time check, which breaks the i386 allyesconfig build. This patch series thus does fix a regression. ] Signed-off-by: Feng Tang LKML-Reference: <1278342202-10973-2-git-send-email-feng.tang@intel.com> Acked-by: Dmitry Torokhov Signed-off-by: H. Peter Anvin commit 72550b3ae545c75897c769d43d62d4be3f3d48fe Author: H. Peter Anvin Date: Wed Jul 7 16:57:46 2010 -0700 x86, platform: Export x86_platform to modules Export x86_platform to modules in preparation of using it for i8042 discovery control. Signed-off-by: H. Peter Anvin LKML-Reference: <1278342202-10973-1-git-send-email-feng.tang@intel.com> Cc: Thomas Gleixner Cc: Feng Tang Cc: Dmitry Torokhov commit f8036965ccec4d786d8bf09bf57b793542cb3dce Author: Rajkumar Manoharan Date: Wed Jul 7 15:19:18 2010 +0530 ath9k_htc: fix memory leak in ath9k_hif_usb_alloc_urbs Failure cases within ath9k_hif_usb_alloc_urbs are failed to release allocated memory. Signed-off-by: Rajkumar Manoharan Signed-off-by: John W. Linville commit da38f43859467a8048365b9e1cce99ccbc62b6e2 Author: Avi Kivity Date: Tue Jul 6 11:30:49 2010 +0300 KVM: VMX: Fix host MSR_KERNEL_GS_BASE corruption enter_lmode() and exit_lmode() modify the guest's EFER.LMA before calling vmx_set_efer(). However, the latter function depends on the value of EFER.LMA to determine whether MSR_KERNEL_GS_BASE needs reloading, via vmx_load_host_state(). With EFER.LMA changing under its feet, it took the wrong choice and corrupted userspace's %gs. This causes 32-on-64 host userspace to fault. Fix not touching EFER.LMA; instead ask vmx_set_efer() to change it. Signed-off-by: Avi Kivity commit 22b1de06c9fe128ca3de72560c3e8c2cabf2927a Author: Sage Weil Date: Mon Jul 5 15:36:49 2010 -0700 ceph: fix leak of mon authorizer Fix leak of a struct ceph_buffer on umount. Signed-off-by: Sage Weil commit ed98adad3d87594c55347824e85137d1829c9e70 Author: Sage Weil Date: Mon Jul 5 12:15:14 2010 -0700 ceph: fix message revocation A message can be on a queue (pending or sent), or out_msg (sending), or both. We were assuming that if it's not on a queue it couldn't be out_msg, but that was false in the case of lossy connections like the OSD. Fix ceph_con_revoke() to treat these cases independently. Also, fix the out_kvec_is_message check to only trigger if we are currently sending _this_ message. This fixes a GPF in tcp_sendpage, triggered by OSD restarts. Signed-off-by: Sage Weil commit 869599ceda4a035cdb3345c563b74cdeef10f790 Author: Thavidu Ranatunga Date: Mon Jul 5 18:00:15 2010 +1000 perf: Version String fix, for fallback if not from git This gets rid of the default version fallback for Perf and changes it so that it returns the version of the kernel from it's Makefile (if sources were not from git, ie. if it was downloaded from a tarball) Signed-off-by: Thavidu Ranatunga Acked-by: Ian Munsie Acked-by: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo LKML-Reference: <1278316815-6099-2-git-send-email-tharan@au1.ibm.com> Signed-off-by: Ingo Molnar commit 2190de2f59b3a371f7a5bf8dcc7a0c3f71723679 Author: Thavidu Ranatunga Date: Mon Jul 5 18:00:14 2010 +1000 perf: Version String fix, using kernel version Changes the Perf --version string such that it shows the kernel version as suggested by Ingo as follows: That way the perf that comes with v2.6.34 will be: perf version v2.6.34 while interim versions will have the version of the interim kernel - for example: perf version v2.6.35-rc4-70-g39ef13a This functionality was already in the perf version generator file except that it was looking for a .git in the perf directory instead of the kernel directory. Signed-off-by: Thavidu Ranatunga Acked-by: Ian Munsie Acked-by: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo LKML-Reference: <1278316815-6099-1-git-send-email-tharan@au1.ibm.com> Signed-off-by: Ingo Molnar commit e4c064728ca358622918fa69ab2bb05f5a2090a8 Author: Reinette Chatre Date: Mon Jun 21 14:23:47 2010 -0700 iwlwifi: remove key information during device restart When there is a firmware error or the firmware is reloaded for some other reason we currently clear all station information, including keys associated with them. A problem is that we do not clear some other information regarding keys that are not stored in the station structs. The consequence of this is that when the device is reconfigured after the firmware reload we can, among other things, run out of key indices. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=16232 http://bugzilla.intellinuxwireless.org/show_bug.cgi?id=2221 Signed-off-by: Reinette Chatre Reviewed-by: Johannes Berg commit c59690fa484c04ab96fe932241b569a09755a4d2 Author: Feng Tang Date: Wed Jun 30 00:53:53 2010 -0700 Input: i8042 - mark stubs in i8042.h "static inline" Otherwise we may run into following: drivers/platform/built-in.o: In function `i8042_lock_chip': /home/test/ws2/projects/linux-2.6/include/linux/i8042.h:50: multiple definition of `i8042_lock_chip' drivers/input/serio/built-in.o:/home/test/ws2/projects/linux-2.6/include/linux/i8042.h:50: first defined here ... make[1]: *** [drivers/built-in.o] Error 1 make: *** [drivers] Error 2 Signed-off-by: Feng Tang Signed-off-by: Dmitry Torokhov commit 2716fbf63ee39eadc1aa9b3841b20f75b99a9bc3 Author: Jiri Slaby Date: Wed Jun 23 20:01:45 2010 +1000 crypto: skcipher - avoid NULL dereference Stanse found a potential NULL dereference in ablkcipher_next_slow. Even though kmalloc fails, its retval is dereferenced later. Return from that function properly earlier. Signed-off-by: Jiri Slaby Acked-by: David S. Miller Signed-off-by: Herbert Xu commit 2d31757c87a741823f77daaa07eeb8d56be63943 Author: Ryan Mallon Date: Tue Jun 15 12:44:59 2010 +1200 ds2782_battery: Fix ds2782_get_capacity return value The ds2782_get_capacity function should return 0 on success, not the capacity value. Signed-off-by: Ryan Mallon Signed-off-by: Anton Vorontsov commit 1739da40543ed2129050ccfa8a076a851ab6ed00 Author: Tao Ma Date: Wed Jun 9 16:43:05 2010 +0800 ocfs2: Limit default local alloc size within bitmap range. In commit 6b82021b9e91cd689fdffadbcdb9a42597bbe764, we increase our local alloc size and calculate how much megabytes we can get according to group size and volume size. But we also need to check the maximum bits a local alloc block bitmap can have. With a bs=512, cs=32K, local volume with 160G, it calculate 96MB while the maximum local alloc size is only 76M. So the bitmap will overflow and corrupt the system truncate log file. See bug http://oss.oracle.com/bugzilla/show_bug.cgi?id=1262 Signed-off-by: Tao Ma Acked-by: Mark Fasheh Signed-off-by: Joel Becker commit 40f165f416bde747d85cdf71bc9dde700912f71f Author: Tao Ma Date: Fri May 28 14:22:59 2010 +0800 ocfs2: Move orphan scan work to ocfs2_wq. We used to let orphan scan work in the default work queue, but there is a corner case which will make the system deadlock. The scenario is like this: 1. set heartbeat threadshold to 200. this will allow us to have a great chance to have a orphan scan work before our quorum decision. 2. mount node 1. 3. after 1~2 minutes, mount node 2(in order to make the bug easier to reproduce, better add maxcpus=1 to kernel command line). 4. node 1 do orphan scan work. 5. node 2 do orphan scan work. 6. node 1 do orphan scan work. After this, node 1 hold the orphan scan lock while node 2 know node 1 is the master. 7. ifdown eth2 in node 2(eth2 is what we do ocfs2 interconnection). Now when node 2 begins orphan scan, the system queue is blocked. The root cause is that both orphan scan work and quorum decision work will use the system event work queue. orphan scan has a chance of blocking the event work queue(in dlm_wait_for_node_death) so that there is no chance for quorum decision work to proceed. This patch resolve it by moving orphan scan work to ocfs2_wq. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 6469272c350872980891dbe38e81c936c43f2d9b Author: Julia Lawall Date: Wed May 26 17:58:53 2010 +0200 fs/ocfs2/dlm: Add missing spin_unlock Add a spin_unlock missing on the error path. Unlock as in the other code that leads to the leave label. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression E1; @@ * spin_lock(E1,...); <+... when != E1 if (...) { ... when != E1 * return ...; } ...+> * spin_unlock(E1,...); // Signed-off-by: Julia Lawall Signed-off-by: Joel Becker