commit 81cfe79b9c577139a873483654640eb3f6e78c39 Author: Linus Torvalds Date: Wed Sep 19 16:01:13 2007 -0700 Linux 2.6.23-rc7 commit 31e879309474d1666d645b96de99d0b682fa055f Author: Eric Paris Date: Wed Sep 19 17:19:12 2007 -0400 SELinux: fix array out of bounds when mounting with selinux options Given an illegal selinux option it was possible for match_token to work in random memory at the end of the match_table_t array. Note that privilege is required to perform a context mount, so this issue is effectively limited to root only. Signed-off-by: Eric Paris Acked-by: Stephen Smalley Signed-off-by: James Morris commit 9c95e7319ba98585ebb6d304eca2d56f401ed70c Author: Hiroshi Shimamoto Date: Wed Sep 19 23:34:46 2007 +0200 sched: fix invalid sched_class use When using rt_mutex, a NULL pointer dereference is occurred at enqueue_task_rt. Here is a scenario; 1) there are two threads, the thread A is fair_sched_class and thread B is rt_sched_class. 2) Thread A is boosted up to rt_sched_class, because the thread A has a rt_mutex lock and the thread B is waiting the lock. 3) At this time, when thread A create a new thread C, the thread C has a rt_sched_class. 4) When doing wake_up_new_task() for the thread C, the priority of the thread C is out of the RT priority range, because the normal priority of thread A is not the RT priority. It makes data corruption by overflowing the rt_prio_array. The new thread C should be fair_sched_class. The new thread should be valid scheduler class before queuing. This patch fixes to set the suitable scheduler class. Signed-off-by: Hiroshi Shimamoto Signed-off-by: Ingo Molnar Signed-off-by: Peter Zijlstra commit 1799e35d5baab6e06168b46cc78b968e728ea3d1 Author: Ingo Molnar Date: Wed Sep 19 23:34:46 2007 +0200 sched: add /proc/sys/kernel/sched_compat_yield add /proc/sys/kernel/sched_compat_yield to make sys_sched_yield() more agressive, by moving the yielding task to the last position in the rbtree. with sched_compat_yield=0: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2539 mingo 20 0 1576 252 204 R 50 0.0 0:02.03 loop_yield 2541 mingo 20 0 1576 244 196 R 50 0.0 0:02.05 loop with sched_compat_yield=1: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 2584 mingo 20 0 1576 248 196 R 99 0.0 0:52.45 loop 2582 mingo 20 0 1576 256 204 R 0 0.0 0:00.00 loop_yield Signed-off-by: Ingo Molnar Signed-off-by: Peter Zijlstra commit dbe3ed1c078c193be34326728d494c5c4bc115e2 Author: Linus Torvalds Date: Wed Sep 19 11:37:14 2007 -0700 x86-64: page faults from user mode are always user faults Randy Dunlap noticed an interesting "crashme" behaviour on his dual Prescott Xeon setup, where he gets page faults with the error code having a zero "user" bit, but the register state points back to user mode. This may be a CPU microcode buglet triggered by some strange instruction pattern that crashme generates, and loading a microcode update seems to possibly have fixed it. Regardless, we really should trust the register state more than the error code, since it's really the register state that determines whether we can actually send a signal, or whether we're in kernel mode and need to oops/kill the process in the case of a page fault. Cc: Randy Dunlap Signed-off-by: Linus Torvalds commit 09abbcffb3ee63fb8712c008df0c6878860777b7 Author: Maciej W. Rozycki Date: Mon Sep 17 17:11:07 2007 +0100 [MIPS] cpu-bugs64.c: GCC 3.3 constraint workaround Add a workaround to address warnings generated on the "n" constraint by GCC 3.3 and below. Signed-off-by: Maciej W. Rozycki Signed-off-by: Ralf Baechle commit 68835999435e01311ab57f5556169ad2966b6828 Author: Maciej W. Rozycki Date: Mon Sep 17 16:58:18 2007 +0100 [MIPS] DEC: Initialise ioasic_ssr_lock Fix the definition of the ioasic_ssr_lock spinlock to include a proper initialisation. Signed-off-by: Maciej W. Rozycki Signed-off-by: Ralf Baechle commit 4f01a757e75f2a3cab2bab89c4176498963946b9 Author: Dmitry Torokhov Date: Tue Sep 18 22:46:50 2007 -0700 Driver core: fix deprectated sysfs structure for nested class devices Nested class devices used to have 'device' symlink point to a real (physical) device instead of a parent class device. When converting subsystems to struct device we need to keep doing what class devices did if CONFIG_SYSFS_DEPRECATED is Y, otherwise parts of udev break. Signed-off-by: Dmitry Torokhov Cc: Kay Sievers Acked-by: Greg KH Tested-by: Anssi Hannula Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 508a92741a105e2e3d466cd727fb73154ebf08de Author: Jeff Dike Date: Tue Sep 18 22:46:49 2007 -0700 uml: fix irqstack crash This patch fixes a crash caused by an interrupt coming in when an IRQ stack is being torn down. When this happens, handle_signal will loop, setting up the IRQ stack again because the tearing down had finished, and handling whatever signals had come in. However, to_irq_stack returns a mask of pending signals to be handled, plus bit zero is set if the IRQ stack was already active, and thus shouldn't be torn down. This causes a problem because when handle_signal goes around the loop, sig will be zero, and to_irq_stack will duly set bit zero in the returned mask, faking handle_signal into believing that it shouldn't tear down the IRQ stack and return thread_info pointers back to their original values. This will eventually cause a crash, as the IRQ stack thread_info will continue pointing to the original task_struct and an interrupt will look into it after it has been freed. The fix is to stop passing a signal number into to_irq_stack. Rather, the pending signals mask is initialized beforehand with the bit for sig already set. References to sig in to_irq_stack can be replaced with references to the mask. [akpm@linux-foundation.org: use UL] Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 480eccf9ae1073b87bb4fe118971fbf134a5bc61 Author: Lee Schermerhorn Date: Tue Sep 18 22:46:47 2007 -0700 Fix NUMA Memory Policy Reference Counting This patch proposes fixes to the reference counting of memory policy in the page allocation paths and in show_numa_map(). Extracted from my "Memory Policy Cleanups and Enhancements" series as stand-alone. Shared policy lookup [shmem] has always added a reference to the policy, but this was never unrefed after page allocation or after formatting the numa map data. Default system policy should not require additional ref counting, nor should the current task's task policy. However, show_numa_map() calls get_vma_policy() to examine what may be [likely is] another task's policy. The latter case needs protection against freeing of the policy. This patch adds a reference count to a mempolicy returned by get_vma_policy() when the policy is a vma policy or another task's mempolicy. Again, shared policy is already reference counted on lookup. A matching "unref" [__mpol_free()] is performed in alloc_page_vma() for shared and vma policies, and in show_numa_map() for shared and another task's mempolicy. We can call __mpol_free() directly, saving an admittedly inexpensive inline NULL test, because we know we have a non-NULL policy. Handling policy ref counts for hugepages is a bit trickier. huge_zonelist() returns a zone list that might come from a shared or vma 'BIND policy. In this case, we should hold the reference until after the huge page allocation in dequeue_hugepage(). The patch modifies huge_zonelist() to return a pointer to the mempolicy if it needs to be unref'd after allocation. Kernel Build [16cpu, 32GB, ia64] - average of 10 runs: w/o patch w/ refcount patch Avg Std Devn Avg Std Devn Real: 100.59 0.38 100.63 0.43 User: 1209.60 0.37 1209.91 0.31 System: 81.52 0.42 81.64 0.34 Signed-off-by: Lee Schermerhorn Acked-by: Andi Kleen Cc: Christoph Lameter Acked-by: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28f300d23674fa01ae747c66ce861d4ee6aebe8c Author: Pavel Emelyanov Date: Tue Sep 18 22:46:45 2007 -0700 Fix user namespace exiting OOPs It turned out, that the user namespace is released during the do_exit() in exit_task_namespaces(), but the struct user_struct is released only during the put_task_struct(), i.e. MUCH later. On debug kernels with poisoned slabs this will cause the oops in uid_hash_remove() because the head of the chain, which resides inside the struct user_namespace, will be already freed and poisoned. Since the uid hash itself is required only when someone can search it, i.e. when the namespace is alive, we can safely unhash all the user_struct-s from it during the namespace exiting. The subsequent free_uid() will complete the user_struct destruction. For example simple program #include char stack[2 * 1024 * 1024]; int f(void *foo) { return 0; } int main(void) { clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0); return 0; } run on kernel with CONFIG_USER_NS turned on will oops the kernel immediately. This was spotted during OpenVZ kernel testing. Signed-off-by: Pavel Emelyanov Signed-off-by: Alexey Dobriyan Acked-by: "Serge E. Hallyn" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 735de2230f09741077a645a913de0a04b10208bf Author: Pavel Emelyanov Date: Tue Sep 18 22:46:44 2007 -0700 Convert uid hash to hlist Surprisingly, but (spotted by Alexey Dobriyan) the uid hash still uses list_heads, thus occupying twice as much place as it could. Convert it to hlist_heads. Signed-off-by: Pavel Emelyanov Signed-off-by: Alexey Dobriyan Acked-by: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d8a4821dca693867a7953104c1e3cc830eb9191f Author: Matthias Kaehlcke Date: Tue Sep 18 22:46:43 2007 -0700 kernel/user.c: Use list_for_each_entry instead of list_for_each kernel/user.c: Convert list_for_each to list_for_each_entry in uid_hash_find() Signed-off-by: Matthias Kaehlcke Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ef2b02d3e617cb0400eedf2668f86215e1b0e6af Author: Eric Sandeen Date: Tue Sep 18 22:46:42 2007 -0700 ext34: ensure do_split leaves enough free space in both blocks The do_split() function for htree dir blocks is intended to split a leaf block to make room for a new entry. It sorts the entries in the original block by hash value, then moves the last half of the entries to the new block - without accounting for how much space this actually moves. (IOW, it moves half of the entry *count* not half of the entry *space*). If by chance we have both large & small entries, and we move only the smallest entries, and we have a large new entry to insert, we may not have created enough space for it. The patch below stores each record size when calculating the dx_map, and then walks the hash-sorted dx_map, calculating how many entries must be moved to more evenly split the existing entries between the old block and the new block, guaranteeing enough space for the new entry. The dx_map "offs" member is reduced to u16 so that the overall map size does not change - it is temporarily stored at the end of the new block, and if it grows too large it may be overwritten. By making offs and size both u16, we won't grow the map size. Also add a few comments to the functions involved. This fixes the testcase reported by hooanon05@yahoo.co.jp on the linux-ext4 list, "ext3 dir_index causes an error" Thanks to Andreas Dilger for discussing the problem & solution with me. Signed-off-by: Eric Sandeen Signed-off-by: Andreas Dilger Tested-by: Junjiro Okajima Cc: Theodore Ts'o Cc: Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e42601973b1bce1d2987f82159c1ebeaccc6b310 Author: Andrew Morton Date: Tue Sep 18 22:46:41 2007 -0700 disable sys_timerfd() for 2.6.23 There is still some confusion and disagreement over what this interface should actually do. So it is best that we disable it in 2.6.23 until we get that fully sorted out. (sys_timerfd() was present in 2.6.22 but it was apparently broken, so here we assume that nobody is using it yet). Cc: Michael Kerrisk Cc: Davide Libenzi Acked-by: Linus Torvalds Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49af7ee181f4f516ac99eba85d3f70ed42cabe76 Author: Alexey Dobriyan Date: Tue Sep 18 22:46:40 2007 -0700 nfs: fix oops re sysctls and V4 support NFS unregisters sysctls only if V4 support is compiled in. However, sysctl table is not V4 specific, so unregister it always. Steps to reproduce: [build nfs.ko with CONFIG_NFS_V4=n] modrobe nfs rmmod nfs ls /proc/sys Unable to handle kernel paging request at ffffffff880661c0 RIP: [] proc_sys_readdir+0xd3/0x350 PGD 203067 PUD 207063 PMD 7e216067 PTE 0 Oops: 0000 [1] SMP CPU 1 Modules linked in: lockd nfs_acl sunrpc Pid: 3335, comm: ls Not tainted 2.6.23-rc3-bloat #2 RIP: 0010:[] [] proc_sys_readdir+0xd3/0x350 RSP: 0018:ffff81007fd93e78 EFLAGS: 00010286 RAX: ffffffff880661c0 RBX: ffffffff80466370 RCX: ffffffff880661c0 RDX: 00000000000014c0 RSI: ffff81007f3ad020 RDI: ffff81007efd8b40 RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff802a8570 R12: ffffffff880661c0 R13: ffff81007e219640 R14: ffff81007efd8b40 R15: ffff81007ded7280 FS: 00002ba25ef03060(0000) GS:ffff81007ff81258(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: ffffffff880661c0 CR3: 000000007dfaf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ls (pid: 3335, threadinfo ffff81007fd92000, task ffff81007d8a0000) Stack: ffff81007f3ad150 ffffffff80283f30 ffff81007fd93f48 ffff81007efd8b40 ffff81007ee00440 0000000422222222 0000000200035593 ffffffff88037e9a 2222222222222222 ffffffff80466500 ffff81007e416400 ffff81007e219640 Call Trace: [] filldir+0x0/0xf0 [] filldir+0x0/0xf0 [] vfs_readdir+0xa7/0xc0 [] sys_getdents+0x96/0xe0 [] system_call+0x7e/0x83 Code: 41 8b 14 24 85 d2 74 dc 49 8b 44 24 08 48 85 c0 74 e7 49 3b RIP [] proc_sys_readdir+0xd3/0x350 RSP CR2: ffffffff880661c0 Kernel panic - not syncing: Fatal exception Signed-off-by: Alexey Dobriyan Acked-by: Trond Myklebust Cc: "J. Bruce Fields" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d82abae9523c33d4a16fdfdfd2bdde316d7b56a Author: Eric Sandeen Date: Tue Sep 18 22:46:38 2007 -0700 dir_index: error out instead of BUG on corrupt dx dirs Convert asserts (BUGs) in dx_probe from bad on-disk data to recoverable errors with helpful warnings. With help catching other asserts from Duane Griffin Signed-off-by: Eric Sandeen Acked-by: Duane Griffin Acked-by: Theodore Ts'o Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e67aa27a6179c287983c6c525beb5320f5cd1672 Author: Dave Airlie Date: Tue Sep 18 22:46:35 2007 -0700 intel-agp: Fix i830 mask variable that changed with G33 support The mask on i830 should be 0x70 always, later chips 0xF0 should be okay. Signed-off-by: Dave Airlie Acked-by: Zhenyu Wang Cc: Michael Haas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c8bd037e5bd7bbc3c82b74cbed4da1ddc3fe8de Author: Antonino A. Daplas Date: Tue Sep 18 22:46:34 2007 -0700 intelfb: Fix bug in DPLL disable Reported in Kernel Bugzilla 9006 Fix an obvious bug in DPLL disable. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 389a3c02496dd1b399bb0efd005e9fa2be24e9ee Author: Jeremy Fitzhardinge Date: Tue Sep 18 22:46:33 2007 -0700 xen: don't bother trying to set cr4 Xen ignores all updates to cr4, and some versions will kill the domain if you try to change its value. Just ignore all changes. Signed-off-by: Jeremy Fitzhardinge Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 248bdd5efca5a113cbf443a993c69e53d370236b Author: Kees Cook Date: Tue Sep 18 22:46:32 2007 -0700 pci: fix unterminated pci_device_id lists Fix a couple drivers that do not correctly terminate their pci_device_id lists. This results in garbage being spewed into modules.pcimap when the module happens to not have 28 NULL bytes following the table, and/or the last PCI ID is actually truncated from the table when calculating the modules.alias PCI aliases, cause those unfortunate device IDs to not auto-load. Signed-off-by: Kees Cook Acked-by: Corey Minyard Cc: David Woodhouse Acked-by: Jeff Garzik Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4191ba26dae8338892e73f6e67bd18068b4344e9 Author: Cliff Wickman Date: Tue Sep 18 22:46:31 2007 -0700 mspec: handle shrinking virtual memory areas The shrinking of a virtual memory area that is mmap(2)'d to a memory special file (device drivers/char/mspec.c) can cause a panic. If the mapped size of the vma (vm_area_struct) is very large, mspec allocates a large vma_data structure with vmalloc(). But such a vma can be shrunk by an munmap(2). The current driver uses the current size of each vma to deduce whether its vma_data structure was allocated by kmalloc() or vmalloc(). So if the vma was shrunk it appears to have been allocated by kmalloc(), and mspec attempts to free it with kfree(). This results in a panic. This patch avoids the panic (by preserving the type of the allocation) and also makes mspec work correctly as the vma is split into pieces by the munmap(2)'s. All vma's derived from such a split vma share the same vma_data structure that represents all the pages mapped into this set of vma's. The mpec driver must be made capable of using the right portion of the structure for each member vma. In other words, it must index into the array of page addresses using the portion of the array that represents the current vma. This is enabled by storing the vma group's vm_start in the vma_data structure. The shared vma_data's are not protected by mm->mmap_sem in the fork() case so the reference count is left as atomic_t. Signed-off-by: Cliff Wickman Acked-by: Jes Sorensen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49cc886aea1d79cdb0ea409554866238b07fe26f Author: Atsushi Nemoto Date: Tue Sep 18 22:46:30 2007 -0700 rtc: rtc-ds1553.c should use resource_size_t for base address Currently the rtc driver, rtc-ds1552.c uses an unsigned long to store the base mmio address of the NVRAM/RTC. This breaks on 32-bit systems with larger physical addresses. Signed-off-by: Atsushi Nemoto Cc: David Brownell Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2e3e31c05798786c131bf257f64848d4a9a894ab Author: David Gibson Date: Tue Sep 18 22:46:28 2007 -0700 rtc-ds1742.c should use resource_size_t for base address Currently the rtc driver, rtc-ds1742.c uses an unsigned long to store the base mmio address of the NVRAM/RTC. This breaks on systems like PowerPC 440, which is a 32-bit core with 36-bit physical addresses: IO on the system, including the RTC, is typically above the 4GB point, and cannot fit into an unsigned long. This patch fixes the problem by replacing the unsigned long with a resource_size_t. Tested on Ebony (PPC440) (with additional patches to instantiate the ds1742 platform device appropriately). Signed-off-by: David Gibson Acked-by: Atsushi Nemoto Cc: Alessandro Zummo Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit efc63c4fb0f95865907472d1c6bc0cfea9ee156b Author: Alexey Dobriyan Date: Tue Sep 18 22:46:27 2007 -0700 Fix UTS corruption during clone(CLONE_NEWUTS) struct utsname is copied from master one without any exclusion. Here is sample output from one proggie doing sethostname("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"); sethostname("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"); and another clone(,, CLONE_NEWUTS, ...) uname() hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaabbbbb' hostname = 'bbbaaaaaaaaaaaaaaaaaaaaaaaaaaa' hostname = 'aaaaaaaabbbbbbbbbbbbbbbbbbbbbb' hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaabbbb' hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaabb' hostname = 'aaabbbbbbbbbbbbbbbbbbbbbbbbbbb' hostname = 'bbbbbbbbbbbbbbbbaaaaaaaaaaaaaa' Hostname is sometimes corrupted. Yes, even _the_ simplest namespace activity had bug in it. :-( Signed-off-by: Alexey Dobriyan Acked-by: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 019ad4a0a60b09022945273848b5a686e39a78aa Author: Nigel Cunningham Date: Tue Sep 18 22:46:25 2007 -0700 Fix failure to resume from initrds Commit 831441862956fffa17b9801db37e6ea1650b0f69 (Freezer: make kernel threads nonfreezable by default) breaks freezing when attempting to resume from an initrd, because the init (which is freezeable) spins while waiting for another thread to run /linuxrc, but doesn't check whether it has been told to enter the refrigerator. The original patch replaced a call to try_to_freeze() with a call to yield(). I believe a simple reversion is wrong because if !CONFIG_PM_SLEEP, try_to_freeze() is a noop. It should still yield. Signed-off-by: Nigel Cunningham Acked-by: Rafael J. Wysocki Acked-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c392a4f47f41b24432e6aa77bb5167d0bbb10c5 Author: Nicolas George Date: Tue Sep 18 22:46:21 2007 -0700 uml: use correct type in BLKGETSIZE ioctl I found a type mismatch in UML that makes host block devices unusable as ubd devices on x86_64 and other 64 bits systems (segfault of the mm subsystem): In block/ioctl.c, the following lines show that the BLKGETSIZE ioctl expects a pointer to a long: case BLKGETSIZE: if ((bdev->bd_inode->i_size >> 9) > ~0UL) return -EFBIG; return put_ulong(arg, bdev->bd_inode->i_size >> 9); In arch/um/os-Linux/file.c, os_file_size calls it with an int. The ioctl_list man page should be fixed as well. Cc: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3558c9b3232b5f0fd9f32043a191eca20fca64c6 Author: Andrew Morton Date: Tue Sep 18 22:46:19 2007 -0700 Fix "Fix DAC960 driver on machines which don't support 64-bit DMA" sparc32: drivers/block/DAC960.c: In function 'DAC960_V1_EnableMemoryMailboxInterface': drivers/block/DAC960.c:1168: error: 'DMA_32BIT_MASK' undeclared (first use in this function) drivers/block/DAC960.c:1168: error: (Each undeclared identifier is reported only Cc: Cc: Cc: Alessandro Polverini Cc: Jeff Garzik Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c27da339698145a9383e052c1070a950d30da478 Author: Benjamin Herrenschmidt Date: Wed Sep 19 14:21:56 2007 +1000 [POWERPC] Fix timekeeping on PowerPC 601 Recent changes to the timekeeping code broke support for the PowerPC 601 processor which doesn't have the usual timebase facility but a slightly different thing called (yuck) the RTC. This fixes it, boot tested on an old 601 based PowerMac 7200. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras commit 7b5acbaac3f94ab810a977c0ec4e5fcabbf51bed Author: Benjamin Herrenschmidt Date: Wed Sep 19 14:21:56 2007 +1000 [POWERPC] Don't expose clock vDSO functions when CPU has no timebase We forgot to remove the clock_gettime, clock_getres and get_tbfreq vDSO calls on CPUs that have no timebase such as 601 or 403 (old CPUs that have different mechanisms and for which the vDSO code will not work properly). This fixes it. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras commit c0e7b4aa1c09ea992808ea8c079141bc8dd0f5bc Author: Christoph Hellwig Date: Wed Sep 19 14:38:12 2007 +1000 [POWERPC] spusched: Fix null pointer dereference in find_victim find_victim can dereference a NULL pointer when iterating over the list of victim spus because list_mutex only guarantees spu->ct to be stable, but of course not to be non-NULL. Also fix find_victim to not call spu_unbind_context without list_mutex because that violates the above guarantee. Signed-off-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Jeremy Kerr Signed-off-by: Paul Mackerras commit b394e43e995d08821588a22561c6a71a63b4ff27 Author: Lachlan McIlroy Date: Fri Sep 14 15:23:04 2007 +1000 [XFS] Avoid replaying inode buffer initialisation log items if on-disk version is newer. SGI-PV: 969656 SGI-Modid: xfs-linux-melb:xfs-kern:29676a Signed-off-by: Lachlan McIlroy Signed-off-by: David Chinner Signed-off-by: Tim Shimmin commit 776a75fa5cfb8f3602d3ca9d221dc34497133f4b Author: Lachlan McIlroy Date: Fri Sep 14 15:22:50 2007 +1000 [XFS] Ensure file size updates have been completed before writing inode to disk. SGI-PV: 968767 SGI-Modid: xfs-linux-melb:xfs-kern:29675a Signed-off-by: Lachlan McIlroy Signed-off-by: David Chinner Signed-off-by: Tim Shimmin commit 9c5b34806c28195e4d0f2deaa41d8158ca5874e1 Author: Al Viro Date: Mon Sep 17 16:47:07 2007 -0700 [SUNSAB]: Fix several bugs. * don't register irq until ->startup() (and release in ->shutdown()). That avoids oopsen with the current tree when interrupt comes before we'd set up the data structures for ttyb. * handle console=ttyS... even when OBP talks to screen/keyboard * register irq handler for each port, let kernel/irq/handle.c call it for both if needed. Kills code duplication in sunsab_interrupt(). BTW, there'd been bitrot in it - ttya handling had stopped calling check_status() on BRK (correctly), ttyb copy of that code had kept the bogus call in that case. Signed-off-by: Al Viro Signed-off-by: David S. Miller commit b20c8e8e86190d60627a59d99ce2ac6ffcbc704d Author: Robert P. J. Day Date: Mon Sep 3 09:35:04 2007 -0300 V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option Since this boot-time option was removed in commit 9ab7e323af9f9efad3e20a14faa4d947adfac381, delete the reference to it. Signed-off-by: Robert P. J. Day Signed-off-by: Mauro Carvalho Chehab commit e53dd083be96a3272df16a675f14c8396cb744ec Author: Mauro Carvalho Chehab Date: Sat Sep 15 07:38:47 2007 -0300 Revert "V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option" This reverts commit 4730d3af625b532e3df5f091b5c8edb08f512fbf. Unfortunately, patch got mangled by a whitespace removal script. Signed-off-by: Mauro Carvalho Chehab commit 588a33556ccf3e2135c7b4527557616f72fc144c Author: Stephen Rothwell Date: Mon Sep 17 12:35:30 2007 +0200 ide: remove unused variables from drivers/ide/ppc/pmac.c Removes these warnings: /home/sfr/kernels/linus/drivers/ide/ppc/pmac.c: In function 'pmac_ide_dma_check': /home/sfr/kernels/linus/drivers/ide/ppc/pmac.c:1807: warning: unused variable 'map' /home/sfr/kernels/linus/drivers/ide/ppc/pmac.c:1805: warning: unused variable 'pmif' Signed-off-by: Stephen Rothwell Cc: paulus@samba.org Signed-off-by: Bartlomiej Zolnierkiewicz commit 7062cdc5edb3ba4b2eb906684cd19e103de1f920 Author: Jorge Juan Chico Date: Mon Sep 17 12:35:30 2007 +0200 ide: ST320413A has the same problem as ST340823A ST320413A has the same problem as ST340823A. Please see https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.15/+bug/26119 From: "Jorge Juan Chico" Signed-off-by: Bartlomiej Zolnierkiewicz commit 65de5567564e70edd01b6d4e95e548d7ba284872 Author: David Chinner Date: Thu Aug 16 15:21:11 2007 +1000 [XFS] On-demand reaping of the MRU cache Instead of running the mru cache reaper all the time based on a timeout, we should only run it when the cache has active objects. This allows CPUs to sleep when there is no activity rather than be woken repeatedly just to check if there is anything to do. SGI-PV: 968554 SGI-Modid: xfs-linux-melb:xfs-kern:29305a Signed-off-by: David Chinner Signed-off-by: Donald Douwsma Signed-off-by: Tim Shimmin commit 3b0c6485a733f5f0f5c362fb094df1466b18ab93 Author: Henrique de Moraes Holschuh Date: Tue Sep 4 11:13:16 2007 -0300 ACPI: thinkpad-acpi: bump up version to 0.16 Name it thinkpad-acpi version 0.16 to avoid any confusion with some 0.15 thinkpad-acpi development snapshots and backports that had input layer support, but no hotkey_report_mode support. Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Len Brown commit ff80f1370f2eff7dd7a828cf2416bf7be697247e Author: Henrique de Moraes Holschuh Date: Tue Sep 4 11:13:15 2007 -0300 ACPI: thinkpad-acpi: revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED option Revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED Kconfig option because it would create a legacy we don't want to support. CONFIG_THINKPAD_ACPI_INPUT_ENABLED was added to try to fix an issue that is now moot with the addition of the netlink ACPI event report interface to the ACPI core. Now that ACPI core can send events over netlink, we can use a different strategy to keep backwards compatibility with older userspace, without the need for the CONFIG_THINKPAD_ACPI_INPUT_ENABLED games. And it arrived before CONFIG_THINKPAD_ACPI_INPUT_ENABLED made it to a stable mainline kernel, even, which is Good. This patch is in sync with some changes to thinkpad-acpi backports, that will keep things sane for userspace across different combinations of kernel versions, thinkpad-acpi backports (or the lack thereof), and userspace capabilities: Unless a module parameter is used, thinkpad-acpi will now behave in such a way that it will work well (by default) with userspace that still uses only the old ACPI procfs event interface and doesn't care for thinkpad-acpi input devices. It will also always work well with userspace that has been updated to use both the thinkpad-acpi input devices, and ACPI core netlink event interface, regardless of any module parameter. The module parameter was added to allow thinkpad-acpi to work with userspace that has been partially updated to use thinkpad-acpi input devices, but not the new ACPI core netlink event interface. To use this mode of hot key reporting, one has to specify the hotkey_report_mode=2 module parameter. The thinkpad-acpi driver exports the value of hotkey_report_mode through sysfs, as well. thinkpad-acpi backports to older kernels, that do not support the new ACPI core netlink interface, have code to allow userspace to switch hotkey_report_mode at runtime through sysfs. This capability will not be provided in mainline thinkpad-acpi as it is not needed there. Signed-off-by: Henrique de Moraes Holschuh Cc: Michael S. Tsirkin Cc: Hugh Dickins Cc: Richard Hughes Signed-off-by: Len Brown commit fa890d586cc127ce72597ba0a909bfecf784e10c Author: Matthew Wilcox Date: Sun Sep 16 17:01:26 2007 -0600 Fix non-ISA link error in drivers/scsi/advansys.c When CONFIG_ISA is disabled, the isa_driver support will not be compiled in. Define stubs so that we don't get link-time errors. Signed-off-by: Matthew Wilcox Signed-off-by: Linus Torvalds commit d9f30ec0b0d129b9cbf2b041a6a3159aa24592f6 Author: Al Viro Date: Sun Sep 16 16:43:04 2007 -0700 [VLAN]: Fix net_device leak. In "[VLAN]: Move device registation to seperate function" (commit e89fe42cd03c8fd3686df82d8390a235717a66de), a pile of code got moved to register_vlan_dev(), including grabbing a reference to underlying device. However, original dev_hold() had been left behind, so we leak a reference to net_device now... Signed-off-by: Al Viro Signed-off-by: David S. Miller commit 2a38b775b77f99308a4e571c13d908df78ac5e57 Author: Herbert Xu Date: Sun Sep 16 16:22:13 2007 -0700 [PPP] generic: Fix receive path data clobbering & non-linear handling This patch adds missing pskb_may_pull calls to deal with non-linear packets that may arrive from pppoe or pppol2tp. It also copies cloned packets before writing over them. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 7b797d5b150775d717cb03b5ada28b8bad99afab Author: Herbert Xu Date: Sun Sep 16 16:21:42 2007 -0700 [PPP] generic: Call skb_cow_head before scribbling over skb It's rude to write over data that other people are still using. So call skb_cow_head before PPP proceeds to modify the skb data. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit d9cc20484e5e48c6a5deb4387c20fd45bfbdde8c Author: Herbert Xu Date: Sun Sep 16 16:21:16 2007 -0700 [NET] skbuff: Add skb_cow_head This patch adds an optimised version of skb_cow that avoids the copy if the header can be modified even if the rest of the payload is cloned. This can be used in encapsulating paths where we only need to modify the header. As it is, this can be used in PPPOE and bridging. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit e081e1e3ef4682802ac63b1e5e26158fb9ca9e90 Author: Herbert Xu Date: Sun Sep 16 16:20:48 2007 -0700 [BRIDGE]: Kill clone argument to br_flood_* The clone argument is only used by one caller and that caller can clone the packet itself. This patch moves the clone call into the caller and kills the clone argument. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 9355ec23397af32799038d0e8edbfa5b6f425c27 Author: Herbert Xu Date: Sun Sep 16 16:20:21 2007 -0700 [PPP] pppoe: Fill in header directly in __pppoe_xmit This patch removes the hdr variable (which is copied into the skb) and instead sets the header directly in the skb. It also uses __skb_push instead of skb_push since we've just checked using skb_cow for enough head room. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit db7bf6d97c6956b7eb0f22131cb5c37bd41f33c0 Author: Herbert Xu Date: Sun Sep 16 16:19:50 2007 -0700 [PPP] pppoe: Fix data clobbering in __pppoe_xmit and return value The function __pppoe_xmit modifies the skb data and therefore it needs to copy and skb data if it's cloned. In fact, it currently allocates a new skb so that it can return 0 in case of error without freeing the original skb. This is totally wrong because returning zero is meant to indicate congestion whereupon pppoe is supposed to wake up the upper layer once the congestion subsides. This makes sense for ppp_async and ppp_sync but is out-of-place for pppoe. This patch makes it always return 1 and free the skb. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 31bac44468257986484703cc09da8a9dcae88a36 Author: Herbert Xu Date: Sun Sep 16 16:19:20 2007 -0700 [PPP] pppoe: Fix skb_unshare_check call position The skb_unshare_check call needs to be made before pskb_may_pull, not after. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 559cf710b07c5e2cfa3fb8d8f4a1320fd84c53f9 Author: Vlad Yasevich Date: Sun Sep 16 16:03:28 2007 -0700 [SCTP]: Convert bind_addr_list locking to RCU Since the sctp_sockaddr_entry is now RCU enabled as part of the patch to synchronize sctp_localaddr_list, it makes sense to change all handling of these entries to RCU. This includes the sctp_bind_addrs structure and it's list of bound addresses. This list is currently protected by an external rw_lock and that looks like an overkill. There are only 2 writers to the list: bind()/bindx() calls, and BH processing of ASCONF-ACK chunks. These are already seriealized via the socket lock, so they will not step on each other. These are also relatively rare, so we should be good with RCU. The readers are varied and they are easily converted to RCU. Signed-off-by: Vlad Yasevich Acked-by: Paul E. McKenney Acked-by: Sridhar Samdurala Signed-off-by: David S. Miller commit 293035479942400a7fe8e4f72465d4e4e466b91a Author: Vlad Yasevich Date: Sun Sep 16 16:02:12 2007 -0700 [SCTP]: Add RCU synchronization around sctp_localaddr_list sctp_localaddr_list is modified dynamically via NETDEV_UP and NETDEV_DOWN events, but there is not synchronization between writer (even handler) and readers. As a result, the readers can access an entry that has been freed and crash the sytem. Signed-off-by: Vlad Yasevich Acked-by: Paul E. McKenney Acked-by: Sridhar Samdurala Signed-off-by: David S. Miller commit ddeee3ce7fbf0e800f2a26a76d6018b42b337cc2 Author: Satyam Sharma Date: Sun Sep 16 14:54:05 2007 -0700 [PKT_SCHED]: sch_cbq.c: Shut up uninitialized variable warning net/sched/sch_cbq.c: In function 'cbq_enqueue': net/sched/sch_cbq.c:383: warning: 'ret' may be used uninitialized in this function has been verified to be a bogus case. So let's shut it up. Signed-off-by: Satyam Sharma Acked-by: Patrick McHardy Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit ce5d0b47f13f83dfb9fbb8ac91adad7120747aaf Author: Adit Ranadive Date: Sun Sep 16 14:52:15 2007 -0700 [PKTGEN]: srcmac fix From: Adit Ranadive Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 6ae5f983cf8de769214d2d9e8a783c881eccd4cd Author: Jiri Kosina Date: Sun Sep 16 14:48:21 2007 -0700 [IPV6]: Fix source address selection. The commit 95c385 broke proper source address selection for cases in which there is a address which is makred 'deprecated'. The commit mistakenly changed ifa->flags to ifa_result->flags (probably copy/paste error from a few lines above) in the 'Rule 3' address selection code. The patch restores the previous RFC-compliant behavior. Signed-off-by: Jiri Kosina Signed-off-by: David S. Miller commit 8a177c4f17c691c2c9a08a54709d37c6db481a0b Author: David S. Miller Date: Sun Sep 16 14:45:06 2007 -0700 [SPARC64]: Warn user if cpu is ignored. When NR_CPUS is smaller than the cpu probed, let the user know that the cpu won't be used. Suggested by Al Viro. Signed-off-by: David S. Miller commit 301feb652441a7168b59256fc44918075dcab0d5 Author: David S. Miller Date: Sun Sep 16 11:51:15 2007 -0700 [SPARC64]: Fix lockdep, particularly on SMP. As noted by Al Viro, when we try to call prom_set_trap_table() in the SMP trampoline code we try to take the PROM call spinlock which doesn't work because the current thread pointer isn't valid yet and lockdep depends upon that being correct. Furthermore, we cannot set the current thread pointer register because it can't be properly dereferenced until we return from prom_set_trap_table(). Kernel TLB misses only work after that call. So do the PROM call to set the trap table directly instead of going through the OBP library C code, and thus avoid the lock altogether. These calls are guarenteed to be serialized fully. Since there are now no calls to the prom_set_trap_table{_sun4v}() library functions, they can be deleted. Signed-off-by: David S. Miller commit 58ea1aa07e3cb4674ab0261b45aa1ba68282a79d Author: David S. Miller Date: Sun Sep 16 09:52:36 2007 -0700 [SPARC64]: Update defconfig. Signed-off-by: David S. Miller commit 5e41d0d60a534d2a5dc9772600a58f44c8d12506 Author: Thomas Gleixner Date: Sun Sep 16 15:36:43 2007 +0200 clockevents: prevent stale tick update on offline cpu Taking a cpu offline removes the cpu from the online mask before the CPU_DEAD notification is done. The clock events layer does the cleanup of the dead CPU from the CPU_DEAD notifier chain. tick_do_timer_cpu is used to avoid xtime lock contention by assigning the task of jiffies xtime updates to one CPU. If a CPU is taken offline, then this assignment becomes stale. This went unnoticed because most of the time the offline CPU went dead before the online CPU reached __cpu_die(), where the CPU_DEAD state is checked. In the case that the offline CPU did not reach the DEAD state before we reach __cpu_die(), the code in there goes to sleep for 100ms. Due to the stale time update assignment, the system is stuck forever. Take the assignment away when a cpu is not longer in the cpu_online_mask. We do this in the last call to tick_nohz_stop_sched_tick() when the offline CPU is on the way to the final play_dead() idle entry. Signed-off-by: Thomas Gleixner commit 31d9b3938c0459e5e9755ce0a98ac1e24eeff972 Author: Thomas Gleixner Date: Sun Sep 16 15:36:43 2007 +0200 clockevents: do not shutdown the oneshot broadcast device When a cpu goes offline it is removed from the broadcast masks. If the mask becomes empty the code shuts down the broadcast device. This is wrong, because the broadcast device needs to be ready for the online cpu going idle (into a c-state, which stops the local apic timer). Signed-off-by: Thomas Gleixner commit 07eec6af448d13a6a520d9c6f06f2e87f61b567a Author: Thomas Gleixner Date: Sun Sep 16 15:36:43 2007 +0200 clockevents: Enforce oneshot broadcast when broadcast mask is set on resume The jinxed VAIO refuses to resume without hitting keys on the keyboard when this is not enforced. It is unclear why the cpu ends up in a lower C State without notifying the clock events layer, but enforcing the oneshot broadcast here is safe. Signed-off-by: Thomas Gleixner commit 729c6ba334771f28a54efd7e3b8f5ab9414ce7bc Author: Venkatesh Pallipadi Date: Sun Sep 16 15:36:43 2007 +0200 ACPI: Reevaluate C/P/T states when a cpu becomes online Reevaluate C/P/T states when a cpu becomes online. This avoids the caching of the broadcast information in the clockevents layer. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Thomas Gleixner Cc: Len Brown commit 6a669ee8a790487b7ec1edda762d39615a78264b Author: Thomas Gleixner Date: Sun Sep 16 15:36:43 2007 +0200 timekeeping: Prevent time going backwards on resume Timekeeping resume adjusts xtime by adding the slept time in seconds and resets the reference value of the clock source (clock->cycle_last). clock->cycle last is used to calculate the delta between the last xtime update and the readout of the clock source in __get_nsec_offset(). xtime plus the offset is the current time. The resume code ignores the delta which had already elapsed between the last xtime update and the actual time of suspend. If the suspend time is short, then we can see time going backwards on resume. Suspend: offs_s = clock->read() - clock->cycle_last; now = xtime + offs_s; timekeeping_suspend_time = read_rtc(); Resume: sleep_time = read_rtc() - timekeeping_suspend_time; xtime.tv_sec += sleep_time; clock->cycle_last = clock->read(); offs_r = clock->read() - clock->cycle_last; now = xtime + offs_r; if sleep_time_seconds == 0 and offs_r < offs_s, then time goes backwards. Fix this by storing the offset from the last xtime update and add it to xtime during resume, when we reset clock->cycle_last: sleep_time = read_rtc() - timekeeping_suspend_time; xtime.tv_sec += sleep_time; xtime += offs_s; /* Fixup xtime offset at suspend time */ clock->cycle_last = clock->read(); offs_r = clock->read() - clock->cycle_last; now = xtime + offs_r; Thanks to Marcelo for tracking this down on the OLPC and providing the necessary details to analyze the root cause. Signed-off-by: Thomas Gleixner Cc: John Stultz Cc: Tosatti commit 3be9095063885d482b87d3875ea7f28e635882d0 Author: Thomas Gleixner Date: Sun Sep 16 15:36:43 2007 +0200 timekeeping: access rtc outside of xtime lock Lockdep complains about the access of rtc in timekeeping_suspend inside the interrupt disabled region of the write locked xtime lock. Move the access outside. Signed-off-by: Thomas Gleixner Cc: John Stultz commit fadacb1b80e35e0b36a90d43e21ef91eec4b889b Author: Jeff Garzik Date: Sat Sep 15 19:41:43 2007 -0400 drivers/net/pcmcia/3c589_cs: fix port configuration switcheroo 10base2 and 10baseT were accidentally switched. Noticed by Andreas HÃŒbner, forwarded by Alan Cox. Signed-off-by: Jeff Garzik commit 5ad887fa8e875231d72a27c474b10241a5818bf1 Author: Stephen Hemminger Date: Sat Sep 15 19:35:14 2007 -0400 sk98lin: resurrect driver This reverts commit e1abecc48938fbe1966ea6e78267fc673fa59295. The driver works on some hardware that skge doesn't handle yet. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 62270336e8fdfbea36cb455c27744c23780dbf07 Author: Anton Vorontsov Date: Thu Sep 13 19:23:33 2007 +0400 ucc_geth: fix compilation Currently qe_bd_t is used in the macro call -- dma_unmap_single, which is a no-op on PPC32, thus error is hidden today. Starting with 2.6.24, macro will be replaced by the empty static function, and erroneous use of qe_bd_t will trigger compilation error. Signed-off-by: Anton Vorontsov Signed-off-by: Jeff Garzik commit e7e381f639657b2e681ff6fb31e131db360550ac Author: Dale Farnsworth Date: Fri Sep 14 11:23:16 2007 -0700 mv643xx_eth: Fix tx_bytes stats calculation Reported by Corey Minyard Signed-off-by: Jeff Garzik commit bb8bd3a52a5dbca8bea31bfc72dacfb384170e69 Author: Tony Breeds Date: Fri Sep 14 17:03:01 2007 -0700 sparc64 (and others): fix tty_ioctl.c build Add Guards around TIOCSLCKTRMIOS and TIOCGLCKTRMIOS. Several architectures are still broken. Put temporary-for-2.6.23 ifdef guards around the offending code. Signed-off-by: Tony Breeds Cc: Alan Cox Cc: Paul Mackerras Cc: Benjamin Herrenschmidt Cc: Heiko Carstens Cc: "David S. Miller" Signed-off-by: Andrew Morton Signed-off-by:: Linus Torvalds commit 2a0c6c980d209827e5d69017fa736f107a744d1d Author: YOSHIFUJI Hideaki Date: Fri Sep 14 17:15:19 2007 -0700 [IPV4]: Just increment OutDatagrams once per a datagram. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit cd562c9859f648d78224e9fc0dafa5a3d5000fdb Author: YOSHIFUJI Hideaki Date: Fri Sep 14 17:15:01 2007 -0700 [IPV6]: Just increment OutDatagrams once per a datagram. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit 3ef9d943d26dea764f4fecf3767001c90b778b0c Author: YOSHIFUJI Hideaki Date: Fri Sep 14 16:45:40 2007 -0700 [IPV6]: Fix unbalanced socket reference with MSG_CONFIRM. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit e1e992e52faa588667e1378a2573b4b8e3fa6670 Author: Jamal Hadi Salim Date: Wed Sep 12 16:32:59 2007 +0200 [NET_SCHED] protect action config/dump from irqs (with no apologies to C Heston) On Mon, 2007-10-09 at 21:00 +0800, Herbert Xu wrote: On Sun, Sep 02, 2007 at 01:11:29PM +0000, Christian Kujau wrote: > > > > after upgrading to 2.6.23-rc5 (and applying davem's fix [0]), lockdep > > was quite noisy when I tried to shape my external (wireless) interface: > > > > [ 6400.534545] FahCore_78.exe/3552 just changed the state of lock: > > [ 6400.534713] (&dev->ingress_lock){-+..}, at: [] > > netif_receive_skb+0x2d5/0x3c0 > > [ 6400.534941] but this lock took another, soft-read-irq-unsafe lock in the > > past: > > [ 6400.535145] (police_lock){-.--} > > This is a genuine dead-lock. The police lock can be taken > for reading with softirqs on. If a second CPU tries to take > the police lock for writing, while holding the ingress lock, > then a softirq on the first CPU can dead-lock when it tries > to get the ingress lock. Signed-off-by: Jamal Hadi Salim Acked-by: Herbert Xu Signed-off-by: David S. Miller commit 4878809f711981a602cc562eb47994fc81ea0155 Author: David S. Miller Date: Fri Sep 14 16:41:03 2007 -0700 [NET]: Fix two issues wrt. SO_BINDTODEVICE. 1) Comments suggest that setting optlen to zero will unbind the socket from whatever device it might be attached to. This hasn't been the case since at least 2.2.x because the first thing this function does is return -EINVAL if 'optlen' is less than sizeof(int). This check also means that passing in a two byte string doesn't work so well. It's almost as if this code was testing with "eth?" patterned strings and nothing else :-) Fix this by breaking the logic of this facility out into a seperate function which validates optlen more appropriately. The optlen==0 and small string cases now work properly. 2) We should reset the cached route of the socket after we have made the device binding changes, not before. Reported by Ben Greear. Signed-off-by: David S. Miller commit 22d95b1282810f5af599ee292b3fc443aefbdad0 Author: Avi Kivity Date: Fri Sep 14 20:26:06 2007 +0300 KVM: MMU: Fix rare oops on guest context switch A guest context switch to an uncached cr3 can require allocation of shadow pages, but we only recycle shadow pages in kvm_mmu_page_fault(). Move shadow page recycling to mmu_topup_memory_caches(), which is called from both the page fault handler and from guest cr3 reload. Signed-off-by: Avi Kivity Signed-off-by: Linus Torvalds commit 7a1fa065a0264f6b3d3003ba5635289f6583c478 Author: Neil Brown Date: Fri Sep 14 10:28:08 2007 -0400 Correctly close old nfsd/lockd sockets. Commit aaf68cfbf2241d24d46583423f6bff5c47e088b3 added a bias to sk_inuse, so this test for an unused socket now fails. So no sockets get closed because they are old (they might get closed if the client closed them). This bug has existed since 2.6.21-rc1. Thanks to Wolfgang Walter for finding and reporting the bug. Cc: Wolfgang Walter Signed-off-by: Neil Brown Signed-off-by: J. Bruce Fields Signed-off-by: Linus Torvalds commit 2123a09f3f129f4d56f59026ec63e5990f86db2f Author: aherrman@arcor.de Date: Fri Sep 14 01:28:56 2007 +0200 Fix kernel buuild with (CONFIG_COMPAT && ! CONFIG_BLOCK) Commit 02a5e0acb3cb85d80d0fe834e366d38a92bbaa22 ("BLOCK: Hide the contents of linux/bio.h if CONFIG_BLOCK=n") broke the kernel build for the CONFIG_COMPAT && !CONFIG_BLOCK case: CC fs/compat_ioctl.o In file included from include/linux/raid/md_k.h:19, from include/linux/raid/md.h:54, from fs/compat_ioctl.c:25: include/linux/raid/../../../drivers/md/dm-bio-list.h: In bio_list_: include/linux/raid/../../../drivers/md/dm-bio-list.h:40: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h: In bio_list_: include/linux/raid/../../../drivers/md/dm-bio-list.h:48: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h:51: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h: In bio_list_: include/linux/raid/../../../drivers/md/dm-bio-list.h:64: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h: In bio_list_merge_: include/linux/raid/../../../drivers/md/dm-bio-list.h:78: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h: In bio_list_: include/linux/raid/../../../drivers/md/dm-bio-list.h:90: error: dereferencing pointer to incomplete type include/linux/raid/../../../drivers/md/dm-bio-list.h:94: error: dereferencing pointer to incomplete type make[1]: *** [fs/compat_ioctl.o] Error 1 make: *** [fs] Error 2 Signed-off-by: Andreas Herrmann Acked-By: David Howells Signed-off-by: Linus Torvalds commit dd941252a81b02b5915e2db160fe02c972875846 Author: Nick Piggin Date: Fri Sep 14 08:41:12 2007 +0200 shared tag queue barrier comment Should add some comments for the tag barriers (they won't be so important if we can switch over to the explicit _lock bitops, but for now we should make it clear). Jens' original patch said a barrier after the test_and_clear_bit was also required. I can't see why (and it would prevent the use of the _lock bitop). Acked-by: Jens Axboe Signed-off-by: Linus Torvalds -- commit 53c5725581cce8a29925afd4eae71fa8c7ce551f Author: Masakazu Mokuno Date: Fri Sep 14 14:35:38 2007 -0400 As struct iw_point is bi-directional payload, we should copy back the content on return from ioctl calls Signed-off-by: Masakazu Mokuno Signed-off-by: John W. Linville commit 3f7086978fc0193eff24a77d8b57ac4debc088fa Author: Larry Finger Date: Tue Sep 4 14:14:20 2007 -0500 [PATCH] bcm43xx: Fix cancellation of work queue crashes A crash upon booting that is caused by bcm43xx has been reported [1] and found to be due to a work queue being reinitialized while work on that queue is still pending. This fix modifies the shutdown of work queues and prevents periodic work from being requeued during shutdown. With this patch, no more crashes on reboot were observed by the original reporter. I do not get that particular failure on my system; however, when running a large number of ifdown/ifup sequences, my system would kernel panic with the 'caps lock' light blinking at roughly a 1 Hz rate. In addition, there were infrequent failures in the firmware that resulted in 'IRQ READY TIMEOUT' errors. With this patch, no more of the first type of failure occur, and incidence of the second type is greatly reduced. [1] http://bugzilla.kernel.org/show_bug.cgi?id=8937 Signed-off-by: Larry Finger Acked-by: Michael Buesch Signed-off-by: John W. Linville commit 50da469a79fa2152d824f25f5ad5962f4af4343d Author: Ralf Baechle Date: Fri Sep 14 19:08:43 2007 +0100 [MIPS] 20Kc: Disable use of WAIT instruction. Another issue with 20Kc's WAIT, waiting for more details. With the 2.6.23 release immindent simply disable the use of WAIT instead of a more fancy workaround. Signed-off-by: Ralf Baechle commit 8df5beac2aa15b18a912ab585e1b86e748eda9ad Author: Maciej W. Rozycki Date: Wed Aug 23 14:26:50 2006 +0100 [MIPS] Workaround for 4Kc machine check exception Signed-off-by: Maciej W. Rozycki Signed-off-by: Ralf Baechle commit 48d480b0bde794781fcae9501fb043c1bac0e523 Author: Ralf Baechle Date: Thu Sep 13 17:36:22 2007 +0100 [MIPS] Malta: Fix off by one bug in interrupt handler. Fairly cosmetic as it would only affect VSMP / SMTC kernels that don't use vectored interrupts. Found by Beth. Signed-off-by: Ralf Baechle commit 6440fcfc62767028a2bbdf742549d24f6a023004 Author: Atsushi Nemoto Date: Tue Sep 4 23:02:02 2007 +0900 [MIPS] No ide_default_io_base() if PCI IDE was not found Revert b5438582090406e2ccb4169d9b2df7c9939ae42b and add no_pci_devices() check to avoid crash due to early calling of pci_get_class(). Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit b1043cc7d9d7a7dec8d807570c067e0c90b94b57 Author: Yoichi Yuasa Date: Thu Sep 13 13:13:28 2007 +0900 [MIPS] Add #include to arch/mips/kernel/time.c It refer to CPU_PROFILING. arch/mips/kernel/time.c: In function 'local_timer_interrupt': arch/mips/kernel/time.c:142: error: implicit declaration of function 'profile_tick' arch/mips/kernel/time.c:142: error: 'CPU_PROFILING' undeclared (first use in this function) arch/mips/kernel/time.c:142: error: (Each undeclared identifier is reported only once arch/mips/kernel/time.c:142: error: for each function it appears in.) Signed-off-by: Yoichi Yuasa Signed-off-by: Ralf Baechle commit 82411390a2eb532a2c54026d39ab6beb83ff838c Author: Johannes Dickgreber Date: Wed Sep 12 18:22:04 2007 +0200 [MIPS] N32 needs to use compat_sys_futimesat Signed-off-by: Ralf Baechle commit 4d24c8f955b8c9d51c5fe7299c898527e94d39ad Author: Ralf Baechle Date: Wed Sep 12 16:32:54 2007 +0100 [MIPS] rtlx: Fix build error. CC arch/mips/kernel/rtlx.o cc1: warnings being treated as errors arch/mips/kernel/rtlx.c:59: warning: 'irq' defined but not used arch/mips/kernel/rtlx.c:60: warning: 'irq_num' defined but not used Signed-off-by: Ralf Baechle commit e606c109c485c6f8e27dd6ddcd2c0b58c96fc5c9 Author: Ralf Baechle Date: Wed Sep 12 16:31:12 2007 +0100 [MIPS] rtlx: fix int vs. long bug. CC arch/mips/kernel/rtlx.o arch/mips/kernel/rtlx.c: In function 'rtlx_init': arch/mips/kernel/rtlx.c:114: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'long unsigned int' Signed-off-by: Ralf Baechle commit e90ff9239e7636a191a8998a70cea220a2c58cdf Author: Linus Torvalds Date: Thu Sep 13 21:09:01 2007 -0300 V4L/DVB (6220a): fix build error for et61x251 driver Signed-off-by: Mauro Carvalho Chehab commit 48200baeab95fd39a7f4c4f3536c7142a64ac335 Author: Steven Toth Date: Thu Sep 6 22:48:35 2007 -0300 V4L/DVB (6188): Avoid a NULL pointer dereference during mpeg_open() Bug: With a hardware encoder board installed as cx88[1] and a non-encoder boards installed as cx88[0], an OOPS is generated during cx8802_get_device() called from mpeg_open(). Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 4730d3af625b532e3df5f091b5c8edb08f512fbf Author: Robert P. J. Day Date: Mon Sep 3 09:35:04 2007 -0300 V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option Since this boot-time option was removed in commit 9ab7e323af9f9efad3e20a14faa4d947adfac381, delete the reference to it. Signed-off-by: Robert P. J. Day Signed-off-by: Mauro Carvalho Chehab commit f5ab272bbff2a37d6d8f84328b6d25d0cdbda605 Author: Mauro Carvalho Chehab Date: Mon Sep 3 12:01:51 2007 -0300 V4L/DVB (6148): Fix a warning at saa7191_probe saa7191.c: In function 'saa7191_probe': saa7191.c:596: warning: passing argument 3 of 'saa7191_write_block' discards qualifiers from pointer target type Signed-off-by: Mauro Carvalho Chehab commit 7b9fbc3e30f785412a26819aa4daf0b6c27f6c53 Author: Jean Delvare Date: Mon Sep 3 11:51:51 2007 -0300 V4L/DVB (6147): Pwc: Fix a broken debug message Commit 85237f202d46d55c1bffe0c5b1aa3ddc0f1dce4d introduced the following warning (with CONFIG_USB_PWC_DEBUG=y): drivers/media/video/pwc/pwc-if.c: In function "pwc_video_close": drivers/media/video/pwc/pwc-if.c:1211: warning: "i" may be used uninitialized in this function This is true, and can cause a broken debug message to be logged. Here's a fix. Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab commit f5e4feead773cb449212eacfa254a238a953d4d5 Author: Stas Sergeev Date: Sun Sep 2 03:56:18 2007 -0300 V4L/DVB (6144): Fix mux setup for composite sound on AverTV 307 Right now the composite sound input doesn't work on AverTV 307 because of the wrong mux setup. The composite sound is routed via an external 4channel multiplexer controlled by GPIO, while the code assumes an internal multiplexer instead. Presumably this was a copy/paste error, and noone have ever tested the functionality. With the attached patch it works properly, which gives me an ability to finally watch the cable TV under linux. Signed-off-by: Stas Sergeev Signed-off-by: Andrew Morton Acked-by: Nickolay V. Shmyrev Signed-off-by: Mauro Carvalho Chehab commit 5614b02143171a99e0e6eb6c7d1d2f8750d2957f Author: Hans Verkuil Date: Thu Aug 23 17:48:41 2007 -0300 V4L/DVB (6095): ivtv: fix VIDIOC_G_ENC_INDEX flag handling Due to a documentation bug (the type mask is 3 bits long, not 2) the wrong frame types were filled in: the B and P frame types were swapped. This bug also hid a second bug: when a capture is stopped a last entry is written into the pgm index buffer with internal type 0, denoting the end of the program. This entry wasn't ignored, instead it was accidentally returned to the caller as a P frame. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit f3da54ba140c6427fa4a32913e1bf406f41b5dda Author: Jens Axboe Date: Thu Sep 13 14:26:53 2007 +0200 Fix race with shared tag queue maps There's a race condition in blk_queue_end_tag() for shared tag maps, users include stex (promise supertrak thingy) and qla2xxx. The former at least has reported bugs in this area, not sure why we haven't seen any for the latter. It could be because the window is narrow and that other conditions in the qla2xxx code hide this. It's a real bug, though, as the stex smp users can attest. We need to ensure two things - the tag bit clearing needs to happen AFTER we cleared the tag pointer, as the tag bit clearing/setting is what protects this map. Secondly, we need to ensure that the visibility of the tag pointer and tag bit clear are ordered properly. [ I removed the SMP barriers - "test_and_clear_bit()" already implies all the required barriers. -- Linus ] Also see http://bugzilla.kernel.org/show_bug.cgi?id=7842 Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit 9ca2152e173554e7ffb7919dc4916a7c61f8be1a Author: Jean Delvare Date: Thu Sep 13 12:19:46 2007 +0200 Fix this Paul Simon song's name Signed-off-by: Jean Delvare Signed-off-by: Linus Torvalds commit 106c4a9cef3671b0a251e64c8f6fb7f1a4d801c6 Author: aherrman@arcor.de Date: Tue Sep 11 20:37:37 2007 +0200 radeonfb: fix chip definition for Radeon Xpress 200M 0x5975 This fixes a problem introduced with commit b5f2f4d1a6d7efde39cfb5e1d034981c69f2214c The commit added a wrong chip definition to radeonfb which causes a blank console on my Laptop if radeonfb is loaded. The patch - renames PCI_CHIP_RS485_5975 to PCI_CHIP_RS482_5975 - corrects the chip family (RS480 instead of R300) for 0x5975 - ensures that PCI IDs are in ascending order in ati_ids.h Signed-off-by: Andreas Herrmann Tentatively-acked-by: Ben Herrenschmidt Signed-off-by: Linus Torvalds commit f2740e45ae59d76ce4303d83824d3625b23334e5 Author: aherrman@arcor.de Date: Tue Sep 11 20:22:28 2007 +0200 radeonfb: fix setting of PPLL_REF_DIV for RV370 5B60. As observed with various Radeon X300 cards console goes blank without that fix. Acked-by: Benjamin Herrenschmidt Signed-off-by: Andreas Herrmann Signed-off-by: Linus Torvalds commit b9338a78fc21e980d33c58b31f3bb37cd48a68f6 Author: Tzachi Perelstein Date: Sun Sep 9 14:24:59 2007 +0100 [ARM] 4567/1: Fix 'Oops - undefined instruction' when CONFIG_VFP=y on non VFP device vfp_init() takes care of the condition when CONFIG_VFP=y but no real VFP device exists. However, when this condition is true, a compiler might misplace code lines in a way that will break this support. (To be more specific - fmrx(FPSID) might be executed before vfp_testing_entry assignment, which will end up with Oops - undefined instruction). This patch adds a barrier() to guarantee the right execution ordering. Signed-off-by: Assaf Hoffman Signed-off-by: Russell King commit a53d6fb83efc75bbd7876459e6e1291c4925103d Author: Russell King Date: Mon Sep 3 09:43:54 2007 +0100 [ARM] realview: disable second GIC on RevB MPCore platforms The second GIC asserts a permanent interrupt on Rev.B MPCore platforms. Disable initialisation of this GIC to avoid unbootable systems. Signed-off-by: Russell King commit d526875deb42e0f4c0d31cb50b4e5bfaf19c3138 Author: Greg Kroah-Hartman Date: Thu Sep 13 06:01:24 2007 -0700 Revert "usb-storage: implement autosuspend" This reverts commit 8dfe4b14869fd185ca25ee88b02ada58a3005eaf. There are a number of issues still remaining in usb-storage autosuspend, so, to be safe, we need to revert this for now. Acked-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 7d2c592609a7da950b458403f1936d382f38ff9c Author: Alan Stern Date: Mon Aug 20 10:48:05 2007 -0400 USB: disable autosuspend by default for non-hubs This patch (as965) disables autosuspend by default for all USB devices other than hubs. We are seeing too many devices that can't suspend or resume properly, the blacklist is growing unreasonably quickly, and this sort of thing should be handled in userspace. Signed-off-by: Alan Stern Cc: stable Signed-off-by: Greg Kroah-Hartman commit a041fe2e8d0bd749b2416ef79adc416e24af7c63 Author: Ishizaki Kou Date: Mon Aug 20 22:13:27 2007 +0900 spidernet: fix interrupt reason recognition This patch solves a problem that the spidernet driver sometimes fails to handle IRQ. The problem happens because, - In Cell architecture, interrupts may arrive at an interrupt controller, even if they are masked by the setting on registers of devices. It happens when interrupt packets are sent just before the interrupts are masked. - spidernet interrupt handler compares interrupt reasons with interrupt masks, so when such interrupts occurs, spidernet interrupt handler returns IRQ_NONE. - When all of interrupt handler return IRQ_NONE, linux kernel disables the IRQ and it no longer delivers interrupts to the interrupt handlers. spidernet doesn't work after above sequence, because it can't receive interrupts. This patch changes spidernet interrupt handler that it compares interrupt reason with SPIDER_NET_INTX_MASK_VALUE. Signed-off-by: Kou Ishizaki Signed-off-by: Jeff Garzik commit 64251621796d5d4c0c4b6a6b6d845e4a43c63aee Author: Jan-Bernd Themann Date: Fri Sep 7 12:30:24 2007 +0200 ehea: fix last_rx update Update last_rx in registered device struct instead of in the dummy device. Signed-off-by: Jan-Bernd Themann Signed-off-by: Jeff Garzik commit 8759cf76e9a6322fc68dcbfaa1cbad00c74b199e Author: Jan-Bernd Themann Date: Fri Sep 7 12:30:17 2007 +0200 ehea: propagate physical port state Introduces a module parameter to decide whether the physical port link state is propagated to the network stack or not. It makes sense not to take the physical port state into account on machines with more logical partitions that communicate with each other. This is always possible no matter what the physical port state is. Thus eHEA can be considered as a switch there. Signed-off-by: Jan-Bernd Themann Signed-off-by: Jeff Garzik commit 026d7917e592f91063861e002adf1c806d7756ae Author: Hans-Jürgen Koch Date: Fri Aug 31 14:30:08 2007 +0200 Fix a lock problem in generic phy code Lock debugging finds a problem in phy.c and phy_device.c, this patch fixes it. Tested on an AT91SAM9263-EK board, kernel 2.6.23-rc4. Signed-off-by: Hans J. Koch Signed-off-by: Jeff Garzik commit d1b139c039704c391ab47c6c9540c28f7fcaa489 Author: Stephen Hemminger Date: Wed Sep 5 16:56:19 2007 +0100 sky2: restore multicast list on resume and other ops Need to restore multicast settings on resume and after 'ethtool -r'. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 5f08e46b621a769e52a9545a23ab1d5fb2aec1d4 Author: Luca Tettamanti Date: Fri Sep 7 20:25:01 2007 -0400 atl1: disable broken 64-bit DMA 64-bit DMA causes data corruption with atl1. We don't know why, and Atheros is working on it. For now, just use 32-bit DMA. This is a big hack that is probably wrong, but it stops the bleeding. Signed-off-by: Luca Tettamanti Acked-by: Chris Snook Acked-by: Jay Cliburn Signed-off-by: Jeff Garzik commit c413fecc763e380ec93dc6faf726e7e735ade04e Author: Rusty Russell Date: Tue Sep 11 17:06:37 2007 +1000 lguest: Fix guest crash when CONFIG_X86_USE_3DNOW=y One of the very first things lguest_init() does is a memcpy. On Athlon/Duron/K7 or CyrixIII/VIA-C3 or Geode GX/LX, this tries to use MMX. memcpy -> _mmx_memcpy -> kernel_fpu_begin -> clts -> paravirt_ops.clts But we haven't set paravirt_ops.clts yet, so we do the native version and crash. The simplest solution is to use __memcpy. Thanks to Michael Rasenberger for the bug report. Signed-off-by: Rusty Russell Signed-off-by: Linus Torvalds commit ee56c47440ab04c6a35c835a9bcc4193304adf93 Author: Olof Johansson Date: Wed Aug 22 19:26:37 2007 -0500 [POWERPC] Move serial_dev_init to device_initcall() With the I/O space rewrite by BenH, the legacy_serial serial_dev_init() initcall is now called before I/O space is setup, but it's dependent on it being available. Since there's no way to make dependencies between initcalls, we'll just have to move it to device_initcall(). Yes, it's suboptimal but I'm not aware of any better solution at this time, and it fixes a regression from 2.6.22. Signed-off-by: Olof Johansson Signed-off-by: Paul Mackerras commit 9863b78a1a82347fa1e727bdca0110151a5c4f10 Author: Andi Kleen Date: Tue Sep 11 14:02:12 2007 +0200 i386: Fix leak of ../kernel from top level Fix a compile error when the directory above the kernel source contains a file named "kernel". Originally from Ben LaHaise, modified based on feedback from Sam Ravnborg Signed-off-by: Andi Kleen Cc: Sam Ravnborg Cc: Ben LaHaise Signed-off-by: Linus Torvalds commit 2966c6a03efd90197582eae8590d82c789475680 Author: Andi Kleen Date: Tue Sep 11 14:02:11 2007 +0200 x86_64: Prevent doing anything from cache_remove_dev() when info setup failed. AK: Removed the unlikelies because gcc heuristics default to unlikely AK: for test == NULL and for negative returns. Cc: Venkatesh Pallipadi Cc: Ashok Raj Cc: Akinobu Mita Signed-off-by: Jan Beulich Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit 95b08679963c78ce0d675224a6efdb5169f2bf75 Author: Andi Kleen Date: Tue Sep 11 14:02:09 2007 +0200 x86_64: Add missing mask operation to vdso vdso vgetns() didn't mask the time source offset calculation, which could lead to time problems with 32bit HPET. Add the masking. Thanks to Chuck Ebbert for tracking this down. Signed-off-by: Andi Kleen Cc: Chuck Ebbert Signed-off-by: Linus Torvalds commit b0052fcaefb829a29fdc6567274daf0b75329fc3 Author: Paul Mackerras Date: Thu Sep 13 01:16:31 2007 +1000 Define termios_1 functions for powerpc, s390, avr32 and frv Commit f629307c857c030d5a3dd777fee37c8bb395e171 introduced uses of kernel_termios_to_user_termios_1 and user_termios_to_kernel_termios_1 on all architectures. However, powerpc, s390, avr32 and frv don't currently define those functions since their termios struct didn't need to be changed when the arbitrary baud rate stuff was added, and thus the kernel won't currently build on those architectures. This adds definitions of kernel_termios_to_user_termios_1 and user_termios_to_kernel_termios_1 to include/asm-generic/termios.h which are identical to kernel_termios_to_user_termios and user_termios_to_kernel_termios respectively. The definitions are the same because the "old" termios and "new" termios are in fact the same on these architectures (which are the same ones that use asm-generic/termios.h). Signed-off-by: Paul Mackerras Cc: Andrew Morton Cc: Alan Cox Cc: David Miller Signed-off-by: Linus Torvalds commit fb4f0e8832e0075849b41b65f6bb9fdfa7593b99 Author: Kumar Gala Date: Mon Sep 10 14:57:34 2007 -0500 [POWERPC] Enable GENERIC_ISA_DMA if FSL_ULI1575 to fix compile issue Since the ULI1575 has a ISA bus we need to enable the generic ISA dma support for drivers that might expect it. Without this we get compile errors like the following: ound/built-in.o: In function `claim_dma_lock': /home/galak/git/linux-8572/include/asm/dma.h:189: undefined reference to `dma_spin_lock' /home/galak/git/linux-8572/include/asm/dma.h:189: undefined reference to `dma_spin_lock' sound/built-in.o: In function `release_dma_lock': /home/galak/git/linux-8572/include/asm/dma.h:195: undefined reference to `dma_spin_lock' sound/built-in.o: In function `claim_dma_lock': /home/galak/git/linux-8572/include/asm/dma.h:189: undefined reference to `dma_spin_lock' /home/galak/git/linux-8572/include/asm/dma.h:189: undefined reference to `dma_spin_lock' sound/built-in.o:/home/galak/git/linux-8572/include/asm/dma.h:195: more undefined references to `dma_spin_lock' follow make: *** [.tmp_vmlinux1] Error 1 Signed-off-by: Kumar Gala commit 1da97f83a843f92678b614fcaebdb3e4ebd6c9dd Author: David S. Miller Date: Wed Sep 12 14:10:58 2007 +0200 [BLUETOOTH]: Fix non-COMPAT build of hci_sock.c Signed-off-by: David S. Miller commit 0931ce8439365358b1cacf888ddc8fb008036125 Author: Mike Frysinger Date: Wed Sep 12 16:30:15 2007 +0800 Blackfin arch: fix some bugs in lib/string.h functions found by our string testing modules - use ints for the return value rather than char since we actually return an int and we dont want it improperly being sign extended during the reload http://blackfin.uclinux.org/gf/project/uclinux-dist/tracker/?action=TrackerItemEdit&tracker_item_id=3525 - if src is shorter than the requested number of copy bytes, we need to null pad the rest http://blackfin.uclinux.org/gf/project/uclinux-dist/tracker/?action=TrackerItemEdit&tracker_item_id=3524 - mark these as __volatile__ and add memory to the clobber list so gcc does not optimize buffers around on us we may be using - rewrite asm code to be readable/maintainable Signed-off-by: Mike Frysinger Signed-off-by: Bryan Wu commit 2cc7345ff71b27b5ac99e49ad7de39360042f601 Author: David S. Miller Date: Wed Sep 12 10:15:59 2007 +0200 [SPARC64]: Fix booting on V100 systems. On the root PCI bus, the OBP device tree lists device 3 twice. Once as 'pm' and once as 'lomp'. Everything goes downhill from there. Ignore the second instance to workaround this. Thanks to Kövedi_Krisztián for the bug report and testing the fix. Signed-off-by: David S. Miller commit 7111de76438e05ceab8ba2a471192fa3ea6c3572 Author: Adrian Bunk Date: Tue Sep 11 15:24:13 2007 -0700 fix SERIAL_CORE_CONSOLE driver dependencies SERIAL_BFIN=m or SERIAL_MUX=m shouldn't allow SERIAL_CORE_CONSOLE=y. Additionally, this patch fixes whitespace instead of tabs at the SERIAL_MUX_CONSOLE option. Signed-off-by: Adrian Bunk Cc: Bryan Wu Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9c54ea95852a920720868d0e18bb4e9d645ea007 Author: Krzysztof Halasa Date: Tue Sep 11 15:24:12 2007 -0700 Subject: [PATCH] Intel FB pixel clock calculation fix Intel framebuffer mis-calculated pixel clocks. The pixel clock (and thus both H and V sync) will be slower than requested, so if you set the minimum allowed the display may not sync. In case of really old CRT display it could theoretically damage it. I'm using it with PAL TV (using RGB input - SCART connector) and the bug prevented it from working at all (TV requirements are more strict and made the bug visible). Signed-off-by: Krzysztof Halasa Cc: "Antonino A. Daplas" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba0268a8b056f2ad846f1f8837a764c21bb6425e Author: Christoph Lameter Date: Tue Sep 11 15:24:11 2007 -0700 SLUB: accurately compare debug flags during slab cache merge This was posted on Aug 28 and fixes an issue that could cause troubles when slab caches >=128k are created. http://marc.info/?l=linux-mm&m=118798149918424&w=2 Currently we simply add the debug flags unconditional when checking for a matching slab. This creates issues for sysfs processing when slabs exist that are exempt from debugging due to their huge size or because only a subset of slabs was selected for debugging. We need to only add the flags if kmem_cache_open() would also add them. Create a function to calculate the flags that would be set if the cache would be opened and use that function to determine the flags before looking for a compatible slab. [akpm@linux-foundation.org: fixlets] Signed-off-by: Christoph Lameter Cc: Chuck Ebbert Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4150d3f549fe2355625017b2a6ff72aec98bcef0 Author: Andrew Morton Date: Tue Sep 11 15:24:10 2007 -0700 revert "highmem: catch illegal nesting" Revert commit 656dad312fb41ed95ef08325e9df9bece3aacbbb Author: Ingo Molnar Date: Sat Feb 10 01:46:36 2007 -0800 [PATCH] highmem: catch illegal nesting Catch illegally nested kmap_atomic()s even if the page that is mapped by the 'inner' instance is from lowmem. This avoids spuriously zapped kmap-atomic ptes and turns hard to find crashes into clear asserts at the bug site. Problem is, a get_zeroed_page(GFP_KERNEL) from interrupt context will trigger this check if non-irq code on this CPU holds a KM_USER0 mapping. But that get_zeroed_page() will never be altering the kmap slot anyway due to the GFP_KERNEL. Cc: Christoph Lameter Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 298a5df45d497e66064fda22ef0abf13766d3333 Author: Tony Breeds Date: Tue Sep 11 15:24:03 2007 -0700 Fix "no_sync_cmos_clock" logic inversion in kernel/time/ntp.c Seems to me that this timer will only get started on platforms that say they don't want it? Signed-off-by: Tony Breeds Cc: Paul Mackerras Cc: Gabriel Paubert Cc: Zachary Amsden Acked-by: Thomas Gleixner Cc: John Stultz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0e2f6db88a6900bc9db576d6b478b12ee60d61f7 Author: Pavel Emelyanov Date: Tue Sep 11 15:24:01 2007 -0700 Leases can be hidden by flocks The inode->i_flock list contains the leases, flocks and posix locks in the specified order. However, the flocks are added in the head of this list thus hiding the leases from F_GETLEASE command, from time_out_leases() and other code that expects the leases to come first. The following example will demonstrate this: #define _GNU_SOURCE #include #include #include #include static void show_lease(int fd) { int res; res = fcntl(fd, F_GETLEASE); switch (res) { case F_RDLCK: printf("Read lease\n"); break; case F_WRLCK: printf("Write lease\n"); break; case F_UNLCK: printf("No leases\n"); break; default: printf("Some shit\n"); break; } } int main(int argc, char **argv) { int fd, res; fd = open(argv[1], O_RDONLY); if (fd == -1) { perror("Can't open file"); return 1; } res = fcntl(fd, F_SETLEASE, F_WRLCK); if (res == -1) { perror("Can't set lease"); return 1; } show_lease(fd); if (flock(fd, LOCK_SH) == -1) { perror("Can't flock shared"); return 1; } show_lease(fd); return 0; } The first call to show_lease() will show the write lease set, but the second will show no leases. Fix the flock adding so that the leases always stay in the head of this list. Found during making the flocks pid-namespaces aware. Signed-off-by: Pavel Emelyanov Acked-by: "J. Bruce Fields" Cc: Trond Myklebust Cc: Andrew Morton Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4740622c5c805d88c63a50747a2d05537dd233cf Author: Zhenyu Wang Date: Tue Sep 11 15:23:58 2007 -0700 intel_agp: fix GTT map size on G33 G33 has 1MB GTT table range. Fix GTT mapping in case like 512MB aperture size. Signed-off-by: Zhenyu Wang Acked-by: Dave Airlie Cc: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f443675affe3f16dd428e46f0f7fd3f4d703eeab Author: Zhenyu Wang Date: Tue Sep 11 15:23:57 2007 -0700 intel_agp: fix stolen mem range on G33 G33 GTT stolen memory is below graphics data stolen memory and be seperate, so don't subtract it in stolen mem counting. Signed-off-by: Zhenyu Wang Acked-by: Dave Airlie Cc: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e845498e4ce4b0e704761e9462e5c29895ced34f Author: Geert Uytterhoeven Date: Tue Sep 11 15:23:56 2007 -0700 m68k(nommu): add missing syscalls Signed-off-by: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd23aae4f5edf4e1dbd8f7f8013a754ba3253f48 Author: Alexey Dobriyan Date: Tue Sep 11 15:23:55 2007 -0700 Fix select on /proc files without ->poll Taneli Vähäkangas reported that commit 786d7e1612f0b0adb6046f19b906609e4fe8b1ba aka "Fix rmmod/read/write races in /proc entries" broke SBCL + SLIME combo. The old code in do_select() used DEFAULT_POLLMASK, if couldn't find ->poll handler. The new code makes ->poll always there and returns 0 by default, which is not correct. Return DEFAULT_POLLMASK instead. Steps to reproduce: install emacs, SBCL, SLIME emacs M-x slime in *inferior-lisp* buffer [watch it doing "Connecting to Swank on port X.."] Please, apply before 2.6.23. P.S.: why SBCL can't just read(2) /proc/cpuinfo is a mystery. Signed-off-by: Alexey Dobriyan Cc: T Taneli Vahakangas Cc: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3210f0ecdba6a81c3f8efe6f442d2e1f57db98f9 Author: Michael Ellerman Date: Tue Sep 11 15:23:51 2007 -0700 Restore call_usermodehelper_pipe() behaviour The semantics of call_usermodehelper_pipe() used to be that it would fork the helper, and wait for the kernel thread to be started. This was implemented by setting sub_info.wait to 0 (implicitly), and doing a wait_for_completion(). As part of the cleanup done in 0ab4dc92278a0f3816e486d6350c6652a72e06c8, call_usermodehelper_pipe() was changed to pass 1 as the value for wait to call_usermodehelper_exec(). This is equivalent to setting sub_info.wait to 1, which is a change from the previous behaviour. Using 1 instead of 0 causes __call_usermodehelper() to start the kernel thread running wait_for_helper(), rather than directly calling ____call_usermodehelper(). The end result is that the calling kernel code blocks until the user mode helper finishes. As the helper is expecting input on stdin, and now no one is writing anything, everything locks up (observed in do_coredump). The fix is to change the 1 to UMH_WAIT_EXEC (aka 0), indicating that we want to wait for the kernel thread to be started, but not for the helper to finish. Signed-off-by: Michael Ellerman Acked-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f629307c857c030d5a3dd777fee37c8bb395e171 Author: David Miller Date: Tue Sep 11 15:23:50 2007 -0700 tty: termios locking functions break with new termios type I ran into a few problems. n_tty_ioctl() for instance: drivers/char/tty_ioctl.c:799: error: $,1rxstruct termios$,1ry has no member named $,1rxc_ispeed$,1ry This is calling the copy interface that is supposed to be using a termios2 when the new interfaces are defined, however: case TIOCGLCKTRMIOS: if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked)) return -EFAULT; return 0; This is going to write over the end of the userspace structure by a few bytes, and wasn't caught by you yet because the i386 implementation is simply copy_to_user() which does zero type checking. Signed-off-by: Alan Cox Cc: "David S. Miller" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 179c85ea53bef807621f335767e41e23f86f01df Author: Arnd Bergmann Date: Tue Sep 11 15:23:49 2007 -0700 futex_compat: fix list traversal bugs The futex list traversal on the compat side appears to have a bug. It's loop termination condition compares: while (compat_ptr(uentry) != &head->list) But that can't be right because "uentry" has the special "pi" indicator bit still potentially set at bit 0. This is cleared by fetch_robust_entry() into the "entry" return value. What this seems to mean is that the list won't terminate when list iteration gets back to the the head. And we'll also process the list head like a normal entry, which could cause all kinds of problems. So we should check for equality with "entry". That pointer is of the non-compat type so we have to do a little casting to keep the compiler and sparse happy. The same problem can in theory occur with the 'pending' variable, although that has not been reported from users so far. Based on the original patch from David Miller. Acked-by: Ingo Molnar Cc: Thomas Gleixner Cc: David Miller Signed-off-by: Arnd Bergmann Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a570ab6f10462b062c28188b64377b8034235761 Author: Andre Haupt Date: Tue Sep 11 15:23:47 2007 -0700 fix typo in Documentation/SubmittingPatches Signed-off-by: Andre Haupt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a83308e60f63749dc1d08acb0d8fa9e2ec13c9a7 Author: Matthew Wilcox Date: Tue Sep 11 15:23:47 2007 -0700 PTR_ALIGN The AdvanSys driver wants to align some pointers, and the ALIGN macro doesn't work for pointers. Rather than try to make it work, add a new PTR_ALIGN macro which is typesafe. Signed-off-by: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f3d79b20df961880697c8442e1f7bc7969ce50a4 Author: Mike Rapoport Date: Tue Sep 11 15:23:45 2007 -0700 RTC v3020 fixes Fix off-by-one in month calculations Add delay for bus accesses to satisfy Tw > 500ns Signed-off-by: Mike Rapoport Acked-by: Raphael Assenat Cc: Alessandro Zummo Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 693c10e6c1087e8f0ba0e2fd1a67adcff230a484 Author: Robert P. J. Day Date: Tue Sep 11 15:23:41 2007 -0700 H8/300: Fix misnamed "CONFIG_BLKDEV_RESERVE_ADDRESS" Kconfig variable Signed-off-by: Robert P. J. Day Acked-by: Satyam Sharma Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c811ac5366750568b0f412c95c6074dec20c69b2 Author: Rob Landley Date: Tue Sep 11 15:23:41 2007 -0700 Documentation/00-INDEX: notice ecryptfs.txt moved ecryptfs.txt moved into filesystems, make 00-INDEX follow. Signed-off-by: Rob Landley Cc: Michael Halcrow Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 868047fcbb85dbb44ddd98c336fef83236a2c06a Author: Matthew Wilcox Date: Tue Sep 11 15:23:38 2007 -0700 Fix DAC960 driver on machines which don't support 64-bit DMA Addresses http://bugzilla.kernel.org/show_bug.cgi?id=8942 Use PCI_DMA_* constants instead of own private definitions Fall back to 32-bit DMA mask if a 64-bit one fails Signed-off-by: Matthew Wilcox Acked-by: Jeff Garzik Tested-by: Lars Cc: Alessandro Polverini Cc: Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a1a1a758bf0107d1f78ff1d622f45987803d894 Author: Andreas Gruenbacher Date: Tue Sep 11 15:23:37 2007 -0700 afs: mntput called before dput dput must be called before mntput here. Signed-off-by: Andreas Gruenbacher Acked-By: David Howells Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a2e0855182e2be26b252745b2bb7558705cb0dd2 Author: NeilBrown Date: Tue Sep 11 15:23:36 2007 -0700 md: fix some bugs with growing raid5/raid6 arrays. The recent changed to raid5 to allow offload of parity calculation etc introduced some bugs in the code for growing (i.e. adding a disk to) raid5 and raid6. This fixes them Acked-by: Dan Williams Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b70ae1d9f69ba52767af89f90fd79587669bc7ff Author: Bjorn Helgaas Date: Tue Sep 11 15:23:35 2007 -0700 PNP: remove SMCf010 quirk If the quirk enables the SIR part of the SMCf010 device, the 8250 driver may claim it as a legacy ttyS device, which makes the legacy probe in the smsc-ircc2 driver fail. Signed-off-by: Bjorn Helgaas Cc: Andrey Borzenkov Cc: Michal Piotrowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 719b6f29fc2064eeeaa360ca06ce11aa207606fb Author: Thiemo Seufer Date: Tue Sep 11 15:23:33 2007 -0700 BCM1480 serial build fix Restores serial functionality for the BCM1480. Signed-off-by: Thiemo Seufer Signed-off-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f9b5a5d193c3f0bc2a8331d95e0e74d76eb8ee2c Author: Aristeu Rozanski Date: Tue Sep 11 15:23:32 2007 -0700 drivers/edac: fix e752x correct return code This patch changes the error code when dev0:fun1 was hidden by BIOS to one more appropriate. Signed-off-by: Aristeu Rozanski Signed-off-by: Mark Gross Signed-off-by: Doug Thompson Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3c8bb2cfa2d6b3dbf7a69641587152a60a96f03b Author: Doug Thompson Date: Tue Sep 11 15:23:31 2007 -0700 drivers/edac: fix printk level down to debug from emerg When EDAC is configured for EDAC DEBUGGING, the debug printk output level was set TOO high (EMERG). This patch brings it down to a DEBUG level Signed-off-by: Doug Thompson Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65e213cdb2e52ba03e61c4d855293054bd8de632 Author: Jan Andersson Date: Tue Sep 11 15:23:30 2007 -0700 spi_mpc83xx: hang fix When the spi_mpc83xx driver receives a tx_buf pointer which is NULL, it only writes one zero filled word to the transmit register. If the driver expects to receive more than one word it will wait forever for a second receive interrupt. With this patch the controller will shift out zeroes until all words have been received. Signed-off-by: Jan Andersson Tested-by: Anton Vorontsov Signed-off-by: David Brownell Acked-by: Kumar Gala Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9c3013e9b91ad23ecae88e45405e98208cce455d Author: Jan Kara Date: Tue Sep 11 15:23:29 2007 -0700 quota: fix infinite loop If we fail to start a transaction when releasing dquot, we have to call dquot_release() anyway to mark dquot structure as inactive. Otherwise we end in an infinite loop inside dqput(). Signed-off-by: Jan Kara Cc: xb Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df96efd73b81b8bc2d23b3d8b6025cce3d43db6c Author: Yoichi Yuasa Date: Tue Sep 11 22:24:45 2007 +0100 leds: Add missing include for leds.h This patch has added #include to include/linux/leds.h for rwlock_t. Signed-off-by: Yoichi Yuasa Signed-off-by: Richard Purdie commit 56fe23d5a702a39ee3bb29a04b55db292479d07a Author: Mikael Pettersson Date: Tue Sep 11 22:28:37 2007 +0200 pdc202xx_new: PLL detection fix Fix a bitmask typo in the pdc202xx_new PLL frequency detection code which causes it to truncate an intermediate difference to 26 bits instead of the correct 30 bits (the PLL's bitwidth). Signed-off-by: Mikael Pettersson Signed-off-by: Bartlomiej Zolnierkiewicz commit 58e47bb1767aa89bfa9cf7ecf4bc051886ae22b3 Author: Bartlomiej Zolnierkiewicz Date: Tue Sep 11 22:28:37 2007 +0200 via82cxxx: add Arima W730-K8 and other rebadgings to short cables list Port of Alan's patch for pata_via.c. Cc: Alan Cox Cc: Mikael Pettersson Signed-off-by: Bartlomiej Zolnierkiewicz commit 6c28c1f59dce3325d373f44766e23eb4237a74c8 Author: Tony Breeds Date: Tue Sep 11 22:28:36 2007 +0200 pmac: build fix Ensure that BLK_DEV_IDE is built-in before allowing BLK_DEV_IDE_PMAC to be selected. Signed-off-by: Tony Breeds Cc: Bret Towe Signed-off-by: Bartlomiej Zolnierkiewicz commit 03e6f489b32c0e7877bfe48f5619db725edf1fea Author: Daniel Exner Date: Tue Sep 11 22:28:36 2007 +0200 pata_ali/alim15x3: override 80-wire cable detection for Toshiba S1800-814 Add Toshiba S1800-814 to whitelist for both pata_ali and alim15x3, as it is correctly detected as 40-wire connected but this cable is short enough to still use transfer modes higher than UDMA33. Signed-off-by: Daniel Exner Cc: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit 2808b0a96a05ac8e826b5380eb2d30a10586707a Author: Sergei Shtylyov Date: Tue Sep 11 22:28:36 2007 +0200 hpt366: UltraDMA filter for SATA cards (take 2) The Marvell bridge chips used on HighPoint SATA cards do not seem to support the UltraDMA modes 1, 2, and 3 as well as any MWDMA modes, so the driver needs to account for this in the udma_filter() method. In order to achieve that, do the following changes: - install the method for all chips, not only HPT36x/370 and improve the code formatting by killing the extra tabs while at it; - add to the end of the 'switch' statement in the method cases for HPT372[AN] and HPT374 chips upon which the known SATA cards are based; - use hwif->ultra_mask as a default mask for the ide_dma_filter() method to behave correctly; - move the HPT370[A] cases below the HPT36x case for consistency. While at it, replace the explicit UltraDMA mode masks with ATA_UDMA* constants all over the driver... Signed-off-by: Sergei Shtylyov Cc: Bob Ham Signed-off-by: Bartlomiej Zolnierkiewicz commit 6c3c22f3cb2b7cd0a42a024b93db76b5c3133d37 Author: Sergei Shtylyov Date: Tue Sep 11 22:28:36 2007 +0200 ide: add ide_dev_is_sata() helper (take 2) Make the SATA drive detection code from eighty_ninty_three() into inline ide_dev_is_sata() helper fixing it along the way to be more strict while checking word 80 for the reserved values... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 7293136810936bbde403bcb67ac1b4dbae4dd790 Author: Sergei Shtylyov Date: Tue Sep 11 22:28:35 2007 +0200 hpt366: fix PCI clock detection for HPT374 (take 4) HPT374 BIOS seems to only save f_CNT register value for the function #0 before re-tuning DPLL (that causes the driver to report obviously distorted f_CNT for the function #1) -- fix this by always reading the saved f_CNT register value from the function #0 in the driver's init_chipset() method. While at it, introduce 'chip_type' for holding the 'struct hpt_info' field of the same name and replace the structure assignment with memcpy()... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 35198234a26fdc0f858774e3ba143796323059a0 Author: Sergei Shtylyov Date: Tue Sep 11 22:28:34 2007 +0200 pdc202xx_new: fix PCI refcounting The driver erroneously "lets go" the mate IDE chip in init_setup_pdc20270() when ide_setup_pci_devices() call succeeds -- fix this, and drop a couple of useless assignments in this function while at it... Bart: keep "findev" variable initialization to silence gcc Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 0505b55fb51fa289027f33ae793995c191277536 Author: Sergei Shtylyov Date: Tue Sep 11 22:28:34 2007 +0200 ide: fix PCI refcounting The IDE core never marked the PCI IDE devices as being in use after succesfull driver probe call (the devices were marked in use only while being probed), and so was susceptible to issues caused by unsolicited PCI hotplug device removal. So, add pci_dev_get() call to ide_scan_pcidev() and convert this function to the kernel style, also dropping a bunch of useless curly braces from its caller, ide_scan_pcibus() and somewhat beautifying printk() call there, while at it... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit dc4b6fd620aec395048b2877daca87ba7bfcd5e0 Author: Kumar Gala Date: Tue Sep 11 22:28:33 2007 +0200 mpc8xx: Only build mpc8xx on arch/ppc Currently the mpc8xx ide driver will only work on arch/ppc so only allow it to be built there. Also, killed a minor include that isn't actually used by the driver. Signed-off-by: Kumar Gala Cc: Paul Mackerras Signed-off-by: Bartlomiej Zolnierkiewicz commit e535e2efd295c3990bb9f654c8bb6bd176ebdc2b Author: Mark Fasheh Date: Fri Aug 31 10:23:41 2007 -0700 ocfs2: Fix calculation of i_blocks during truncate We were setting i_blocks too early - before truncating any allocation. Correct things to set i_blocks after the allocation change. Signed-off-by: Mark Fasheh commit 30b8548f2c270c0205558fe4826a6ab8e7fe51ad Author: tao.ma@oracle.com Date: Thu Sep 6 08:02:25 2007 +0800 [PATCH] ocfs2: Fix a wrong cluster calculation. In ocfs2_alloc_write_write_ctxt, the written clusters length is calculated by the byte length only. This may cause some problems if we start to write at some position in the end of one cluster and last to a second cluster while the "len" is smaller than a cluster size. In that case, we have to write 2 clusters actually. So we have to take the start position into consideration also. Signed-off-by: Tao Ma Signed-off-by: Mark Fasheh commit c0123adef626607535f3c2c93b530c36780885e0 Author: Tiger Yang Date: Sat Sep 8 00:16:10 2007 +0800 [PATCH] ocfs2: fix mount option parsing For some mount option types, ocfs2_parse_options() will try to access sb->s_fs_info to get at the ocfs2 private superblock. Unfortunately, that hasn't been allocated yet and will cause a kernel crash. Fix this by storing options in a struct which can then get pushed into the ocfs2_super once it's been allocated later. If we need more options which store to the ocfs2_super in the future, we can just fields to this struct. Signed-off-by: Tiger Yang Signed-off-by: Mark Fasheh commit 10b0845bed2b93f88d9758880a0a0e53f50c5139 Author: Mark Fasheh Date: Thu Aug 23 11:17:55 2007 -0700 ocfs2: update docs for new features Update documentation listing ocfs2 features to reflect the current state of the file system. Add missing descriptions for some mount options which ocfs2 supports. Signed-off-by: Mark Fasheh commit b868868ae0f7272228c95cc760338ffe35bb739d Author: Ralf Baechle Date: Tue Sep 11 18:05:33 2007 +0100 [MIPS] Fix aliasing bug in copy_user_highpage. Copy_user_highpage was written assuming it was only being called for breaking COW pages in which case the source page isn't cached as in marked cachable under it kernel virtual address. If it is called anyway the aliasing avoidance strategy implemented by kmap_coherent will fail. Avoid the use of kmap_coherent for pages marked dirty and to avoid another instance of this sort of bug, place a BUG_ON in kmap_coherent. Signed-off-by: Ralf Baechle commit 01e9943c79ad4edb2c0b76c99029e34d704223ce Author: Thomas Bogendoerfer Date: Tue Sep 11 12:43:55 2007 +0200 [MIPS] IP22: fix wrong argument order Fix wrong argument order; this is just a minimal fix for the half baked redadb/writeb() conversion. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Ralf Baechle commit 0ba8bc60ca482d678fcc63af44b243de6555dab5 Author: Thomas Bogendoerfer Date: Tue Sep 11 12:46:03 2007 +0200 [MIPS] IP22: Fix wrong check for second HPC Wrong check for the second hpc on fullhouse machines, caused DBEs on SGI Indys Signed-off-by: Thomas Bogendoerfer Signed-off-by: Ralf Baechle commit 98f9085405b059d1e1915fbb9b861d9efcd7c597 Author: Yoichi Yuasa Date: Thu Sep 6 21:32:57 2007 +0900 [MIPS] Ocelot: remove remaining bits Signed-off-by: Yoichi Yuasa Signed-off-by: Ralf Baechle commit d6698a2cd6ba23f5f73b0115c277dca8341af4a0 Author: Thiemo Seufer Date: Wed Sep 5 12:11:22 2007 +0100 [MIPS] TLB: Fix instruction bitmasks Signed-Off-By: Thiemo Seufer Signed-off-by: Ralf Baechle commit 8bce4e9de113e2957c74cc4ce36fbd6eff47d24d Author: Maxime Bizon Date: Fri Aug 31 11:03:14 2007 +0200 [MIPS] R10000: Fix wrong test in dma-default.c Signed-off-by: Maxime Bizon Signed-off-by: Ralf Baechle commit 4af2b1454da7a2feec071a6a50dd957df7d0b7a7 Author: Ralf Baechle Date: Mon Sep 3 16:22:26 2007 +0200 [MIPS] Provide empty irq_enable_hazard definition for legacy and R1 cores. Following a strict interpretation the empty definition of irq_enable_hazard has always been a bug - but an intentional one because it didn't bite. This has now changed, for uniprocessor kernels mm/slab.c:do_drain() [...] on_each_cpu(do_drain, cachep, 1, 1); check_irq_on(); [...] may be compiled into a mtc0 c0_status; mfc0 c0_status sequence resulting in a back-to-back hazard. Signed-off-by: Ralf Baechle commit 76e7f79950b54eb17f4041d020811331b7ae1a9e Author: Ralf Baechle Date: Thu Aug 30 00:58:53 2007 +0100 [MIPS] Sibyte: Remove broken dependency on EXPERIMENTAL from SIBYTE_SB1xxx_SOC. Otherwise Kconfig will produce a nonsenical .config for a kernel that is neither 32-bit nor 64-bit. Signed-off-by: Ralf Baechle commit ad015f41e1ea7c64bb8b25c46c33bb049ec54f71 Author: Ralf Baechle Date: Wed Aug 29 14:21:45 2007 +0100 [MIPS] Kconfig: whitespace cleanup. Signed-off-by: Ralf Baechle commit 41f9c78c2e599d3a50cf092eda2d1c2d5962bda8 Author: Ralf Baechle Date: Wed Aug 29 08:34:39 2007 +0100 [MIPS] PCI: Set need_domain_info if controller domain index is non-zero. This fixes this little funny: bigsur:/proc/bus/pci# ls -l total 0 dr-xr-xr-x 2 root root 0 Aug 28 19:31 00 dr-xr-xr-x 2 root root 0 Aug 28 19:31 00 dr-xr-xr-x 2 root root 0 Aug 28 19:31 01 dr-xr-xr-x 2 root root 0 Aug 28 19:31 03 -r--r--r-- 1 root root 0 Aug 28 19:31 devices Signed-off-by: Ralf Baechle commit 28e18a0f691b3737f73ab9033ded6a4da6c31b2f Author: Ralf Baechle Date: Wed Aug 29 00:38:13 2007 +0100 [MIPS] BCM1480: Fix computation of interrupt mask address register. CC arch/mips/sibyte/bcm1480/irq.o arch/mips/sibyte/bcm1480/irq.c: In function 'bcm1480_mask_irq': arch/mips/sibyte/bcm1480/irq.c:112: warning: cast to pointer from integer of different size arch/mips/sibyte/bcm1480/irq.c:114: warning: cast to pointer from integer of different size arch/mips/sibyte/bcm1480/irq.c: In function 'bcm1480_unmask_irq': arch/mips/sibyte/bcm1480/irq.c:130: warning: cast to pointer from integer of different size arch/mips/sibyte/bcm1480/irq.c:132: warning: cast to pointer from integer of different size Signed-off-by: Ralf Baechle commit 045e4bb2bafb7aa8141c2f8332ce31b224ac3bb0 Author: Kyungmin Park Date: Fri Aug 10 14:00:21 2007 -0700 [MIPS] i8259: Add disable method. After 76d2160147f43f982dfe881404cfde9fd0a9da21, the qemu NE2000 was frequently producing WATCHDOG timeouts. Signed-off-by: Kyungmin Park Cc: Ralf Baechle Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Ralf Baechle commit dafd49fc6cf68f815a4c2838c2c1407678d82e51 Author: Alan Cox Date: Fri Aug 10 14:00:20 2007 -0700 [MIPS] tty: add the new ioctls and definitions. Same as all the others, just put in the constants for the existing kernel code and termios2 structure Signed-off-by: Alan Cox Acked-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Ralf Baechle commit e0cda54e4414e98f0bf72116d8522f4e434f6b4b Author: Anti Sullin Date: Thu Aug 30 16:15:16 2007 +0200 bug in AT91 MCI suspend routines This patch fixes a bug in AT91 mmc host driver, that enables the wakeup from suspend on card detection pin even if the card detect pin is not available (==0). If not card detection pin is defined, IRQ0 == FIQ gets enabled and if some activity is present on that pin, the system gets a FIQ request, that causes a crash. Signed-off-by: Anti Sullin Signed-off-by: Nicolas Ferre Signed-off-by: Pierre Ossman commit 03fc370bdc1b31f3d09bd88d65bc50c03f450a9d Author: Satyam Sharma Date: Mon Sep 3 01:42:43 2007 +0530 USB: drivers/usb/serial/bus.c: Fix incompatible pointer type warning drivers/usb/serial/bus.c: In function usb_serial_bus_deregister: drivers/usb/serial/bus.c:185: warning: passing argument 1 of free_dynids from incompatible pointer type Above build warning comes when CONFIG_HOTPLUG=n because argument of free_dynids() in serial/bus.c is a struct usb_serial_driver, not a struct usb_driver. This is not a runtime bug, because the function is an empty stub and never dereferences the passed pointer anyway. Signed-off-by: Satyam Sharma Signed-off-by: Greg Kroah-Hartman commit e6a20ff999fe849d1f5f15d5e14763f5a553778f Author: Oliver Neukum Date: Tue Aug 28 10:34:22 2007 +0200 USB: another quirky device (LCD display) this time it is an LCD. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 49b4f902857c3d8d95b47ae5a8cecb34ae96a3ba Author: David Brownell Date: Sun Aug 26 12:44:24 2007 -0700 USB: fix serial gadget ACM breakage Two of the CDC ACM control requests in the serial gadget have never been correct, and have been reported to cause serious troubles ... as in, soft lockup and maybe watchdog reset (depending on hardware). This patch makes those request fail cleanly, rather than misbehaving. Someone using CDC ACM should fix them according to the FIXME comments which now replace the previous bugs. Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 86833691c21efba661bd3512d2ebfa0b96c011c5 Author: Lamarque Vieira Souza Date: Tue Sep 4 12:15:08 2007 -0300 USB: More USB_QUIRK_RESET_RESUME devices I would like have the attached patch added to Linux kernel. The three usb flash memories listed in the patch are being used in Intel's ClassmatePC and need USB_QUIRK_RESET_RESUME to work reliably when resuming from ram. commit c4766560e4d3e2a9c10d69d7d618dc2b0082a3dc Author: Massimiliano Ghilardi Date: Tue Sep 4 22:53:43 2007 +0200 USB Mass Storage: limit "Rockchip ROCK MP3" device (071b:3203) max I/O to 64 sectors per command The MP3/MP4/AVI player "Rockchip ROCK MP3" is seen as a USB disk, but fails if more than 128 sectors (64kB) are sent or requested in a single read or write command, and disconnects from the USB bus. Typical kernel log showing the problem is: usb 3-1: reset high speed USB device using ehci_hcd and address 6 usb 3-1: reset high speed USB device using ehci_hcd and address 6 sd 14:0:0:0: [sdb] Result: hostbyte=0x07 driverbyte=0x00 end_request: I/O error, dev sdb, sector 32 sd 14:0:0:0: [sdb] Result: hostbyte=0x07 driverbyte=0x00 end_request: I/O error, dev sdb, sector 32 usb 3-1: USB disconnect, address 6 This patch works around the device limitation by adding "Rockchip ROCK MP3" to unusual USB devices list and limiting data transfers to 64 sectors (32kB) per command. Tested on 2.6.23-rc5 (amd64). Signed-off-by: Massimiliano Ghilardi Signed-off-by: Greg Kroah-Hartman commit 9374b9fd6cef7f8b75a543d044c5b0925aae08cd Author: Ortwin Glück Date: Thu Sep 6 00:06:26 2007 +0200 USB: Nikon D40 Quirks The D40 needs the same quirks as the other (semi-)professional Nikon cameras. The patch is against 2.6.23-rc5. Details: http://bugs.gentoo.org/show_bug.cgi?id=191431 From: Ortwin Glück Signed-off-by: Greg Kroah-Hartman commit 61392af387787dfa2b381880d195dfb7ab0d1ea3 Author: Ricardo Barberis Date: Wed Sep 5 22:37:19 2007 -0700 USB: Add Sony Ericsson P1i to unusual_devs.h Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 2c4cd1f13a658daacb4fe5ed88887675c31ae78f Author: Greg Kroah-Hartman Date: Thu Aug 30 19:02:10 2007 +0200 USB: option: Add Dell HSDPA 5520 to driver This is based on information sent in by Christian Gothe. Cc: Christian Gothe Signed-off-by: Greg Kroah-Hartman commit a3209a0efc404cc4190b496bae247e7706371032 Author: Jaime Velasco Juan Date: Fri Sep 7 19:06:39 2007 +0100 USB: option: Add a new device ID for the HUAWEI E220 HSDPA modem. Signed-off-by: Jaime Velasco Juan CC: Matthias Urlichs Signed-off-by: Greg Kroah-Hartman commit e5dd01154c1e9ca2400f4682602d1a4fa54c25dd Author: Nathael Pajani Date: Tue Sep 4 11:46:23 2007 +0200 USB: fix linked list insertion bugfix for usb core This patch fixes the order of list_add_tail() arguments in usb_store_new_id() so the list can have more than one single element. Signed-off-by: Nathael Pajani Cc: stable Signed-off-by: Greg Kroah-Hartman commit ce05916f6bf9906fba88853078715f9a4d300237 Author: Oliver Neukum Date: Tue Sep 4 16:11:41 2007 +0200 USB: quirky flash drive That drive is quite odd. It has 2K sectors, times out getting string descriptors and needs a quirk. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit c269b6abd65c24517b70ccc9430c4c50dbc0dc84 Author: Alan Stern Date: Tue Sep 4 10:12:44 2007 -0400 USB: prevent Genesys USB-IDE from autosuspending This patch (as986) prevents the troublesome Genesys USB-IDE adapter from autosuspending. It may not be necessary for all such devices, but the one in Bugzilla #8892 sometimes fails to resume. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit d7790baf62a0e9f034e4668bb4b5fdaaa248412b Author: Alan Stern Date: Tue Sep 4 10:11:56 2007 -0400 USB: prevent Thomson card reader from autosuspending This patch (as985) prevents the SGS THomson Microelectronics 4in1 card reader from autosuspending. This resolves Bugzilla #8885. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit a74108d33878078b9403e5426a04c54683a8ebc2 Author: Matt Colyer Date: Tue Aug 28 23:33:52 2007 -0700 USB: Add iPhone device id to the quirk list. commit d7fde2d6729482e093b18a74fc24c4c2c0c61ca5 Author: Pierre Castella Date: Thu Sep 6 22:34:39 2007 +0200 USB: ftdi_sio: add of a new product/manufacturer, TML I have added to a new product based on the FTDI 232R USB/Serial transceiver, which is commercialized by The Mobility Lab. Here is a trivial patch enclosed, against 2.6.22.6 kernel. Signed-off-by: Pierre Castella Signed-off-by: Greg Kroah-Hartman commit ca9024eb6ca31df971c5fa40bf4bee2d913115e2 Author: samson yeung Date: Fri Aug 31 16:40:40 2007 -0400 usb/misc/sisusbvga: add product ID of TARGUS/MCT device Device is Targus ACP50US which includes a Magic Control Technologies usb vga device using the SiS315(E) or compatible. Signed-off-by: Samson Yeung Signed-off-by: Greg Kroah-Hartman commit fa0e6721e7931f5bb0293db982b327b0dff97596 Author: Alan Cox Date: Wed Aug 22 23:11:06 2007 +0100 USB: oti6858: Remove broken ioctl code in -mm tree and also the broken fixes This stuff is simply not needed. Signed-off-by: Alan Cox Cc: stable Signed-off-by: Greg Kroah-Hartman commit 99fa9844f0eed5582b5648f745204758b27db659 Author: Jason Gaston Date: Thu Aug 30 17:50:56 2007 -0700 PCI: irq and pci_ids patch for Intel Tolapai This patch adds the Intel Tolapai LPC and SMBus Controller DID's. Signed-off-by: Jason Gaston Signed-off-by: Greg Kroah-Hartman commit d7698edca8d372e9ecaebca82d236828d72ea39d Author: gw.kernel@tnode.com Date: Thu Aug 23 21:22:04 2007 +0200 PCI: unhide SMBus on Compaq Deskpro EP 401963-001 motherboard PCI quirk to unhide SMBus on Compaq Deskpro EP 401963-001 (PCA# 010174) motherboard. Signed-off-by: Greg White Acked-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 4dd5bb987367d791e10e716538d83edb24c0817d Author: Ralf Baechle Date: Thu Aug 23 19:45:49 2007 +0100 PCI: Remove __devinit from pcibios_get_irq_routing_table pcibios_get_irq_routing_table is an exported symbol. This results in a modpost warning: WARNING: vmlinux.o(.text+0xdca51): Section mismatch: reference to .init.text:pcibios_fixup_bus (between 'pci_scan_child_bus' and 'pci_scan_bus_parented') Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit e365c3e75ef00a78bd38757a9da12e84039c2828 Author: Ralf Baechle Date: Thu Aug 23 18:49:17 2007 +0100 PCI: remove devinit from pci_read_bridge_bases On MIPS with PCI && !HOTPLUG, I'm currently getting the following modpost warning: MODPOST vmlinux.o WARNING: vmlinux.o(.text+0x1ce128): Section mismatch: reference to .init.text:pci_read_bridge_bases (between 'pcibios_fixup_bus' and 'pcibios_enable_device') On MIPS I have the call chains pci_scan_child_bus -> pcibios_fixup_bus -> pci_read_bridge_bases. pci_scan_child_bus can't be __devinit because it it is an exported symbol, thus pcibios_fixup_bus and pci_read_bridge_bases can't be either. For some reason I don't see this issue on x86; I blame compiler differences. Signed-off-by: Ralf Baechle Signed-off-by: Greg Kroah-Hartman commit 5547bbeed37f7ab64942ffcce9293681101577ef Author: Randy Dunlap Date: Thu Aug 23 10:37:53 2007 -0700 PCI AER: fix warnings when PCIEAER=n Fix warnings when CONFIG_PCIEAER=n: drivers/pci/pcie/portdrv_pci.c:105: warning: statement with no effect drivers/pci/pcie/portdrv_pci.c:226: warning: statement with no effect drivers/scsi/arcmsr/arcmsr_hba.c:352: warning: statement with no effect Signed-off-by: Randy Dunlap Acked-by: Linas Vepstas Signed-off-by: Greg Kroah-Hartman commit 0a9c73014415d2a84dac346c1e12169142a6ad37 Author: Patrick McHardy Date: Tue Sep 11 11:33:28 2007 +0200 [INET_DIAG]: Fix oops in netlink_rcv_skb netlink_run_queue() doesn't handle multiple processes processing the queue concurrently. Serialize queue processing in inet_diag to fix a oops in netlink_rcv_skb caused by netlink_run_queue passing a NULL for the skb. BUG: unable to handle kernel NULL pointer dereference at virtual address 00000054 [349587.500454] printing eip: [349587.500457] c03318ae [349587.500459] *pde = 00000000 [349587.500464] Oops: 0000 [#1] [349587.500466] PREEMPT SMP [349587.500474] Modules linked in: w83627hf hwmon_vid i2c_isa [349587.500483] CPU: 0 [349587.500485] EIP: 0060:[] Not tainted VLI [349587.500487] EFLAGS: 00010246 (2.6.22.3 #1) [349587.500499] EIP is at netlink_rcv_skb+0xa/0x7e [349587.500506] eax: 00000000 ebx: 00000000 ecx: c148d2a0 edx: c0398819 [349587.500510] esi: 00000000 edi: c0398819 ebp: c7a21c8c esp: c7a21c80 [349587.500517] ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0068 [349587.500521] Process oidentd (pid: 17943, ti=c7a20000 task=cee231c0 task.ti=c7a20000) [349587.500527] Stack: 00000000 c7a21cac f7c8ba78 c7a21ca4 c0331962 c0398819 f7c8ba00 0000004c [349587.500542] f736f000 c7a21cb4 c03988e3 00000001 f7c8ba00 c7a21cc4 c03312a5 0000004c [349587.500558] f7c8ba00 c7a21cd4 c0330681 f7c8ba00 e4695280 c7a21d00 c03307c6 7fffffff [349587.500578] Call Trace: [349587.500581] [] show_trace_log_lvl+0x1c/0x33 [349587.500591] [] show_stack_log_lvl+0x8d/0xaa [349587.500595] [] show_registers+0x1cb/0x321 [349587.500604] [] die+0x112/0x1e1 [349587.500607] [] do_page_fault+0x229/0x565 [349587.500618] [] error_code+0x72/0x78 [349587.500625] [] netlink_run_queue+0x40/0x76 [349587.500632] [] inet_diag_rcv+0x1f/0x2c [349587.500639] [] netlink_data_ready+0x57/0x59 [349587.500643] [] netlink_sendskb+0x24/0x45 [349587.500651] [] netlink_unicast+0x100/0x116 [349587.500656] [] netlink_sendmsg+0x1c2/0x280 [349587.500664] [] sock_sendmsg+0xba/0xd5 [349587.500671] [] sys_sendmsg+0x17b/0x1e8 [349587.500676] [] sys_socketcall+0x230/0x24d [349587.500684] [] syscall_call+0x7/0xb [349587.500691] ======================= [349587.500693] Code: f0 ff 4e 18 0f 94 c0 84 c0 0f 84 66 ff ff ff 89 f0 e8 86 e2 fc ff e9 5a ff ff ff f0 ff 40 10 eb be 55 89 e5 57 89 d7 56 89 c6 53 <8b> 50 54 83 fa 10 72 55 8b 9e 9c 00 00 00 31 c9 8b 03 83 f8 0f Reported by Athanasius Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit e1f52208bb968291f7d9142eff60b62984b4a511 Author: YOSHIFUJI Hideaki Date: Tue Sep 11 11:31:43 2007 +0200 [IPv6]: Fix NULL pointer dereference in ip6_flush_pending_frames Some of skbs in sk->write_queue do not have skb->dst because we do not fill skb->dst when we allocate new skb in append_data(). BTW, I think we may not need to (or we should not) increment some stats when using corking; if 100 sendmsg() (with MSG_MORE) result in 2 packets, how many should we increment? If 100, we should set skb->dst for every queued skbs. If 1 (or 2 (*)), we increment the stats for the first queued skb and we should just skip incrementing OutDiscards for the rest of queued skbs, adn we should also impelement this semantics in other places; e.g., we should increment other stats just once, not 100 times. *: depends on the place we are discarding the datagram. I guess should just increment by 1 (or 2). Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit 16fcec35e7d7c4faaa4709f6434a4a25b06d25e3 Author: Neil Horman Date: Tue Sep 11 11:28:26 2007 +0200 [NETFILTER]: Fix/improve deadlock condition on module removal netfilter So I've had a deadlock reported to me. I've found that the sequence of events goes like this: 1) process A (modprobe) runs to remove ip_tables.ko 2) process B (iptables-restore) runs and calls setsockopt on a netfilter socket, increasing the ip_tables socket_ops use count 3) process A acquires a file lock on the file ip_tables.ko, calls remove_module in the kernel, which in turn executes the ip_tables module cleanup routine, which calls nf_unregister_sockopt 4) nf_unregister_sockopt, seeing that the use count is non-zero, puts the calling process into uninterruptible sleep, expecting the process using the socket option code to wake it up when it exits the kernel 4) the user of the socket option code (process B) in do_ipt_get_ctl, calls ipt_find_table_lock, which in this case calls request_module to load ip_tables_nat.ko 5) request_module forks a copy of modprobe (process C) to load the module and blocks until modprobe exits. 6) Process C. forked by request_module process the dependencies of ip_tables_nat.ko, of which ip_tables.ko is one. 7) Process C attempts to lock the request module and all its dependencies, it blocks when it attempts to lock ip_tables.ko (which was previously locked in step 3) Theres not really any great permanent solution to this that I can see, but I've developed a two part solution that corrects the problem Part 1) Modifies the nf_sockopt registration code so that, instead of using a use counter internal to the nf_sockopt_ops structure, we instead use a pointer to the registering modules owner to do module reference counting when nf_sockopt calls a modules set/get routine. This prevents the deadlock by preventing set 4 from happening. Part 2) Enhances the modprobe utilty so that by default it preforms non-blocking remove operations (the same way rmmod does), and add an option to explicity request blocking operation. So if you select blocking operation in modprobe you can still cause the above deadlock, but only if you explicity try (and since root can do any old stupid thing it would like.... :) ). Signed-off-by: Neil Horman Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 0fb96701376874c9f1f80322f89a5bf4457c709f Author: Patrick McHardy Date: Tue Sep 11 11:27:01 2007 +0200 [NETFILTER]: nf_conntrack_ipv4: fix "Frag of proto ..." messages Since we're now using a generic tuple decoding function in ICMP connection tracking, ipv4_get_l4proto() might get called with a fragmented packet from within an ICMP error. Remove the error message we used to print when this happens. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit fdd8a532a6764393305ae7063a8994d71404c482 Author: Peter P Waskiewicz Jr Date: Tue Sep 11 11:12:06 2007 +0200 [NET] DOC: Update networking/multiqueue.txt with correct information. Updated the multiqueue.txt document to call out the correct kernel options to select to enable multiqueue. Signed-off-by: Peter P Waskiewicz Jr Signed-off-by: David S. Miller commit 9e3be4b34364a670bd6e57d2e8c3caabdd8d89f8 Author: Denis V. Lunev Date: Tue Sep 11 11:04:49 2007 +0200 [IPV6]: Freeing alive inet6 address From: Denis V. Lunev addrconf_dad_failure calls addrconf_dad_stop which takes referenced address and drops the count. So, in6_ifa_put perrformed at out: is extra. This results in message: "Freeing alive inet6 address" and not released dst entries. Signed-off-by: Denis V. Lunev Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit a2221f308dabb95abb914ad858d36c2462705558 Author: Patrick McHardy Date: Tue Sep 11 10:45:15 2007 +0200 [DECNET]: Fix interface address listing regression. Not all are listed, same as the IPV4 devinet bug. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 596e41509550447b030f7b16adaeb0138ab585a8 Author: Stephen Hemminger Date: Tue Sep 11 10:41:04 2007 +0200 [IPV4] devinet: show all addresses assigned to interface Bug: http://bugzilla.kernel.org/show_bug.cgi?id=8876 Not all ips are shown by "ip addr show" command when IPs number assigned to an interface is more than 60-80 (in fact it depends on broadcast/label etc presence on each address). Steps to reproduce: It's terribly simple to reproduce: # for i in $(seq 1 100); do ip ad add 10.0.$i.1/24 dev eth10 ; done # ip addr show this will _not_ show all IPs. Looks like the problem is in netlink/ipv4 message processing. This is fix from bug submitter, it looks correct. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit ef8aef55ce61fd0e2af798695f7386ac756ae1e7 Author: Herbert Xu Date: Thu Sep 6 14:06:35 2007 +0100 [NET]: Do not dereference iov if length is zero When msg_iovlen is zero we shouldn't try to dereference msg_iov. Right now the only thing that tries to do so is skb_copy_and_csum_datagram_iovec. Since the total length should also be zero if msg_iovlen is zero, it's sufficient to check the total length there and simply return if it's zero. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 2fbe43f6f631dd7ce19fb1499d6164a5bdb34568 Author: Michael Chan Date: Thu Sep 6 12:04:29 2007 +0100 [TG3]: Workaround MSI bug on 5714/5780. A hardware bug was revealed after a recent PCI MSI patch was made to always disable legacy INTX when enabling MSI. The 5714/5780 chips will not generate MSI when INTX is disabled, causing MSI failure messages to be reported, and another patch was made to workaround the problem by disabling MSI on ServerWorks HT1000 bridge chips commonly found with the 5714. We workaround this chip bug by enabling INTX after we enable MSI and after we resume from suspend. Update version to 3.81. This problem was discovered by David Miller. Signed-off-by: Michael Chan Acked-by: Andy Gospodarek Signed-off-by: David S. Miller commit 83fcdb4b352f74a8a74737aedeaf622c37140c73 Author: Scott Wood Date: Wed Sep 5 14:29:10 2007 -0500 [POWERPC] cpm2: Fix off-by-one error in setbrg(). The hardware adds one to the BRG value to get the divider, so it must be subtracted by software. Without this patch, characters will occasionally be corrupted. Signed-off-by: Scott Wood Signed-off-by: Kumar Gala commit 36c50f729b77144cae8d43457fefca66a4eeff6a Author: Jochen Friedrich Date: Tue Aug 28 13:20:48 2007 +0200 [PPC] 8xx: Fix r3 trashing due to 8MB TLB page instantiation Instantiation of 8MB pages on the TLB cache for the kernel static mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations. This ensures r3 gets saved and restored. This has been posted to linuxppc-embedded by Marcelo Tosatti , but only an incomplete version of the patch has been applied in c51e078f82096a7d35ac8ec2416272e843a0e1c4. This patch adds the rest of the fix. Signed-off-by: Jochen Friedrich Signed-off-by: Kumar Gala commit 2af8569dc9f29c303bf4aa012d991afcfaeed0c3 Author: Kumar Gala Date: Mon Sep 10 14:30:33 2007 -0500 [POWERPC] 8{5,6}xx: Fix build issue with !CONFIG_PCI We needed some ifdef CONFIG_PCI protection for pcibios_fixup so we can build !CONFIG_PCI. Signed-off-by: Kumar Gala commit 89f2783ded0a4fc98852cb9552bb27a80cd6a41a Author: Marcel Holtmann Date: Sun Sep 9 08:39:49 2007 +0200 [Bluetooth] Fix parameter list for event filter command On device initialization the event filters are cleared. In case of clearing the filters the extra condition type shall be omitted. Signed-off-by: Marcel Holtmann commit 7c631a67601f116d303cfb98a3d964a150090e38 Author: Marcel Holtmann Date: Sun Sep 9 08:39:43 2007 +0200 [Bluetooth] Update security filter for Bluetooth 2.1 This patch updates the HCI security filter with support for the Bluetooth 2.1 commands and events. Signed-off-by: Marcel Holtmann commit 767c5eb5d35aeb85987143f0a730bc21d3ecfb3d Author: Marcel Holtmann Date: Sun Sep 9 08:39:34 2007 +0200 [Bluetooth] Add compat handling for timestamp structure The timestamp structure needs special handling in case of compat programs. Use the same wrapping method the network core uses. Signed-off-by: Marcel Holtmann commit 26a4a06e7ff2874154eb3f4b4ba0514dc563b100 Author: Marcel Holtmann Date: Sun Sep 9 08:39:27 2007 +0200 [Bluetooth] Add missing stat.byte_rx counter modification With the support for hci_recv_fragment() the call to increase the stat.byte_rx counter got accidentally removed. This patch fixes it. Signed-off-by: Marcel Holtmann commit 7b6dff982b063b1b15c30508f16863e5449e7229 Author: Vladimir Shebordaev Date: Thu Sep 6 21:32:16 2007 -0400 Input: usbtouchscreen - correctly set 'phys' This patch fixes a nasty typo in usbtouchscreen driver. The typo is inherited from the original mtouchusb. It used to make the input subsytem to incorrectly report the physical device ids to userspace that in turn is very confusing for, e.g. XInput hotplug facilities in setups with multiple identical touchscreens. Signed-off-by: Vladimir Shebordaev Signed-off-by: Dmitry Torokhov commit 749aea73aaf4ff1dbd83c2021b57a4dde6bbe2b9 Author: Elvis Pranskevichus Date: Tue Sep 4 23:18:21 2007 -0400 Input: i8042 - add HP Pavilion DV4270ca to the MUX blacklist This fixes "atkbd.c: Suprious NAK on isa0060/serio0" errors for HP Pavilion DV4270ca. Signed-off-by: Elvis Pranskevichus Signed-off-by: Dmitry Torokhov commit 7a1904c32c5a18a1123fa0ea5040439337617877 Author: Ralf Baechle Date: Tue Sep 4 23:16:31 2007 -0400 Input: i8042 - fix modpost warning i8042_unregister_ports's only caller i8042_remove is a __devexit function so make it __devexit too. Signed-off-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Dmitry Torokhov commit 9e3d3d07de1a9f2b83299653b75bfdbc0a8118f2 Author: Samuel Thibault Date: Tue Sep 4 23:16:04 2007 -0400 Input: add more Braille keycodes Some braille keyboards have 10 dots, so extend the Input braille keys definitions. Signed-off-by: Samuel Thibault Signed-off-by: Dmitry Torokhov commit 66baf327ae5d4c17e75d1f501145e79eaeeaf649 Author: Henrique de Moraes Holschuh Date: Mon Sep 3 00:03:35 2007 -0300 ACPI: fix CONFIG_NET=n acpi_bus_generate_netlink_event build failure drivers/acpi/event.c:243: error: 'acpi_generate_netlink_event' undeclared here (not in a function) Signed-off-by: Henrique de Moraes Holschuh Signed-off-by: Len Brown commit cb90ab5b424e711390c2ef6f0882b615b042dcb6 Author: Jonathan Woithe Date: Wed Aug 29 15:58:19 2007 +0930 msi-laptop: replace ',' with ';' Signed-off-by: Jonathan Woithe Signed-off-by: Len Brown commit 134c21715ac3cb36db13c8d362cc80ccc87ee48d Author: Christian Borntraeger Date: Tue Aug 28 14:58:56 2007 -0400 ACPI: (more) delete CONFIG_ACPI_PROCFS_SLEEP (again) Commit 2bcf9dddeb8e79a4ba55bf191533f70f39ce ('ACPI: delete CONFIG_ACPI_PROCFS_SLEEP (again)') was incomplete. Signed-off-by: Christian Borntraeger Signed-off-by: Len Brown commit ebb2a97b2e7422176d52f4f33e3ee400653875b4 Author: Alan Cox Date: Wed Aug 22 10:54:43 2007 -0700 [patch 1/2] Xtensa: enable arbitary tty speed setting ioctls Adding the defines/constants activates the existing code in the tty layer and allows arbitary tty speeds to be requested on this platform Signed-off-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Chris Zankel commit 969f865f36b65c2fcd1fb1ba09b4a2c6f071f864 Author: Frederik Deweerdt Date: Wed Aug 22 10:47:58 2007 -0700 [patch 2/2] xtensa console.c: remove duplicate #include This patch removes one of the two linux/console.h included in arch/xtensa/platform-iss/console.c Signed-off-by: Frederik Deweerdt Signed-off-by: Andrew Morton Signed-off-by: Chris Zankel commit 6656920b0b50beacb6cb64cf55273cbb686e436e Author: Chris Zankel Date: Wed Aug 22 10:14:51 2007 -0700 [XTENSA] Add support for cache-aliasing Add support for processors that have cache-aliasing issues, such as the Stretch S5000 processor. Cache-aliasing means that the size of the cache (for one way) is larger than the page size, thus, a page can end up in several places in cache depending on the virtual to physical translation. The method used here is to map a user page temporarily through the auto-refill way 0 and of of the DTLB. We probably will want to revisit this issue and use a better approach with kmap/kunmap. Signed-off-by: Chris Zankel commit ff6fd469885aafa5ec387babcb6537f3c00d6df0 Author: Chris Zankel Date: Tue Aug 14 13:02:06 2007 -0700 [XTENSA] Add kernel module support Add kernel module support. Signed-off-by: Chris Zankel commit 01858d1b0b406307626bbc01238391b06aae2c20 Author: Chris Zankel Date: Mon Aug 6 23:57:57 2007 -0700 [XTENSA] Add support for executable/non-executable feature in the mmu Newer processor versions starting with Xtensa6/LX2 support an 'executable' bit for memory pages. This bit replaces the 'valid' bit, so it must be always set to one for older processor versions. To mark a page invalid, we now set the cache-attributes to b11, which is backward compatible. Signed-off-by: Chris Zankel commit 26465f2f4f5a253f22596fc9245a6bb5c0856ee1 Author: Chris Zankel Date: Mon Aug 6 23:12:24 2007 -0700 [XTENSA] Use the generic version of get_order Use the generic version of get_order for processor configurations that don't have the 'nsa/nsau' instructions. Signed-off-by: Chris Zankel commit 5c1c8085b5dc30ae4ff0ee54039e387ed59262bf Author: Chris Zankel Date: Sun Aug 5 11:51:57 2007 -0700 [XTENSA] Initialize semaphore_wake_lock Initialize semaphore_wake_lock. Signed-off-by: Chris Zankel commit 24a9ab7fa143498802b35c66de10cc3cfdac2c51 Author: Chris Zankel Date: Sun Aug 5 11:24:13 2007 -0700 [XTENSA] Add typecast macro for constants Add macros (__XTENSA_UL and __XTENSA_UL_CONST) for typecasting constants. Signed-off-by: Chris Zankel commit 2b8aea74e78e977b1f9987e23e3e59f3ef4359f4 Author: Chris Zankel Date: Sun Aug 5 10:26:30 2007 -0700 [XTENSA] Fix timer instabilities. The timer code could have missed a tick. Signed-off-by: Chris Zankel commit bc671aa9838f234ccfc794a77325628f1e41e083 Author: Chris Zankel Date: Sun Aug 5 10:22:58 2007 -0700 [XTENSA] Fix fadvise64_64 Xtensa passes long long arguments in a even/odd register pair, so we also need to shuffle the arguments when passed through the system call to avoid an empty argument register. Signed-off-by: Chris Zankel commit 068732d9b465cafcc56a745c3931f2fc4e58f48f Author: Chris Zankel Date: Sun Aug 5 10:16:54 2007 -0700 [XTENSA] Remove extraneous include statement We don't need to include processor.h in bug.h. Signed-off-by: Chris Zankel commit 787a22d1d284b21ad810fd0bedbdefb329f31cd2 Author: Chris Zankel Date: Sat Aug 4 14:31:04 2007 -0700 [XTENSA] Move string-io functions to io.c from pci.c The string-io functions (outs{bwl}, ins{bwl}) are independent from the PCI option and should be in a separate file. Signed-off-by: Chris Zankel commit 73089cbfdf0c69e061a4fa90d614679e630c6727 Author: Chris Zankel Date: Sat Aug 4 09:27:30 2007 -0700 [XTENSA] Move pre-initialized structures to init_task.c Move all initialization structures for the initial task to it's own file. Signed-off-by: Chris Zankel commit b2444d34a0e727a80fee4b725bc5ecb9d0f206f0 Author: Chris Zankel Date: Sat Aug 4 09:23:54 2007 -0700 [XTENSA] Add freestanding option to CFLAGS We also need to set the freestanding option for GCC in the CFLAGS. Signed-off-by: Chris Zankel commit cef9287ead2775e4d7eaa280a73ee99d7269c3e4 Author: Chris Zankel Date: Sat Aug 4 09:20:43 2007 -0700 [XTENSA] Add getpgrp system-call to unistd.h Although __ARCH_WANT_SYS_GETPGRP was defined, the actualy entry for the getpgrp system-call was missing. Signed-off-by: Chris Zankel commit 3547cdb1526aabd38b1e71dba93d545340fe41f8 Author: Chris Zankel Date: Fri Aug 3 15:55:07 2007 -0700 [XTENSA] add missing system calls Add missing system calls that have been recently added to the kernel for the Xtensa architecture and define __IGNORE macros for system calls that we don't need for Xtensa. Signed-off-by: Chris Zankel commit b91dc336cc7e0c9843f87ad0ba4cdbc821d69549 Author: Chris Zankel Date: Fri Aug 3 15:54:36 2007 -0700 [XTENSA] fix wrong usage of __init and __initdata in traps.c A variable was defined with __init instead of __initdata and the function accessing that variable wasn't initialized with __init. Signed-off-by: Chris Zankel commit 6724add1b5cfb020ba8f5532efe430d1ccd5fc30 Author: Mike Christie Date: Wed Aug 15 01:38:30 2007 -0500 [SCSI] libiscsi: sync up iscsi and scsi eh's access to the connection The iscsi eh could be tearing down the session/connection while the scsi eh is still sending task management functions. If when we drop the session lock to grab the recv lock, the iscsi eh tears down the connection we will oops. Signed-off-by: Mike Christie Signed-off-by: James Bottomley commit 96809f1b15eddae2325b2ab78e6f931edc969074 Author: Mike Christie Date: Wed Aug 15 01:38:29 2007 -0500 [SCSI] libiscsi: fix null ptr regression when aborting a command with data to transfer We do not want to send data if we are aborting a task. There is a check in iscsi_xmit_ctask, but right before calling this we overwrite the state so we always go right past the test. Sending data causes problems because when we clean up from a successful abort the LLD assumes that the task is not running. Signed-off-by: Mike Christie Signed-off-by: James Bottomley commit 604cd794de3094ccf8a9c149f299237a642ba9b5 Author: Andrew Vasquez Date: Sun Aug 12 18:22:57 2007 -0700 [SCSI] qla2xxx: Update version number to 8.02.00-k3. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 6afd9763c1b16f12653e5bcb9376886c82805bd5 Author: Andrew Vasquez Date: Sun Aug 12 18:22:56 2007 -0700 [SCSI] qla2xxx: Correct mailbox register dump for FWI2 capable ISPs. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit a3cbdfad15dee42eb2d17d28fd36447082278dc9 Author: Andrew Vasquez Date: Mon Aug 13 10:13:18 2007 -0700 [SCSI] qla2xxx: Correct 8GB iIDMA support. Original implementation manipulated the FC_GS values for port-speed. Transition the codes to use the driver's own internal representations as this makes for a reduction in duplicate 'conversion' codes throughout the driver. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 02d638b4b72af9ee617831066d6245c882da1ee0 Author: Andrew Vasquez Date: Sun Aug 12 18:22:54 2007 -0700 [SCSI] qla2xxx: Correct management-server login-state synchronization issue. Transitioning link-state via NOS/OLS requires a relogin to a fabric's Management Server. Request relogin when the firmware issues a point-to-point asynchronous event (0x8030). Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 8fef696b00b863c8c898293bd09be581b934849b Author: Andrew Vasquez Date: Sun Aug 12 18:22:53 2007 -0700 [SCSI] qla2xxx: Don't modify parity bits during ISP25XX restart. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 29856e2841ebc6dadff0db1032be14e467989452 Author: Andrew Vasquez Date: Sun Aug 12 18:22:52 2007 -0700 [SCSI] qla2xxx: Allocate enough space for the full PCI descriptor. Signed-off-by: Andrew Vasquez Signed-off-by: James Bottomley commit 9d212a4d20928f865b9a48e870d6ecef0e30175d Author: Heiko Carstens Date: Wed Aug 8 10:47:26 2007 +0200 [SCSI] zfcp: fix the data buffer accessor patch Fix the data buffer accessor patch. For request without a data buffer nothing was written into a SBALE. Signed-off-by: Heiko Carstens Signed-off-by: Swen Schillig Signed-off-by: James Bottomley commit 47b87b7948111fa95e99fbd60fc3255423b45809 Author: Heiko Carstens Date: Wed Aug 8 10:47:10 2007 +0200 [SCSI] zfcp: allocate gid_pn_data objects from gid_pn_cache allocate gid_pn_data objects from gid_pn_cache. Allocate gid_pn_data objects from the corresponding cache which ensures proper alignment. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Swen Schillig Signed-off-by: James Bottomley commit 83f6d6d7258974a99cbf465878bc11eb4d494c61 Author: Heiko Carstens Date: Wed Aug 8 10:47:02 2007 +0200 [SCSI] zfcp: fix memory leak fix memory leak. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky Signed-off-by: Swen Schillig Signed-off-by: James Bottomley commit e62687f995fd7ba0b68c3b0a4f4d9fd9d1c54ec2 Author: Robin Getz Date: Sun Aug 5 17:21:55 2007 +0800 Blackfin arch: fix the aliased write macros Signed-off-by: Robin Getz Signed-off-by: Bryan Wu commit 4bbd10fd312f50de74ba53f6cb968986da5dfe92 Author: Michael Hennerich Date: Mon Aug 27 17:29:10 2007 +0800 Blackfin arch: Update/Fix PM support add new pm_ops valid Signed-off-by: Michael Hennerich Signed-off-by: Bryan Wu