commit de46c33745f5e2ad594c72f2cf5f490861b16ce1 Author: Linus Torvalds Date: Wed Apr 25 20:08:32 2007 -0700 Linux 2.6.21 .. ok, enough waffling about it already. "Just do it!" Signed-off-by: Linus Torvalds commit cbc31a475a7f7748bd0a4e536533868e7cff8645 Author: Andrew Morton Date: Wed Apr 25 13:01:21 2007 -0700 packet: fix error handling The packet driver is assuming (reasonably) that the (undocumented) request.errors is an errno. But it is in fact some mysterious bitfield. When things go wrong we return weird positive numbers to the VFS as pointers and it goes oops. Thanks to William Heimbigner for reporting and diagnosis. (It doesn't oops, but this driver still doesn't work for William) Cc: William Heimbigner Cc: Peter Osterlund Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1194ed0a3eb8076c8fbfe310f1ccbf229e8647de Author: Alexey Kuznetsov Date: Wed Apr 25 13:07:28 2007 -0700 [NETLINK]: Infinite recursion in netlink. Reply to NETLINK_FIB_LOOKUP messages were misrouted back to kernel, which resulted in infinite recursion and stack overflow. The bug is present in all kernel versions since the feature appeared. The patch also makes some minimal cleanup: 1. Return something consistent (-ENOENT) when fib table is missing 2. Do not crash when queue is empty (does not happen, but yet) 3. Put result of lookup Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller commit 5044eed48886b105a123333fe7ca97c6bd496120 Author: Jens Axboe Date: Wed Apr 25 11:53:48 2007 +0200 cfq-iosched: fix alias + front merge bug There's a really rare and obscure bug in CFQ, that causes a crash in cfq_dispatch_insert() due to rq == NULL. One example of the resulting oops is seen here: http://lkml.org/lkml/2007/4/15/41 Neil correctly diagnosed the situation for how this can happen: if two concurrent requests with the exact same sector number (due to direct IO or aliasing between MD and the raw device access), the alias handling will add the request to the sortlist, but next_rq remains NULL. Read the more complete analysis at: http://lkml.org/lkml/2007/4/25/57 This looks like it requires md to trigger, even though it should potentially be possible to due with O_DIRECT (at least if you edit the kernel and doctor some of the unplug calls). The fix is to move the ->next_rq update to when we add a request to the rbtree. Then we remove the possibility for a request to exist in the rbtree code, but not have ->next_rq correctly updated. Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit a23cf14b161b8deeb0f701d577a0e8be6365e247 Author: YOSHIFUJI Hideaki Date: Wed Apr 25 11:13:49 2007 +0900 IPv6: fix Routing Header Type 0 handling thinko Oops, thinko. The test for accempting a RH0 was exatly the wrong way around. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: Linus Torvalds commit 68c9f75a0539db583db074059d54deb607d1a475 Author: Michael Chan Date: Tue Apr 24 15:35:53 2007 -0700 [BNX2]: Fix occasional NETDEV WATCHDOG on 5709. Tweak a register setting to prevent the tx mailbox from halting. Update version to 1.5.8. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 0bcbc92629044b5403719f77fb015e9005b1f504 Author: YOSHIFUJI Hideaki Date: Tue Apr 24 14:58:30 2007 -0700 [IPV6]: Disallow RH0 by default. A security issue is emerging. Disallow Routing Header Type 0 by default as we have been doing for IPv4. Note: We allow RH2 by default because it is harmless. Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit 6f4c5bdef2943d9ec074be32c437ca897016aaad Author: Ralf Baechle Date: Tue Apr 24 21:42:20 2007 +0100 [MIPS] Fix oprofile logic to physical counter remapping This did cause oprofile to fail on non-multithreaded systems with more than 2 processors such as the BCM1480. Reported by Manish Lachwani (mlachwani@mvista.com). Signed-off-by: Ralf Baechle commit 5efb764c8653c187912669629c14bb47242a5d05 Author: Andrew Morton Date: Tue Apr 24 12:51:03 2007 -0400 drivers/net/hamradio/baycom_ser_fdx build fix sparc64: drivers/net/hamradio/baycom_ser_fdx.c: In function `ser12_open': drivers/net/hamradio/baycom_ser_fdx.c:417: error: `NR_IRQS' undeclared (first us e in this function) drivers/net/hamradio/baycom_ser_fdx.c:417: error: (Each undeclared identifier is reported only once drivers/net/hamradio/baycom_ser_fdx.c:417: error: for each function it appears i n.) Cc: Folkert van Heusden Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit c43c49bd61fdb9bb085ddafcaadb17d06f95ec43 Author: Dan Williams Date: Tue Apr 24 10:20:06 2007 -0400 usb-net/pegasus: fix pegasus carrier detection Broken by 4a1728a28a193aa388900714bbb1f375e08a6d8e which switched the return semantics of read_mii_word() but didn't fix usage of read_mii_word() to conform to the new semantics. Setting carrier to off based on the NO_CARRIER flag is also incorrect as that flag only triggers on TX failure and therefore isn't correct when no frames are being transmitted. Since there is already a 2*HZ MII carrier check going on, defer to that. Add a TRUST_LINK_STATUS feature flag for adapters where the LINK_STATUS flag is actually correct, and use that rather than the NO_CARRIER flag. Signed-off-by: Dan Williams Signed-off-by: Jeff Garzik commit b748d9e3b80dc7e6ce6bf7399f57964b99a4104c Author: Neil Horman Date: Fri Apr 20 09:54:58 2007 -0400 sis900: Allocate rx replacement buffer before rx operation The sis900 driver appears to have a bug in which the receive routine passes the skbuff holding the received frame to the network stack before refilling the buffer in the rx ring. If a new skbuff cannot be allocated, the driver simply leaves a hole in the rx ring, which causes the driver to stop receiving frames and become non-recoverable without an rmmod/insmod according to reporters. This patch reverses that order, attempting to allocate a replacement buffer first, and receiving the new frame only if one can be allocated. If no skbuff can be allocated, the current skbuf in the rx ring is recycled, dropping the current frame, but keeping the NIC operational. Signed-off-by: Neil Horman Signed-off-by: Jeff Garzik commit d91c088b39e3c66d309938de858775bb90fd1ead Author: Andrea Righi Date: Tue Apr 24 12:40:57 2007 -0400 [netdrvr] depca: handle platform_device_add() failure The following patch fixes a kernel bug in depca_platform_probe(). We don't use a dynamic pointer for pldev->dev.platform_data, so it seems that the correct way to proceed if platform_device_add(pldev) fails is to explicitly set the pldev->dev.platform_data pointer to NULL, before calling the platform_device_put(pldev), or it will be kfree'ed by platform_device_release(). Signed-off-by: Jeff Garzik commit 4bf3631cdb012591667ab927fcd7719d92837833 Author: Jiri Kosina Date: Mon Apr 23 14:41:21 2007 -0700 8250: fix possible deadlock between serial8250_handle_port() and serial8250_interrupt() Commit 40b36daa introduced possibility that serial8250_backup_timeout() -> serial8250_handle_port() locks port.lock without disabling irqs, thus allowing deadlock against interrupt handler (port.lock is acquired in serial8250_interrupt()). Spotted by lockdep. Signed-off-by: Jiri Kosina Cc: Dave Jones Cc: Russell King Cc: Alex Williamson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c5408b88ecb8b7127334a34c55d4e0174434f4ec Author: Akinobu Mita Date: Mon Apr 23 14:41:20 2007 -0700 fault injection: add entry to MAINTAINERS Add maintainer for fault injection support. Signed-off-by: Akinobu Mita Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 98f85d30ced96ac466f30419de8b3fac341ebe75 Author: Jiri Slaby Date: Mon Apr 23 14:41:20 2007 -0700 Char: icom, mark __init as __devinit Two functions are called from __devinit context, but they are marked as __init. Fix this. Signed-off-by: Jiri Slaby Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 9b7f375505f5611efb562065b57814b28a81abc3 Author: Jeff Mahoney Date: Mon Apr 23 14:41:17 2007 -0700 reiserfs: fix xattr root locking/refcount bug The listxattr() and getxattr() operations are only protected by a read lock. As a result, if either of these operations run in parallel, a race condition exists where the xattr_root will end up being cached twice, which results in the leaking of a reference and a BUG() on umount. This patch refactors get_xa_root(), __get_xa_root(), and create_xa_root(), into one get_xa_root() function that takes the appropriate locking around the entire critical section. Reported, diagnosed and tested by Andrea Righi Signed-off-by: Jeff Mahoney Cc: Andrea Righi Cc: "Vladimir V. Saveliev" Cc: Edward Shishkin Cc: Alex Zarochentsev Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1a641fceb6bb6b0930db1aadbda1aaf5711d65d6 Author: Jean Delvare Date: Mon Apr 23 14:41:16 2007 -0700 hwmon/w83627ehf: Don't redefine REGION_OFFSET On ia64, kernel headers define REGION_OFFSET so we can't use that. Reported by Andrew Morton. Signed-off-by: Jean Delvare Acked-by: David Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 179fb0c726fa34a1ecbb9385a01c704babb9c0ab Author: Olaf Hering Date: Mon Apr 23 14:41:15 2007 -0700 do not truncate irq number for icom adapter irq values are u32, not u8. Large irq numbers will be truncated, free_irq may free a different irq. Remove incorrectly sized struct member and use the one from pci_dev. Signed-off-by: Olaf Hering Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 91fcd412e957f433e9f1abeb0b1926dbeb66ca80 Author: Bastian Blank Date: Mon Apr 23 14:41:14 2007 -0700 Allow reading tainted flag as user The commit 34f5a39899f3f3e815da64f48ddb72942d86c366 restricted reading of the tainted value. The attached patch changes this back to a write-only check and restores the read behaviour of older versions. Signed-off-by: Bastian Blank Cc: Theodore Ts'o Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 94e22e13ad063c614b458a019b428ffc118e5c06 Author: Andrew Morton Date: Mon Apr 23 14:41:13 2007 -0700 acpi-thermal: fix mod_timer() interval Use relative time, not absolute. Discovered by Jung-Ik (John) Lee . Cc: Jung-Ik (John) Lee Acked-by: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c959df9f01cfb2f43b4d1f58631ee1e9c50541b6 Author: Latchesar Ionkov Date: Mon Apr 23 14:41:11 2007 -0700 v9fs: don't use primary fid when removing file v9fs_insert uses v9fs_fid_lookup (which also locks the fid) to get the primary fid associated with the dentry and destroys the v9fs_fid struct after removing the file. If another process called v9fs_fid_lookup on the same dentry, it may wait undefinitely for the fid's lock (as the struct is freed). This patch changes v9fs_remove to use a cloned fid, so the primary fid is not locked and freed. Signed-off-by: Latchesar Ionkov Cc: Eric Van Hensbergen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f51a5a9de86a948b9a30daab90fb003f51446dcd Author: Stefan Richter Date: Mon Apr 23 14:41:10 2007 -0700 ieee1394: update MAINTAINERS database - update Ben's address - replace Ben's contact by mine as raw1394's 2nd contact - eth1394's and pcilynx's maintenance doesn't really differ from that of other parts of the stack like video1394 Signed-off-by: Stefan Richter Acked-by: Ben Collins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0e8c7d0fd5b4999675c7d5cd95d0eb7106b756b3 Author: Christoph Lameter Date: Mon Apr 23 14:41:09 2007 -0700 page migration: fix NR_FILE_PAGES accounting NR_FILE_PAGES must be accounted for depending on the zone that the page belongs to. If we replace the page in the radix tree then we may have to shift the count to another zone. Suggested-by: Ethan Solomita Eventually-typed-in-by: Christoph Lameter Cc: Martin Bligh Cc: Signed-off-by: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10ccaf4b7121fb839442be7e079baa8fd0b28caf Author: Miguel Ojeda Date: Mon Apr 23 14:41:09 2007 -0700 Fix spelling in drivers/video/Kconfig Signed-off-by: Miguel Ojeda Sandonis Cc: "Antonino A. Daplas" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 39a3bfdd3779636018ca0e2b8fe0a32378eed67b Author: Michael Buesch Date: Mon Apr 23 14:41:08 2007 -0700 Add mbuesch to .mailmap Signed-off-by: Michael Buesch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 671d40f4aa20d31121695e33393c9bd87053f4fa Author: Alexey Dobriyan Date: Mon Apr 23 14:41:07 2007 -0700 paride drivers: initialize spinlocks pcd_lock and pf_spin_lock are passed to blk_init_queue() which, seeing them as valid lock pointer, sets it as ->queue_lock. The problem is that pcd_lock and pf_spin_lock aren't initialized anywhere. Signed-off-by: Alexey Dobriyan Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f318a63ba018d1f30521b733e86fc2d0207e496b Author: David Brownell Date: Mon Apr 23 14:41:06 2007 -0700 MAINTAINERS: use lists.linux-foundation.org Update various mailing list addresses to use "lists.linux-foundation.org" instead of "lists.osdl.org", to help phase out the old addresses. Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7e40f2ab0a7e36706ee78b78b3792f08f208cd44 Author: Balbir Singh Date: Mon Apr 23 14:41:05 2007 -0700 Taskstats fix the structure members alignment issue We broke the the alignment of members of taskstats to the 8 byte boundary with the CSA patches. In the current kernel, the taskstats structure is not suitable for use by 32 bit applications in a 64 bit kernel. On x86_64 Offsets of taskstats' members (64 bit kernel, 64 bit application) @taskstats'offsetof[@taskstats'indices] = ( 0, # version 4, # ac_exitcode 8, # ac_flag 9, # ac_nice 16, # cpu_count 24, # cpu_delay_total 32, # blkio_count 40, # blkio_delay_total 48, # swapin_count 56, # swapin_delay_total 64, # cpu_run_real_total 72, # cpu_run_virtual_total 80, # ac_comm 112, # ac_sched 113, # ac_pad 116, # ac_uid 120, # ac_gid 124, # ac_pid 128, # ac_ppid 132, # ac_btime 136, # ac_etime 144, # ac_utime 152, # ac_stime 160, # ac_minflt 168, # ac_majflt 176, # coremem 184, # virtmem 192, # hiwater_rss 200, # hiwater_vm 208, # read_char 216, # write_char 224, # read_syscalls 232, # write_syscalls 240, # read_bytes 248, # write_bytes 256, # cancelled_write_bytes ); Offsets of taskstats' members (64 bit kernel, 32 bit application) @taskstats'offsetof[@taskstats'indices] = ( 0, # version 4, # ac_exitcode 8, # ac_flag 9, # ac_nice 12, # cpu_count 20, # cpu_delay_total 28, # blkio_count 36, # blkio_delay_total 44, # swapin_count 52, # swapin_delay_total 60, # cpu_run_real_total 68, # cpu_run_virtual_total 76, # ac_comm 108, # ac_sched 109, # ac_pad 112, # ac_uid 116, # ac_gid 120, # ac_pid 124, # ac_ppid 128, # ac_btime 132, # ac_etime 140, # ac_utime 148, # ac_stime 156, # ac_minflt 164, # ac_majflt 172, # coremem 180, # virtmem 188, # hiwater_rss 196, # hiwater_vm 204, # read_char 212, # write_char 220, # read_syscalls 228, # write_syscalls 236, # read_bytes 244, # write_bytes 252, # cancelled_write_bytes ); This is one way to solve the problem without re-arranging structure members is to pack the structure. The patch adds an __attribute__((aligned(8))) to the taskstats structure members so that 32 bit applications using taskstats can work with a 64 bit kernel. Using __attribute__((packed)) would break the 64 bit alignment of members. The fix was tested on x86_64. After the fix, we got Offsets of taskstats' members (64 bit kernel, 64 bit application) @taskstats'offsetof[@taskstats'indices] = ( 0, # version 4, # ac_exitcode 8, # ac_flag 9, # ac_nice 16, # cpu_count 24, # cpu_delay_total 32, # blkio_count 40, # blkio_delay_total 48, # swapin_count 56, # swapin_delay_total 64, # cpu_run_real_total 72, # cpu_run_virtual_total 80, # ac_comm 112, # ac_sched 113, # ac_pad 120, # ac_uid 124, # ac_gid 128, # ac_pid 132, # ac_ppid 136, # ac_btime 144, # ac_etime 152, # ac_utime 160, # ac_stime 168, # ac_minflt 176, # ac_majflt 184, # coremem 192, # virtmem 200, # hiwater_rss 208, # hiwater_vm 216, # read_char 224, # write_char 232, # read_syscalls 240, # write_syscalls 248, # read_bytes 256, # write_bytes 264, # cancelled_write_bytes ); Offsets of taskstats' members (64 bit kernel, 32 bit application) @taskstats'offsetof[@taskstats'indices] = ( 0, # version 4, # ac_exitcode 8, # ac_flag 9, # ac_nice 16, # cpu_count 24, # cpu_delay_total 32, # blkio_count 40, # blkio_delay_total 48, # swapin_count 56, # swapin_delay_total 64, # cpu_run_real_total 72, # cpu_run_virtual_total 80, # ac_comm 112, # ac_sched 113, # ac_pad 120, # ac_uid 124, # ac_gid 128, # ac_pid 132, # ac_ppid 136, # ac_btime 144, # ac_etime 152, # ac_utime 160, # ac_stime 168, # ac_minflt 176, # ac_majflt 184, # coremem 192, # virtmem 200, # hiwater_rss 208, # hiwater_vm 216, # read_char 224, # write_char 232, # read_syscalls 240, # write_syscalls 248, # read_bytes 256, # write_bytes 264, # cancelled_write_bytes ); Signed-off-by: Balbir Singh Cc: Jay Lan Cc: Shailabh Nagar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fc83815c3afe1bd8d0f0961a668a96caabb049be Author: Jiri Slaby Date: Mon Apr 23 14:41:04 2007 -0700 Char: mxser, fix TIOCMIWAIT There was schedule() missing in the TIOCMIWAIT ioctl. Solve it by moving the code to the wait_event_interruptible. Signed-off-by: Jiri Slaby Cc: Jan Yenya Kasprzak Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b446a4a5757fe1287bf3472efcdde6b59dfd63ad Author: Jiri Slaby Date: Mon Apr 23 14:41:03 2007 -0700 Char: mxser_new, fix TIOCMIWAIT There was schedule() missing in the TIOCMIWAIT ioctl. Solve it by moving the code to the wait_event_interruptible. Cc: Jan "Yenya" Kasprzak Signed-off-by: Jiri Slaby Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 67d2bc58afdd5168dce54ae06f5f30038c59f498 Author: Jan Yenya Kasprzak Date: Mon Apr 23 14:41:02 2007 -0700 Char: mxser_new, fix recursive locking Signed-off-by: Jan "Yenya" Kasprzak Acked-by: Jiri Slaby Acked-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d124cbba316737af8f3a6959edb95bbd130a4d8 Author: Hugh Dickins Date: Mon Apr 23 14:41:02 2007 -0700 fix OOM killing processes wrongly thought MPOL_BIND I only have CONFIG_NUMA=y for build testing: surprised when trying a memhog to see lots of other processes killed with "No available memory (MPOL_BIND)". memhog is killed correctly once we initialize nodemask in constrained_alloc(). Signed-off-by: Hugh Dickins Acked-by: Christoph Lameter Acked-by: William Irwin Acked-by: KAMEZAWA Hiroyuki Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fdc30b3d448bf86dd45f9df3e8ac0d36a3bdd9b2 Author: Taku Izumi Date: Mon Apr 23 14:41:00 2007 -0700 Fix possible NULL pointer access in 8250 serial driver I encountered the following kernel panic. The cause of this problem was NULL pointer access in check_modem_status() in 8250.c. I confirmed this problem is fixed by the attached patch, but I don't know this is the correct fix. sadc[4378]: NaT consumption 2216203124768 [1] Modules linked in: binfmt_misc dm_mirror dm_mod thermal processor fan container button sg e100 eepro100 mii ehci_hcd ohci_hcd Pid: 4378, CPU 0, comm: sadc psr : 00001210085a2010 ifs : 8000000000000289 ip : [] Not tainted ip is at check_modem_status+0xf1/0x360 Call Trace: [] show_stack+0x40/0xa0 [] show_regs+0x840/0x880 [] die+0x1c0/0x2c0 [] die_if_kernel+0x50/0x80 [] ia64_fault+0x11e0/0x1300 [] ia64_leave_kernel+0x0/0x280 [] check_modem_status+0xf0/0x360 [] serial8250_get_mctrl+0x20/0xa0 [] uart_read_proc+0x250/0x860 [] proc_file_read+0x1d0/0x4c0 [] vfs_read+0x1b0/0x300 [] sys_read+0x70/0xe0 [] ia64_ret_from_syscall+0x0/0x20 [] __kernel_syscall_via_break+0x0/0x20 Fix the possible NULL pointer access in check_modem_status() in 8250.c. The check_modem_status() would access 'info' member of uart_port structure, but it is not initialized before uart_open() is called. The check_modem_status() can be called through /proc/tty/driver/serial before uart_open() is called. Signed-off-by: Kenji Kaneshige Signed-off-by: Taku Izumi Cc: Russell King Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 650a7c974f1b91de9732c0f720e792837f8abfd6 Author: David Rientjes Date: Mon Apr 23 21:36:13 2007 -0700 oom: kill all threads that share mm with killed task oom_kill_task() calls __oom_kill_task() to OOM kill a selected task. When finding other threads that share an mm with that task, we need to kill those individual threads and not the same one. (Bug introduced by f2a2a7108aa0039ba7a5fe7a0d2ecef2219a7584) Acked-by: William Irwin Acked-by: Christoph Lameter Cc: Nick Piggin Cc: Andrew Morton Cc: Andi Kleen Signed-off-by: David Rientjes Signed-off-by: Linus Torvalds commit 8689b517be3e3f65f8ba20490beccca13c5879fa Author: Andi Kleen Date: Tue Apr 24 13:05:37 2007 +0200 [PATCH] i386: Fix some warnings added by earlier patch Signed-off-by: Andi Kleen commit 90767bd13febfdf8a5f5077e2bb975f79d6b919c Author: Andi Kleen Date: Tue Apr 24 13:05:37 2007 +0200 [PATCH] x86-64: Always flush all pages in change_page_attr change_page_attr on x86-64 only flushed the TLB for pages that got reverted. That's not correct: it has to be flushed in all cases. This bug was added in some earlier changes. Just flush all pages for now. This could be done more efficiently, but for this late in the release this seem to be the best fix. Pointed out by Jan Beulich Signed-off-by: Andi Kleen commit 9ce883becb83190061369940de9c415595836c9b Author: Andi Kleen Date: Tue Apr 24 13:05:37 2007 +0200 [PATCH] x86: Remove noreplacement option noreplacement is dangerous on modern systems because it will not replace the context switch FNSAVE with SSE aware FXSAVE. But other places in the kernel still assume SSE and do FXSAVE and the CPU will then access FXSAVE information with FNSAVE and cause corruption. Easiest way to avoid this is to remove the option. It was mostly for paranoia reasons anyways and alternative()s have been stable for some time. Thanks to Jeremy F. for reporting and helping debug it. Signed-off-by: Andi Kleen commit cf6387daf8858bdcb3e123034ca422e8979d73f1 Author: Joachim Deguara Date: Tue Apr 24 13:05:36 2007 +0200 [PATCH] x86-64: make GART PTEs uncacheable This patches fixes the silent data corruption problems being seen using the GART iommu where 4kB of data where incorrect (seen mostly on Nvidia CK804 systems). This fix, to mark the memory regin the GART PTEs reside on as uncacheable, also brings the code in line with the AGP specification. Signed-off-by: Joachim Deguara Signed-off-by: Andi Kleen commit 5a68b2e346f043820e2ba0cde57cc75b4561c124 Author: David S. Miller Date: Mon Apr 23 23:33:17 2007 -0700 [PARPORT] SUNBPP: Fix OOPS when debugging is enabled. The debugging code would dereference __iomem pointers instead of going through sbus_{read,write}{b,w,l}(). Signed-off-by: David S. Miller commit 7e9f33461521180ef2c148c0b77eeb412d18ffae Author: Alan Cox Date: Mon Apr 23 22:50:53 2007 -0700 [SPARC] openprom: Switch to ref counting PCI API Signed-off-by: Alan Cox Signed-off-by: David S. Miller commit 05d224468a273a9ee773a0e9d34227ee7f2c0840 Author: Patrick McHardy Date: Mon Apr 23 22:39:02 2007 -0700 [XFRM]: beet: fix pseudo header length value draft-nikander-esp-beet-mode-07.txt is not entirely clear on how the length value of the pseudo header should be calculated, it states "The Header Length field contains the length of the pseudo header, IPv4 options, and padding in 8 octets units.", but also states "Length in octets (Header Len + 1) * 8". draft-nikander-esp-beet-mode-08-pre1.txt [1] clarifies this, the header length should not include the first 8 byte. This change affects backwards compatibility, but option encapsulation didn't work until very recently anyway. [1] http://users.piuha.net/jmelen/BEET/draft-nikander-esp-beet-mode-08-pre1.txt Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 4d4d3d1e8807d6aa9822eeedf7fe8500e1b7e38d Author: Stephen Hemminger Date: Mon Apr 23 22:32:11 2007 -0700 [TCP]: Congestion control initialization. Change to defer congestion control initialization. If setsockopt() was used to change TCP_CONGESTION before connection is established, then protocols that use sequence numbers to keep track of one RTT interval (vegas, illinois, ...) get confused. Change the init hook to be called after handshake. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 01abc2aa0f447bce2f6beb06dd0607ba0f01c5bb Author: Bartlomiej Zolnierkiewicz Date: Mon Apr 23 23:19:36 2007 +0200 Revert "adjust legacy IDE resource setting (v2)" This reverts commit ed8ccee0918ad063a4741c0656fda783e02df627. It causes hang on boot for some users and we don't yet know why: http://bugzilla.kernel.org/show_bug.cgi?id=7562 http://lkml.org/lkml/2007/4/20/404 http://lkml.org/lkml/2007/3/25/113 Just reverse it for 2.6.21-final, having broken X server is somehow better than unbootable system. Signed-off-by: Bartlomiej Zolnierkiewicz commit c445a31cd7f469d77acc37538ab43a99530968b8 Author: S.Çağlar Onur Date: Sun Apr 22 00:52:48 2007 +0300 Add missing USRobotics Wireless Adapter (Model 5423) id into zd1211rw USRobotics Wireless Adapter (Model 5423) works well with current zd1211rw driver also (i have tested 2.6.18, 2.6.20 and 2.6.21-rc7). It just needs its ID added to the list of devices. Signed-off-by: S.Çağlar Onur Signed-off-by: Linus Torvalds commit c3b99f0db9b2ef4292ef774bae1ea0d6f1e8d82a Author: Marcel van Nies Date: Sat Apr 21 15:34:55 2007 -0700 [SUNHME]: Fix module unload. Signed-off-by: Marcel van Nies Signed-off-by: David S. Miller commit 9f9b6693ed8254177bafcb823b0ea3659d61adb0 Author: Marcel van Nies Date: Sat Apr 21 15:34:10 2007 -0700 [SUNLANCE]: Fix module unload. Signed-off-by: Marcel van Nies Signed-off-by: David S. Miller commit d0dc1129c2e5a5a0e53940cad44333e6bd2f9af3 Author: Marcel van Nies Date: Sat Apr 21 15:31:58 2007 -0700 [SUNQE]: Fix MAC address assignment. The MAC address assignment at module loading is simply forgotten. The bug at module unloading is caused by an incorrect call. The bug at module unloading does not only happen for sunqe, sunlance and sunhme (sbus) suffer from it too. I've tested this on my SS20. Signed-off-by: Marcel van Nies Signed-off-by: David S. Miller commit 2e6679a0aa352e6b74f6385c49cd4dca3dc7201f Author: vignesh babu Date: Tue Apr 17 12:42:09 2007 -0700 [SBUS] vfc_dev.c: kzalloc Replacing kmalloc/memset combination with kzalloc. Signed-off-by: vignesh babu Signed-off-by: David S. Miller commit 241c39b9ac4bf847013aa06cce6d4d61426a2006 Author: Trond Myklebust Date: Fri Apr 20 16:12:55 2007 -0400 RPC: Fix the TCP resend semantics for NFSv4 Fix a regression due to the patch "NFS: disconnect before retrying NFSv4 requests over TCP" The assumption made in xprt_transmit() that the condition "req->rq_bytes_sent == 0 and request is on the receive list" should imply that we're dealing with a retransmission is false. Firstly, it may simply happen that the socket send queue was full at the time the request was initially sent through xprt_transmit(). Secondly, doing this for each request that was retransmitted implies that we disconnect and reconnect for _every_ request that happened to be retransmitted irrespective of whether or not a disconnection has already occurred. Fix is to move this logic into the call_status request timeout handler. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 2b82f190c81bf1524447c021df4e9ce8ef379bd5 Author: Trond Myklebust Date: Fri Apr 20 16:12:50 2007 -0400 NFS: Fix race in nfs_set_page_dirty Protect nfs_set_page_dirty() against races with nfs_inode_add_request. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 612c9384fd0486686699f7d49b774f0c7a79c511 Author: Trond Myklebust Date: Fri Apr 20 16:12:45 2007 -0400 NFS: Fix the 'desynchronized value of nfs_i.ncommit' error Redirtying a request that is already marked for commit will screw up the accounting for NR_UNSTABLE_NFS as well as nfs_i.ncommit. Ensure that all requests on the commit queue are labelled with the PG_NEED_COMMIT flag, and avoid moving them onto the dirty list inside nfs_page_mark_flush(). Also inline nfs_mark_request_dirty() into nfs_page_mark_flush() for atomicity reasons. Avoid dropping the spinlock until we're done marking the request in the radix tree and have added it to the ->dirty list. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 6d677e3504cd173b2ff7fc393ee4241b3c0f92a6 Author: Trond Myklebust Date: Fri Apr 20 16:12:40 2007 -0400 NFS: Don't clear PG_writeback until after we've processed unstable writes Ensure that we don't release the PG_writeback lock until after the page has either been redirtied, or queued on the nfs_inode 'commit' list. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 8e821cad12e80cd1a8a3fbadf91f62f17f32549e Author: Trond Myklebust Date: Fri Apr 20 16:12:34 2007 -0400 NFS: clean up the unstable write code Get rid of the inlined #ifdefs. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 7ab77e03c1f665d5dee78f1248fffd11fa0c5154 Author: Dave Jones Date: Fri Apr 20 15:58:00 2007 -0400 Longhaul - Revert ACPI C3 on Longhaul ver. 2 Support for Longhaul ver. 2 broke driver for VIA C3 Eden 600MHz with Samuel 2 core. Processor is not able to switch frequency anymore. I don't know much about this issue at the moment, but until (if ever) I will know why, this part should be reversed. Signed-off-by: Rafal Bilski Signed-off-by: Dave Jones Signed-off-by: Linus Torvalds commit a993800655ee516b6f6a6fc4c2ee13fedfb0590b Author: Jens Axboe Date: Fri Apr 20 08:55:52 2007 +0200 cfq-iosched: fix sequential write regression We have a 10-15% performance regression for sequential writes on TCQ/NCQ enabled drives in 2.6.21-rcX after the CFQ update went in. It has been reported by Valerie Clement and the Intel testing folks. The regression is because of CFQ's now more aggressive queue control, limiting the depth available to the device. This patches fixes that regression by allowing a greater depth when only one queue is busy. It has been tested to not impact sync-vs-async workloads too much - we still do a lot better than 2.6.20. Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit 8929fea39cb0ab3e455fe00e7eb6806c32155cd2 Author: Bartlomiej Zolnierkiewicz Date: Fri Apr 20 22:16:58 2007 +0200 ide/Kconfig: add missing range check for IDE_MAX_HWIFS ide_hwif_to_major[] has only 10 entries as there are 10 major numbers reserved for IDE (if somebody needs more it shouldn't be hard to fix). Signed-off-by: Bartlomiej Zolnierkiewicz commit 38b66f8444050c7cdfad759b8b556338e1fcb4da Author: Sergei Shtylyov Date: Fri Apr 20 22:16:58 2007 +0200 hpt366: fix kernel oops with HPT302N The driver crashes the kernel on HPT302N chips due to the missing initializer for 'hpt302n.settings' having been unfortunately overlooked so far. :-< Much thanks to Mike Mattie for pin-pointing the reason of crash. Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 2571b16dde15dacf0e338cc5fe8fb3142122eb5a Author: Mark Lord Date: Fri Apr 20 22:16:58 2007 +0200 ide/pci/delkin_cb.c: add new PCI ID Add PCI ID for a newer variant of cardbus CF/IDE adapter card. Signed-off-by: Mark Lord Signed-off-by: Bartlomiej Zolnierkiewicz commit 1d464c26b5625215c4b35fb336c8f3c57d248c2e Author: Dave Johnson Date: Wed Apr 18 10:39:41 2007 -0400 [MIPS] Fix wrong checksum for split TCP packets on 64-bit MIPS I've traced down an off-by-one TCP checksum calculation error under the following conditions: 1) The TCP code needs to split a full-sized packet due to a reduced MSS (typically due to the addition of TCP options mid-stream like SACK). _AND_ 2) The checksum of the 2nd fragment is larger than the checksum of the original packet. After subtraction this results in a checksum for the 1st fragment with bits 16..31 set to 1. (this is ok) _AND_ 3) The checksum of the 1st fragment's TCP header plus the previously 32bit checksum of the 1st fragment DOES NOT cause a 32bit overflow when added together. This results in a checksum of the TCP header plus TCP data that still has the upper 16 bits as 1's. _THEN_ 4) The TCP+data checksum is added to the checksum of the pseudo IP header with csum_tcpudp_nofold() incorrectly (the bug). The problem is the checksum of the TCP+data is passed to csum_tcpudp_nofold() as an 32bit unsigned value, however the assembly code acts on it as if it is a 64bit unsigned value. This causes an incorrect 32->64bit extension if the sum has bit 31 set. The resulting checksum is off by one. This problems is data and TCP header dependent due to #2 and #3 above so it doesn't occur on every TCP packet split. Signed-off-by: Dave Johnson Signed-off-by: Ralf Baechle commit ba755f8ec80fdbf2b5212622eabf7355464c6327 Author: Atsushi Nemoto Date: Thu Apr 12 20:02:54 2007 +0900 [MIPS] Fix BUG(), BUG_ON() handling With commit 63dc68a8cf60cb110b147dab1704d990808b39e2, kernel can not handle BUG() and BUG_ON() properly since get_user() returns false for kernel code. Use __get_user() to skip unnecessary access_ok(). This patch also make BRK_BUG code encoded in the TNE instruction. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit faea62346444ce5b1dba8fb5291d95b676522c42 Author: Atsushi Nemoto Date: Mon Apr 16 23:19:44 2007 +0900 [MIPS] Retry {save,restore}_fp_context if failed in atomic context. The save_fp_context()/restore_fp_context() might sleep on accessing user stack and therefore might lose FPU ownership in middle of them. If these function failed due to "in_atomic" test in do_page_fault, touch the sigcontext area in non-atomic context and retry these save/restore operation. This is a replacement of a (broken) fix which was titled "Allow CpU exception in kernel partially". Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 5323180db75d562a287cb2020b07c9422df13df6 Author: Atsushi Nemoto Date: Sat Apr 14 02:37:26 2007 +0900 [MIPS] Disallow CpU exception in kernel again. The commit 4d40bff7110e9e1a97ff8c01bdd6350e9867cc10 ("Allow CpU exception in kernel partially") was broken. The commit was to fix theoretical problem but broke usual case. Revert it for now. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 9a9943575ade643368849e2c963094ac637867e0 Author: Mark Mason Date: Fri Apr 13 10:32:25 2007 -0700 [MIPS] Add missing silicon revisions for BCM112x Recent versions of the BCM112X processors aren't recognized by Linux (preventing Linux from booting on those processors). This patch adds support for those that are missing. Signed-off-by: Mark Mason Signed-off-by: Ralf Baechle commit 46fcc86dd71d70211e965102fb69414c90381880 Author: Linus Torvalds Date: Thu Apr 19 18:21:01 2007 -0700 Revert "e1000: fix NAPI performance on 4-port adapters" This reverts commit 60cba200f11b6f90f35634c5cd608773ae3721b7. It's been linked to lockups of the e1000 hardware, see for example https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229603 but it's likely that the commit itself is not really introducing the bug, but just allowing an unrelated problem to rear its ugly head (ie one current working theory is that the code exposes us to a hardware race condition by decreasing the amount of time we spend in each NAPI poll cycle). We'll revert it until root cause is known. Intel has a repeatable reproduction on two different machines and bus traces of the hardware doing something bad. Acked-by: Jesse Brandeburg Cc: Jeff Garzik Cc: David S. Miller Cc: Greg KH Cc: Dave Jones Cc: Auke Kok Cc: Andrew Morton Signed-off-by: Linus Torvalds commit f3769e9db11df38c211881a5f11b2e38a8e4477a Author: Alan Cox Date: Thu Apr 19 11:09:52 2007 +0100 pata_sis: Fix oops on boot A small number of SiS setups require special handling (not many judging by how long this dumb bug survived). A couple of Fedora 7 devel testers hit an Oops on pata_sis loading which is caused by terminal confusion between chipset as 'the chipset we have found' and chipset as 'array iterator' Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit 7c5050e3e49f6d89af0d63111611693d9625d1f5 Author: Paul Mackerras Date: Thu Apr 19 13:05:52 2007 -0700 [PPP]: Fix skbuff.c:BUG due incorrect logic in process_input_packet() From: Paul Mackerras This fixes: Subject: kernel BUG at net/core/skbuff.c in linux-2.6.21-rc6 process_input_packet() treats the case where the first byte is 0xff (PPP_ALLSTATIONS) but the second byte is 0x03 (PPP_UI) as indicating a packet with a PPP protocol number of 0xff. Arguably that's wrong since PPP protocol 0xff is reserved, and the RFC does envision the possibility of receiving frames where the control field has values other than 0x03. Signed-off-by: David S. Miller commit 93cd791e02bbdb504aba024a14fdc07fe246bc71 Author: Stephen Hemminger Date: Wed Apr 11 14:48:03 2007 -0700 sky2: version 1.14 Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit d2adf4f65a70f94cbb3bb4dffd4bbc70cc383071 Author: Stephen Hemminger Date: Wed Apr 11 14:48:02 2007 -0700 sky2: no jumbo on Yukon FE The Yukon FE (100mbit only) chips do not support large packets. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit b628ed986d681c708aec64418c2c7f6a6b715855 Author: Stephen Hemminger Date: Wed Apr 11 14:48:01 2007 -0700 sky2: EC-U performance and jumbo support The Yukon EC Ultra chips have transmit settings for store and forward and PCI buffering. By setting these appropriately, normal performance goes from 750Mbytes/sec to 940Mbytes/sec (non-jumbo). It is also possible to do Jumbo mode, but it means turning off TSO and checksum offload so the performance gets worse. There isn't enough buffering for checksum offload to work. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 4f44d8ba09280a7f0887ab60277940d6c72f2b43 Author: Stephen Hemminger Date: Wed Apr 11 14:48:00 2007 -0700 sky2: disable ASF on all chip types Need to make sure and disable ASF on all chip types. Otherwise, there may be random reboots. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 40b01727a5a65597160f1738d3fbe63de902f0cb Author: Stephen Hemminger Date: Wed Apr 11 14:47:59 2007 -0700 sky2: handle descriptor errors There should never be descriptor error unless hardware or driver is buggy. But if an error occurs, print useful information, clear irq, and recover. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 0a17e4c252ce951615f3c1fccae6d6262c8d4187 Author: Stephen Hemminger Date: Wed Apr 11 14:47:58 2007 -0700 sky2: disable support for 88E8056 This device is having all sorts of problems that lead to data corruption and system instability. It gets receive status and data out of order, it generates descriptor and TSO errors, etc. Until the problems are resolved, it should not be used by anyone who cares about there system. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit bf41a7c5d94a3d197002bdf11892529b47a63e99 Author: Dave Jiang Date: Thu Apr 12 10:57:06 2007 -0700 gianfar needs crc32 lib dependency Gianfar needs crc32 to be selected to compile. Signed-off-by: Dave Jiang -- drivers/net/Kconfig | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) -- Signed-off-by: Jeff Garzik commit 33bdeec80649f2eab36039f63d69c65378493cbe Author: Linas Vepstas Date: Mon Apr 16 22:54:13 2007 -0700 spidernet: Fix problem sending IP fragments The basic structure of "normal" UDP/IP/Ethernet frames (that actually work): - It starts with the Ethernet header (dest MAC, src MAC, etc.) - The next part is occupied by the IP header (version info, length of packet, id=0, fragment offset=0, checksum, from / to address, etc.) - Then comes the UDP header (src / dest port, length, checksum) - Actual payload - Ethernet checksum Now what's different for IP fragment: - The IP header has id set to some value (same for all fragments), offset is set appropriately (i.e. 0 for first fragment, following according to size of other fragments), size is the length of the frame. - UDP header is unchanged. I.e. length is according to full UDP datagram, not just the part within the actual frame! But this is only true within the first frame: all following frames don't have a valid UDP-header at all. The spidernet silicon seems to be quite intelligent: It's able to compute (IP / UDP / Ethernet) checksums on the fly and tests if frames are conforming to RFC -- at least conforming to RFC on complete frames. But IP fragments are different as explained above: I.e. for IP fragments containing part of a UDP datagram it sees incompatible length in the headers for IP and UDP in the first frame and, thus, skips this frame. But the content *is* correct for IP fragments. For all following frames it finds (most probably) no valid UDP header at all. But this *is* also correct for IP fragments. The Linux IP-stack seems to be clever in this point. It expects the spidernet to calculate the checksum (since the module claims to be able to do so) and marks the skb's for "normal" frames accordingly (ip_summed set to CHECKSUM_HW). But for the IP fragments it does not expect the driver to be capable to handle the frames appropriately. Thus all checksums are allready computed. This is also flaged within the skb (ip_summed set to CHECKSUM_NONE). Unfortunately the spidernet driver ignores that hints. It tries to send the IP fragments of UDP datagrams as normal UDP/IP frames. Since they have different structure the silicon detects them the be not "well-formed" and skips them. The following one-liner against 2.6.21-rc2 changes this behavior. If the IP-stack claims to have done the checksumming, the driver should not try to checksum (and analyze) the frame but send it as is. Signed-off-by: Norbert Eicker Signed-off-by: Linas Vepstas Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 1ca03cbc2057f61390e8e8a3234dc0bb0a8fe57a Author: Divy Le Ray Date: Tue Apr 17 11:06:36 2007 -0700 cxgb3 - PHY interrupts and GPIO pins. Remove assumption that PHY interrupts use GPIOs 3 and 5. Deal with PHY interrupts connected to any GPIO pins. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 606fcd0b94f7531f52a9b07008a4461213cbcd27 Author: Divy Le Ray Date: Tue Apr 17 11:06:30 2007 -0700 cxgb3 - Fix low memory conditions Reuse the incoming skb when a clientless abort req is recieved. The release of RDMA connections HW resources might be deferred in low memory situations. Ensure that no further activity is passed up to the RDMA driver for these connections. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 6b8d0f9b180cb93513bb65f705b299370f0357a1 Author: Avi Kivity Date: Wed Apr 18 11:18:18 2007 +0300 KVM: Fix off-by-one when writing to a nonpae guest pde Nonpae guest pdes are shadowed by two pae ptes, so we double the offset twice: once to account for the pte size difference, and once because we need to shadow pdes for a single guest pde. But when writing to the upper guest pde we also need to truncate the lower bits, otherwise the multiply shifts these bits into the pde index and causes an access to the wrong shadow pde. If we're at the end of the page (accessing the very last guest pde) we can even overflow into the next host page and oops. Signed-off-by: Avi Kivity commit ac57b3a9ce280763296f99e32187a0b4384d9389 Author: Denis Lunev Date: Wed Apr 18 17:05:58 2007 -0700 [NETLINK]: Don't attach callback to a going-away netlink socket There is a race between netlink_dump_start() and netlink_release() that can lead to the situation when a netlink socket with non-zero callback is freed. Here it is: CPU1: CPU2 netlink_release(): netlink_dump_start(): sk = netlink_lookup(); /* OK */ netlink_remove(); spin_lock(&nlk->cb_lock); if (nlk->cb) { /* false */ ... } spin_unlock(&nlk->cb_lock); spin_lock(&nlk->cb_lock); if (nlk->cb) { /* false */ ... } nlk->cb = cb; spin_unlock(&nlk->cb_lock); ... sock_orphan(sk); /* * proceed with releasing * the socket */ The proposal it to make sock_orphan before detaching the callback in netlink_release() and to check for the sock to be SOCK_DEAD in netlink_dump_start() before setting a new callback. Signed-off-by: Denis Lunev Signed-off-by: Kirill Korotaev Signed-off-by: Pavel Emelianov Acked-by: Patrick McHardy Signed-off-by: David S. Miller commit bfb6709d0b239af5e3ce5859aae926e1b79ba84b Author: Olaf Kirch Date: Wed Apr 18 15:07:22 2007 -0700 [IrDA]: Correctly handling socket error This patch fixes an oops first reported in mid 2006 - see http://lkml.org/lkml/2006/8/29/358 The cause of this bug report is that when an error is signalled on the socket, irda_recvmsg_stream returns without removing a local wait_queue variable from the socket's sk_sleep queue. This causes havoc further down the road. In response to this problem, a patch was made that invoked sock_orphan on the socket when receiving a disconnect indication. This is not a good fix, as this sets sk_sleep to NULL, causing applications sleeping in recvmsg (and other places) to oops. This is against the latest net-2.6 and should be considered for -stable inclusion. Signed-off-by: Olaf Kirch Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit d0cf0d9940ef27b46fcbbd9e0cc8427c30fe05eb Author: Vlad Yasevich Date: Wed Apr 18 14:11:06 2007 -0700 [SCTP]: Do not interleave non-fragments when in partial delivery The way partial delivery is currently implemnted, it is possible to intereleave a message (either from another steram, or unordered) that is not part of partial delivery process. The only way to this is for a message to not be a fragment and be 'in order' or unorderd for a given stream. This will result in bypassing the reassembly/ordering queues where things live duing partial delivery, and the message will be delivered to the socket in the middle of partial delivery. This is a two-fold problem, in that: 1. the app now must check the stream-id and flags which it may not be doing. 2. this clearing partial delivery state from the association and results in ulp hanging. This patch is a band-aid over a much bigger problem in that we don't do stream interleave. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit fefaa75e0451c76225863644be01e4fd70884153 Author: David S. Miller Date: Tue Apr 17 21:48:10 2007 -0700 [IPSEC] af_key: Fix thinko in pfkey_xfrm_policy2msg() Make sure to actually assign the determined mode to rq->sadb_x_ipsecrequest_mode. Noticed by Joe Perches. Signed-off-by: David S. Miller commit 080dfbe176c8dd87fc8f27e2941f31171b738f60 Author: Olof Johansson Date: Tue Apr 17 00:32:29 2007 -0700 Minor bug fixes to i2c-pasemi * Last write during i2c_xfer is of the wrong byte (off-by-1). * Read length is wrong for some of the reads (mistakenly used the PEC version) Signed-off-by: Olof Johansson Signed-off-by: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 56a3b5ebee0be7af723bfad56def48ebf899b7fb Author: Jean Delvare Date: Tue Apr 17 00:32:28 2007 -0700 i2c-pasemi: Depend on PPC_PASEMI again Looks like a local change I made to be able to test-compile the i2c-pasemi driver leaked upstream. Signed-off-by: Jean Delvare Acked-by: Olof Johansson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 33725ad36d48c09e9537d3d7e680471c298539a9 Author: Jean Delvare Date: Tue Apr 17 00:32:27 2007 -0700 hwmon/w83627ehf: Fix the fan5 clock divider write Users have been complaining about the w83627ehf driver flooding their logs with debug messages like: w83627ehf 9191-0a10: Increasing fan 4 clock divider from 64 to 128 or: w83627ehf 9191-0290: Increasing fan 4 clock divider from 4 to 8 The reason is that we failed to actually write the LSB of the encoded clock divider value for that fan, causing the next read to report the same old value again and again. Additionally, the fan number was improperly reported, making the bug harder to find. Signed-off-by: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 93da28790c17345f4db10358dfb19b4c241d8ba3 Author: Russell King Date: Tue Apr 17 00:32:26 2007 -0700 Provide dummy devm_ioport_* if !HAS_IOPORT Provide an dummy implementation of devm_ioport_map() and devm_ioport_unmap() to allow drivers (eg, pata_platform) to build for platforms where CONFIG_NO_IOPORT is selected. Signed-off-by: Russell King Cc: Alan Cox Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 30f3deeee81cf22546da1b0b89a937bb991dea23 Author: NeilBrown Date: Mon Apr 16 22:53:25 2007 -0700 knfsd: use a spinlock to protect sk_info_authunix sk_info_authunix is not being protected properly so the object that it points to can be cache_put twice, leading to corruption. We borrow svsk->sk_defer_lock to provide the protection. We should probably rename that lock to have a more generic name - later. Thanks to Gabriel for reporting this. Cc: Greg Banks Cc: Gabriel Barazer Signed-off-by: Neil Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 94256dd680f837dc14dd7d1377c5326fb3362721 Author: Andrew Morton Date: Mon Apr 16 22:53:25 2007 -0700 drivers/macintosh/smu.c: fix locking snafu It got its lock and unlock backwards. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=8334 (obviously, this code could be using plain old spin_lock_irq(), too) Cc: Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 07a0cfec30848319cc86f21cce0d2efeca593e1a Author: Evgeniy Dushistov Date: Mon Apr 16 22:53:24 2007 -0700 ufs proper handling of zero link case This patch should fix or partly fix this bug: http://bugzilla.kernel.org/show_bug.cgi?id=8276 The problem is: - if we see "zero link case" during reading inode operation, we call ufs_error(which remount fs readonly), but not "mark" inode as bad (1) - in readonly case we do not fill some data structures, which are used in read and write case (2) - VFS call ufs_delete_inode if link count is zero (3) so (1)->(3)->(2) cause oops, this patch should fix such scenario Signed-off-by: Evgeniy Dushistov Cc: Jim Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d2c5b415ccd6c322e18adaed3a5b21f7ec555ef Author: Ben Dooks Date: Mon Apr 16 22:53:22 2007 -0700 spi: fix use of set_cs in spi_s3c24xx driver It turns out that the last patch to change set_cs to be kept in the controller's structure instead of the platform data was an incomplete change, and did not change the references to platfrom data in the setup xfer code. (This can prevent an oops.) Reported-by: Signed-off-by: Ben Dooks Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 88ed39b064575b4f42ecb737ec2daa66717de173 Author: Ivan Kokshaysky Date: Mon Apr 16 22:53:21 2007 -0700 alpha: build fixes - force architecture Override compiler .arch directive for generic kernel build. Signed-off-by: Ivan Kokshaysky Signed-off-by: Richard Henderson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7fc1a1abc1eca1278d6d37ec54b72005d15b5c1e Author: Ivan Kokshaysky Date: Mon Apr 16 22:53:21 2007 -0700 alpha: more fixes for specific machine types arch/alpha/kernel/sys_sx164.c Earlier firmware revisions need MVI fix as well. arch/alpha/kernel/sys_nautilus.c On UP1500 firmware reports wrong AGP IRQ (10 instead of 5). This causes interrupt storm if there is a PCI device that uses IRQ 5. Signed-off-by: Ivan Kokshaysky Cc: Richard Henderson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1b75b05b73cdefd1d10074e9dad60812f9731a5e Author: Ivan Kokshaysky Date: Mon Apr 16 22:53:17 2007 -0700 alpha: fixes for specific machine types Files: arch/alpha/kernel/core_mcpcia.c arch/alpha/kernel/sys_rawhide.c include/asm-alpha/core_mcpcia.h Determine correct hose configuration; RAWHIDE family can have 2 or 4 hoses, so make sure non-existent hoses are ignored. arch/alpha/kernel/err_titan.c Supply a needed #include arch/alpha/kernel/module.c Add some useful output to the relocation overflow messages. arch/alpha/kernel/sys_noritake.c Supply necessary noritake_end_irq() to correct interrupt handling. This fixes a problem first noted by hangs during boot probing with a DE500-BA TULIP NIC present. arch/alpha/kernel/sys_sio.c Correct saving of original PIRQ register (PCI IRQ routing); change default PIRQ setting to leave PCI IRQs 9 and 14 free to be used for sound (Multia) and IDE (any), respectively. include/asm-alpha/io.h Supply the "isa_virt_to_bus" routine. Signed-off-by: Jay Estabrook Signed-off-by: Ivan Kokshaysky Cc: Richard Henderson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8a93258ce302c2b597289770cb7de8dba7c6c219 Author: Benjamin Herrenschmidt Date: Mon Apr 16 22:53:16 2007 -0700 fix bogon in /dev/mem mmap'ing on nommu While digging through my MAP_FIXED changes, I found that rather obvious bug in /dev/mem mmap implementation for nommu archs. get_unmapped_area() is expected to return an address, not a pfn. Signed-off-by: Benjamin Herrenschmidt Acked-By: David Howells Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 112654208bd6f092e064973b8fa680e37ffa74a6 Author: Randy Dunlap Date: Mon Apr 16 22:53:15 2007 -0700 kernel-doc: fix plist.h comments Make kernel-doc comments match macro names. Correct parameter names in a few places. Remove '#' from beginning of kernel-doc comment macro names. Remove extra (erroneous) blank lines in kernel-doc. Warning(plist.h:100): Cannot understand * #PLIST_HEAD_INIT - static struct plist_head initializer on line 100 - I thought it was a doc line Warning(plist.h:112): Cannot understand * #PLIST_NODE_INIT - static struct plist_node initializer on line 112 - I thought it was a doc line Warning(plist.h:103): No description found for parameter '_lock' Warning(plist.h:129): No description found for parameter 'lock' Warning(plist.h:158): No description found for parameter 'pos' Warning(plist.h:169): No description found for parameter 'pos' Warning(plist.h:169): No description found for parameter 'n' Warning(plist.h:179): No description found for parameter 'mem' This still leaves one warning & one error that need attention: Error(plist.h:219): cannot understand prototype: '(' Warning(plist.h): no structured comments found Acked-by: Inaky Perez-Gonzalez Cc: Daniel Walker Cc: Thomas Gleixner Cc: Oleg Nesterov Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c4bbafda70a0fc95c6595bffd6825ef264050d01 Author: Alan Cox Date: Mon Apr 16 22:53:13 2007 -0700 exec.c: fix coredump to pipe problem and obscure "security hole" The patch checks for "|" in the pattern not the output and doesn't nail a pid on to a piped name (as it is a program name not a file) Also fixes a very very obscure security corner case. If you happen to have decided on a core pattern that starts with the program name then the user can run a program called "|myevilhack" as it stands. I doubt anyone does this. Signed-off-by: Alan Cox Confirmed-by: Christopher S. Aker Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c4b7e8754e3198eb5392568e523da6440143c2cd Author: Don Zickus Date: Mon Apr 16 22:53:12 2007 -0700 allow vmsplice to work in 32-bit mode on ppc64 Trivial change to pass vmsplice arguments through the compat layer on pp64. Signed-off-by: Don Zickus Acked-by: Stephen Rothwell Acked-by: Paul Mackerras Cc: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 19bb3506e27096eea5f7b71b89621ad1203ed318 Author: Evgeny Kravtsunov Date: Tue Apr 17 12:31:24 2007 -0700 [BRIDGE]: Unaligned access when comparing ethernet addresses compare_ether_addr() implicitly requires that the addresses passed are 2-bytes aligned in memory. This is not true for br_stp_change_bridge_id() and br_stp_recalculate_bridge_id() in which one of the addresses is unsigned char *, and thus may not be 2-bytes aligned. Signed-off-by: Evgeny Kravtsunov Signed-off-by: Kirill Korotaev Signed-off-by: Pavel Emelianov commit 0304ff8a2d5f57defb011c7f261b4c1b3eff96d1 Author: Paolo Galtieri Date: Tue Apr 17 12:52:36 2007 -0700 [SCTP]: Unmap v4mapped addresses during SCTP_BINDX_REM_ADDR operation. During the sctp_bindx() call to add additional addresses to the endpoint, any v4mapped addresses are converted and stored as regular v4 addresses. However, when trying to remove these addresses, the v4mapped addresses are not converted and the operation fails. This patch unmaps the addresses on during the remove operation as well. Signed-off-by: Paolo Galtieri Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit ea2bc483ff5caada7c4aa0d5fbf87d3a6590273d Author: Tsutomu Fujii Date: Tue Apr 17 12:49:53 2007 -0700 [SCTP]: Fix assertion (!atomic_read(&sk->sk_rmem_alloc)) failed message In current implementation, LKSCTP does receive buffer accounting for data in sctp_receive_queue and pd_lobby. However, LKSCTP don't do accounting for data in frag_list when data is fragmented. In addition, LKSCTP doesn't do accounting for data in reasm and lobby queue in structure sctp_ulpq. When there are date in these queue, assertion failed message is printed in inet_sock_destruct because sk_rmem_alloc of oldsk does not become 0 when socket is destroyed. Signed-off-by: Tsutomu Fujii Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit c2ecba71717c4f60671175fd26083c35a4b9ad58 Author: Pavel Emelianov Date: Tue Apr 17 12:45:31 2007 -0700 [NET]: Set a separate lockdep class for neighbour table's proxy_queue Otherwise the following calltrace will lead to a wrong lockdep warning: neigh_proxy_process() `- lock(neigh_table->proxy_queue.lock); arp_redo /* via tbl->proxy_redo */ arp_process neigh_event_ns neigh_update skb_queue_purge `- lock(neighbor->arp_queue.lock); This is not a deadlock actually, as neighbor table's proxy_queue and the neighbor's arp_queue are different queues. Lockdep thinks there is a deadlock as both queues are initialized with skb_queue_head_init() and thus have a common class. Signed-off-by: David S. Miller commit 5e7d7fa57323dfb48fb09464cf4542daa7ce8a72 Author: Aubrey.Li Date: Tue Apr 17 12:40:20 2007 -0700 [NET]: Fix UDP checksum issue in net poll mode. In net poll mode, the current checksum function doesn't consider the kind of packet which is padded to reach a specific minimum length. I believe that's the problem causing my test case failed. The following patch fixed this issue. Signed-off-by: Aubrey.Li Signed-off-by: David S. Miller commit 55569ce256ce29f4624f0007213432c1ed646584 Author: Kazunori MIYAZAWA Date: Tue Apr 17 12:32:20 2007 -0700 [KEY]: Fix conversion between IPSEC_MODE_xxx and XFRM_MODE_xxx. We should not blindly convert between IPSEC_MODE_xxx and XFRM_MODE_xxx just by incrementing / decrementing because the assumption is not true any longer. Signed-off-by: Kazunori MIYAZAWA Singed-off-by: YOSHIFUJI Hideaki commit b4dfa0b1fb39c7ffe74741d60668825de6a47b69 Author: Herbert Xu Date: Tue Apr 17 12:28:27 2007 -0700 [NET]: Get rid of alloc_skb_from_cache Since this was added originally for Xen, and Xen has recently (~2.6.18) stopped using this function, we can safely get rid of it. Good timing too since this function has started to bit rot. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 6f29e35e2d4cdbc3e8785982314e54ec5df4ad37 Author: Badari Pulavarty Date: Fri Apr 13 08:13:42 2007 -0700 cache_k8_northbridges() overflows beyond allocation cache_k8_northbridges() is storing config values to incorrect locations (in flush_words) and also its overflowing beyond the allocation, causing slab verification failures. Signed-off-by: Badari Pulavarty Signed-off-by: Linus Torvalds commit 608d8268be392444f825b4fc8fc7c8b509627129 Author: Michael S. Tsirkin Date: Mon Apr 16 17:04:55 2007 +0300 IB/mthca: Fix data corruption after FMR unmap on Sinai In mthca_arbel_fmr_unmap(), the high bits of the key are masked off. This gets rid of the effect of adjust_key(), which makes sure that bits 3 and 23 of the key are equal when the Sinai throughput optimization is enabled, and so it may happen that an FMR will end up with bits 3 and 23 in the key being different. This causes data corruption, because when enabling the throughput optimization, the driver promises the HCA firmware that bits 3 and 23 of all memory keys will always be equal. Fix by re-applying adjust_key() after masking the key. Thanks to Or Gerlitz for reproducing the problem, and Ariel Shahar for help in debug. Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit 1af1e32adef775dfc103f9679417009f2cf838ab Author: Ben Dooks Date: Mon Apr 9 10:15:20 2007 +0100 [ARM] 4313/1: S3C24XX: Update s3c2410 defconfig to 2.6.21-rc6 Update defconfig to the latest kernel version and enable the h1940 LED driver Signed-off-by: Ben Dooks Signed-off-by: Russell King commit 4c467e758a55e455264a994646b789ddb625fcaa Author: Russell King Date: Sun Apr 8 09:57:26 2007 +0100 [ARM] Update mach-types Signed-off-by: Russell King commit 1714f9bfc92d6ee67e84127332a1fae27772acfe Author: Andi Kleen Date: Mon Apr 16 10:30:27 2007 +0200 [PATCH] x86: Fix potential overflow in perfctr reservation While reviewing this code again I found a potential overflow of the bitmap. The p4 oprofile can theoretically set bits beyond the reservation bitmap for specific configurations. Avoid that by sizing the bitmaps properly. Signed-off-by: Andi Kleen commit 08269c6d38e003adb12f55c6d795daa89bdc1bae Author: Andi Kleen Date: Mon Apr 16 10:30:27 2007 +0200 [PATCH] x86: Fix gcc 4.2 _proxy_pda workaround Due to an over aggressive optimizer gcc 4.2 cannot optimize away _proxy_pda in all cases (counter intuitive, but true). This breaks loading of some modules. The earlier workaround to just export a dummy symbol didn't work unfortunately because the module code ignores exports with 0 value. Make it 1 instead. Signed-off-by: Andi Kleen commit 94a05509a9e11806acd797153d03019706e466f1 Author: Linus Torvalds Date: Sun Apr 15 16:50:57 2007 -0700 Linux 2.6.21-rc7 I tend to prefer to not have to cut an -rc7, but we still have some network device driver and suspend issues. So here's -rc7. Signed-off-by: Linus Torvalds commit eb4cac10d9f7b006da842e2d37414d13e1333781 Author: Trond Myklebust Date: Sun Apr 15 16:21:49 2007 -0400 NFS: Fix a list corruption problem We must remove the request from whatever list it is currently on before we can add it to the dirty list. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit 0492c371372ef5eac3a952509391dea231b0de89 Author: Zachary Amsden Date: Thu Apr 12 19:28:46 2007 -0700 Fix VMI relocation processing logic error Fix logic error in VMI relocation processing. NOPs would always cause a BUG_ON to fire because the != RELOCATION_NONE in the first if clause precluding the == VMI_RELOCATION_NOP in the second clause. Make these direct equality tests and just warn for unsupported relocation types (which should never happen), falling back to native in that case. Thanks to Anthony Liguori for noting this! Signed-off-by: Zachary Amsden Signed-off-by: Linus Torvalds commit 5a6d41b32a17ca902ef50fdfa170d7f23264bad5 Author: Trond Myklebust Date: Sat Apr 14 19:10:12 2007 -0400 NFS: Ensure PG_writeback is cleared when writeback fails If the writebacks are cancelled via nfs_cancel_dirty_list, or due to the memory allocation failing in nfs_flush_one/nfs_flush_multi, then we must ensure that the PG_writeback flag is cleared. Also ensure that we actually own the PG_writeback flag whenever we schedule a new writeback by making nfs_set_page_writeback() return the value of test_set_page_writeback(). The PG_writeback page flag ends up replacing the functionality of the PG_FLUSHING nfs_page flag, so we rip that out too. Signed-off-by: Trond Myklebust Cc: Peter Zijlstra Signed-off-by: Linus Torvalds commit 60fa3f769f7651a60125a0f44e3ffe3246d7cf39 Author: Trond Myklebust Date: Sat Apr 14 19:11:52 2007 -0400 NFS: Fix two bugs in the O_DIRECT write code Do not flag an error if the COMMIT call fails and we decide to resend the writes. Let the resend flag the error if it fails. If a write has failed, then nfs_direct_write_result should not attempt to send a commit. It should just exit asap and return the error to the user. Signed-off-by: Trond Myklebust Cc: Chuck Lever Signed-off-by: Linus Torvalds commit e1552e199857109d4b25b9163eff4646726eee3d Author: Trond Myklebust Date: Sat Apr 14 19:07:28 2007 -0400 NFS: Fix an Oops in nfs_setattr() It looks like nfs_setattr() and nfs_rename() also need to test whether the target is a regular file before calling nfs_wb_all()... Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit c9c57929d23e44f258d1b6e7f089e72c85f0bd1c Author: Ravikiran G Thirumalai Date: Fri Apr 13 16:28:20 2007 -0700 failsafe mechanism to HPET clock calibration Provide a failsafe mechanism to avoid kernel spinning forever at read_hpet_tsc during early kernel bootup. This failsafe mechanism was originally introduced in commit 2f7a2a79c3ebb44f8b1b7d9b4fd3a650eb69e544, but looks like the hpet split from time.c lost it again. This reintroduces the failsafe mechanism Signed-off-by: Ravikiran Thirumalai Signed-off-by: Shai Fultheim Cc: Jack Steiner Cc: john stultz Cc: Andi Kleen Signed-off-by: Linus Torvalds commit 8d3ee2cb0ab59f78fdc801ede7db15ef47387bd0 Author: David S. Miller Date: Sat Apr 14 10:29:10 2007 -0700 [SCSI] QLOGICPTI: Do not unmap DMA unless we actually mapped something. We only map DMA when cmd->request_bufflen is non-zero for non-sg buffers, we thus should make the same check when unmapping. Based upon a report from Pasi Pirhonen. Signed-off-by: David S. Miller commit 6e3b2bbb197eb12b2bef35bcf2ac3bd6a5facab2 Author: James Bottomley Date: Fri Apr 6 11:14:56 2007 -0500 [SCSI] 3w-xxxx: fix oops caused by incorrect REQUEST_SENSE handling 3w-xxxx emulates a REQUEST_SENSE response by simply returning nothing. Unfortunately, it's assuming that the REQUEST_SENSE command is implemented with use_sg == 0, which is no longer the case. The oops occurs because it's clearing the scatterlist in request_buffer instead of the memory region. This is fixed by using tw_transfer_internal() to transfer correctly to the scatterlist. Acked-by: adam radford Signed-off-by: James Bottomley commit d791d413fd8527aa6b130882cc84d52aee0fe980 Author: Olaf Kirch Date: Fri Apr 13 01:18:44 2007 -0400 DVB: dvb-usb-remote - fix oops when changing keymap DVB USB remotes do not support changing keycode maps but set input_dev->keycodesize and input_dev->keycodemax without setting input_dev->keycode. This causes kernel oops when user tries to look up (or change) current keymap. While the proper fix would be to make remotes handle keymap changes we'll just remove keycodemax and keycodesize initialization so EVIOCGKEYCODE and EVIOCSKEYCODE will simply return -EINVAL. http://bugzilla.kernel.org/show_bug.cgi?id=8312 Signed-off-by: olaf.kirch@oracle.com Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds commit 49688c843101ba6275756505e81af45ef50f87d7 Author: David S. Miller Date: Fri Apr 13 16:37:54 2007 -0700 [NETFILTER] arp_tables: Fix unaligned accesses. There are two device string comparison loops in arp_packet_match(). The first one goes byte-by-byte but the second one tries to be clever and cast the string to a long and compare by longs. The device name strings in the arp table entries are not guarenteed to be aligned enough to make this value, so just use byte-by-byte for both cases. Based upon a report by . Signed-off-by: David S. Miller commit 612f09e8495ba656032f89147ab999ef2be9c360 Author: YOSHIFUJI Hideaki Date: Fri Apr 13 16:18:02 2007 -0700 [IPV6] SNMP: Fix {In,Out}NoRoutes statistics. A packet which is being discarded because of no routes in the forwarding path should not be counted as OutNoRoutes but as InNoRoutes. Additionally, on this occasion, a packet whose destinaion is not valid should be counted as InAddrErrors separately. Based on patch from Mitsuru Chinen . Signed-off-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit 661697f728d75302e1f661a58db2fcba71d5cbc9 Author: Joy Latten Date: Fri Apr 13 16:14:35 2007 -0700 [IPSEC] XFRM_USER: kernel panic when large security contexts in ACQUIRE When sending a security context of 50+ characters in an ACQUIRE message, following kernel panic occurred. kernel BUG in xfrm_send_acquire at net/xfrm/xfrm_user.c:1781! cpu 0x3: Vector: 700 (Program Check) at [c0000000421bb2e0] pc: c00000000033b074: .xfrm_send_acquire+0x240/0x2c8 lr: c00000000033b014: .xfrm_send_acquire+0x1e0/0x2c8 sp: c0000000421bb560 msr: 8000000000029032 current = 0xc00000000fce8f00 paca = 0xc000000000464b00 pid = 2303, comm = ping kernel BUG in xfrm_send_acquire at net/xfrm/xfrm_user.c:1781! enter ? for help 3:mon> t [c0000000421bb650] c00000000033538c .km_query+0x6c/0xec [c0000000421bb6f0] c000000000337374 .xfrm_state_find+0x7f4/0xb88 [c0000000421bb7f0] c000000000332350 .xfrm_tmpl_resolve+0xc4/0x21c [c0000000421bb8d0] c0000000003326e8 .xfrm_lookup+0x1a0/0x5b0 [c0000000421bba00] c0000000002e6ea0 .ip_route_output_flow+0x88/0xb4 [c0000000421bbaa0] c0000000003106d8 .ip4_datagram_connect+0x218/0x374 [c0000000421bbbd0] c00000000031bc00 .inet_dgram_connect+0xac/0xd4 [c0000000421bbc60] c0000000002b11ac .sys_connect+0xd8/0x120 [c0000000421bbd90] c0000000002d38d0 .compat_sys_socketcall+0xdc/0x214 [c0000000421bbe30] c00000000000869c syscall_exit+0x0/0x40 --- Exception: c00 (System Call) at 0000000007f0ca9c SP (fc0ef8f0) is in userspace We are using size of security context from xfrm_policy to determine how much space to alloc skb and then putting security context from xfrm_state into skb. Should have been using size of security context from xfrm_state to alloc skb. Following fix does that Signed-off-by: Joy Latten Acked-by: James Morris Signed-off-by: David S. Miller commit 279e172a580d415b83eba4f9fbbc77b08e546553 Author: Jerome Borsboom Date: Fri Apr 13 16:12:47 2007 -0700 [VLAN]: Allow VLAN interface on top of bridge interface When a VLAN interface is created on top of a bridge interface and netfilter is enabled to see the bridged packets, the packets can be corrupted when passing through the netfilter code. This is caused by the VLAN driver not setting the 'protocol' and 'nh' members of the sk_buff structure. In general, this is no problem as the VLAN interface is mostly connected to a physical ethernet interface which does not use the 'protocol' and 'nh' members. For a bridge interface, however, these members do matter. Signed-off-by: Jerome Borsboom Signed-off-by: David S. Miller commit 24fc6f00b64985773b5abd592c4cb2e30bad7584 Author: Tom "spot" Callaway Date: Fri Apr 13 13:35:35 2007 -0700 [SPARC64]: Fix inline directive in pci_iommu.c While building a test kernel for the new esp driver (against git-current), I hit this bug. Trivial fix, put the inline declaration in the right place. :) Signed-off-by: Tom "spot" Callaway Signed-off-by: David S. Miller commit 5c7aa6ffae514bfeb7ec0f249dde949863d895ac Author: David S. Miller Date: Fri Apr 13 13:27:08 2007 -0700 [SPARC64]: Fix arg passing to compat_sys_ipc(). Do not sign extend args using the sys32_ipc stub, that is buggy and unnecessary. Based upon an excellent report by Mikael Pettersson. Signed-off-by: David S. Miller commit 6a04de6dbe1772d98fddf5099738d6f508e86e21 Author: Wu, Bryan Date: Wed Apr 11 23:28:47 2007 -0700 [PATCH] nommu: fix bug ip_conntrack does not work on nommu num_physpages is not exported out in mm/nommu.c, so the ip_conntrack module link will fail. Signed-off-by: Bryan Wu Acked-By: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c3724b129b5a1a1789a2dc5348685a236ae02479 Author: Jeff Mahoney Date: Wed Apr 11 23:28:46 2007 -0700 [PATCH] autofs4: fix race in unhashed dentry code Commit f50b6f8691cae2e0064c499dd3ef3f31142987f0 introduced a race in autofs4 between autofs_lookup_unhashed() and autofs_dentry_release(). autofs_dentry_release() ends up clearing the ->dentry and ->inode members of autofs_info before removing it from the rehash list. The list is protected by the rehash lock in both functions, but since autofs_dentry_release() starts tearing the autofs_info struct down before removing it from the list, autofs_lookup_unhashed() can get a autofs_info with a NULL dentry. This patch moves the clearing of ->dentry and ->inode after the removal from the rehash list. Signed-off-by: Jeff Mahoney Acked-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6d205f120547043de663315698dcf5f0eaa31b5c Author: Vladimir Saveliev Date: Wed Apr 11 23:28:44 2007 -0700 [PATCH] reiserfs: fix key decrementing This patch fixes a bug in function decrementing a key of stat data item. Offset of reiserfs keys are compared as signed values. To set key offset to maximal possible value maximal signed value has to be used. This bug is responsible for severe reiserfs filesystem corruption which shows itself as warning vs-13060. reiserfsck fixes this corruption by filesystem tree rebuilding. Signed-off-by: Vladimir Saveliev Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 505fa2c4a2f125a70951926dfb22b9cf273994f1 Author: Neil Brown Date: Wed Apr 11 23:28:44 2007 -0700 [PATCH] md: fix calculation for size of filemap_attr array in md/bitmap If 'num_pages' were ever 1 more than a multiple of 8 (32bit platforms) or of 16 (64 bit platforms). filemap_attr would be allocated one 'unsigned long' shorter than required. We need a round-up in there. Signed-off-by: Neil Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b6550777a32f7204f87475beb4f40d054fb8d4b4 Author: Bjorn Helgaas Date: Wed Apr 11 23:28:43 2007 -0700 [PATCH] cciss: unregister from SCSI before tearing down device resources We must unregister from SCSI before we unmap device resources and unhook the IRQ handler. Otherwise, SCSI may send us more requests, and we won't be able to handle them. I see the following oops during every reboot of my HP DL360: ... Unmounting local filesystems...done. Rebooting... Completed flushing cache on controller 0 BUG: unable to handle kernel paging request at virtual address f8808040 printing eip: c02dc72b *pde = 02120067 *pte = 00000000 Oops: 0002 [#1] SMP Modules linked in: CPU: 1 EIP: 0060:[] Not tainted VLI EFLAGS: 00010046 (2.6.21-rc6 #1) EIP is at SA5_submit_command+0xb/0x20 eax: f8808000 ebx: f7a00000 ecx: f79f0000 edx: 37a00000 esi: f79f0000 edi: 00000000 ebp: 00000000 esp: dd717a44 ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068 Process khelper (pid: 1427, ti=dd716000 task=c2260a70 task.ti=dd716000) Stack: c02df2c0 f7a00000 f7a00000 00d41008 c02df691 00000000 00000010 00000002 00000001 f79f0000 f7fff844 c1398420 00000000 00000000 00001000 230a3020 69666564 5420656e 50434f49 465f544b 4853554c 44414552 0a312009 66656423 Call Trace: [] start_io+0x80/0x120 [] do_cciss_request+0x331/0x350 [] mempool_alloc+0x2a/0xe0 [] blk_alloc_request+0x61/0x80 [] get_request+0x15e/0x1e0 [] cache_alloc_refill+0xb0/0x1e0 [] as_update_rq+0x2d/0x80 [] as_add_request+0x68/0x90 [] elv_insert+0x119/0x160 [] __make_request+0xcb/0x320 [] lock_timer_base+0x20/0x50 [] del_timer+0x56/0x60 [] blk_remove_plug+0x38/0x70 [] __generic_unplug_device+0x25/0x30 [] generic_unplug_device+0x15/0x30 ... Signed-off-by: Bjorn Helgaas Acked-by: Mike Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1668be71ccae5a9610fc8a224bd80fbe852f93ae Author: David Brownell Date: Wed Apr 11 23:28:42 2007 -0700 [PATCH] doc: gpio.txt describes open-drain emulation Update the GPIO docs to describe the idiom whereby open drain signals are emulated by toggling the GPIO direction. Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fe20e581a72979917e35d5146458ceba79be391f Author: Randy Dunlap Date: Wed Apr 11 23:28:41 2007 -0700 [PATCH] fix kernel oops with badly formatted module option Catch malformed kernel parameter usage of "param = value". Spaces are not supported, but don't cause a kernel fault on such usage, just report an error. Signed-off-by: Randy Dunlap Acked-by: Larry Finger Acked-by: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 09fe3ef46c5a2cc65d173df9518013e208eb3ba3 Author: Andrew Morton Date: Thu Apr 12 14:45:32 2007 -0700 [PKTGEN]: Add try_to_freeze() The pktgen module prevents suspend-to-disk. Fix. Acked-by: "Michal Piotrowski" Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 01102e7ca2e71ec0c300d41a1f3e594235b733ee Author: Patrick McHardy Date: Thu Apr 12 14:27:03 2007 -0700 [NETFILTER]: ipt_ULOG: use put_unaligned Use put_unaligned to fix warnings about unaligned accesses. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit f6b45da1299f1f2e92a1446cfa400be53fdc5c99 Author: Robert Reif Date: Thu Apr 12 13:47:37 2007 -0700 [SPARC]: Fix section mismatch warnings in pci.c and pcic.c Fix section mismatch in arch/sparc/kernel/pcic.c and arch/sparc64/kernel/pci.c. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit bc375ea7efcda0450b7cba9b3514e76d2e1cea79 Author: David S. Miller Date: Thu Apr 12 13:35:59 2007 -0700 [SUNRPC]: Make sure on-stack cmsg buffer is properly aligned. Based upon a report from Meelis Roos. Signed-off-by: David S. Miller commit 1d51c69fb6e61054cd6cc485f9bef77d19d82751 Author: Roland McGrath Date: Thu Apr 12 13:13:42 2007 -0700 [SPARC]: avoid CHILD_MAX and OPEN_MAX constants I don't figure anyone really cares about SunOS syscall emulation, and I certainly don't. But I'm getting rid of uses of the OPEN_MAX and CHILD_MAX compile-time constant, and these are almost the only ones. OPEN_MAX is a bogus constant with no meaning about anything. The RLIMIT_NOFILE resource limit is what sysconf (_SC_OPEN_MAX) actually wants to return. The CHILD_MAX cases weren't actually using anything I want to get rid of, but I noticed that they are there and are wrong too. The CHILD_MAX value is not really unlimited as a -1 return from sysconf indicates. The RLIMIT_NPROC resource limit is what sysconf (_SC_CHILD_MAX) wants to return. Signed-off-by: Roland McGrath Signed-off-by: David S. Miller commit 7a6491dffb5bf86ae86c90895c0f40aacceb7083 Author: Vitaly Bordug Date: Tue Apr 10 21:52:04 2007 +0400 [PPC] Fix compilation and linking errors of mpc86xads build. Fix compilation of mpc866ads_setup.c Signed-off-by: Vitaly Bordug Signed-off-by: Kumar Gala commit fa76abac9271e314c02aff9b407116b783e0ccbb Author: Vitaly Bordug Date: Tue Apr 10 21:52:02 2007 +0400 [PPC] Fix compilation and linking errors of mpc885ads build. Fix compilation of mpc885ads_setup.c Signed-off-by: Vitaly Bordug Signed-off-by: Kumar Gala commit 1ca19770c5ba90d041ba4d06976c77048d330cc8 Author: Steve Wise Date: Thu Apr 12 07:56:34 2007 -0500 RDMA/cxgb3: Add set_tcb_rpl_handler As of commit 6cdbd77e ("cxgb3 - missing CPL hanler and register setting."), the cxgb3 ethernet NIC driver no longer handles SET_TCB replies, so we need to do it in the iWARP driver. Signed-off-by: Steve Wise Acked-by: Divy Le Ray Signed-off-by: Roland Dreier commit 6df7d40682242b52c3ed1ea4bbdb594c2d8737c5 Author: Vitaly Bordug Date: Tue Apr 10 21:51:53 2007 +0400 [PPC] MPC8272 ADS compile fixed, defconfig refreshed. Fix compilation of mpc8272ads_setup.c Signed-off-by: Vitaly Bordug Signed-off-by: Kumar Gala commit 2f3a2efd85b698e51e90f06a37d85066725fb4c4 Author: David S. Miller Date: Wed Apr 11 21:38:45 2007 -0700 [SPARC64]: Fix SBUS IOMMU allocation code. There are several IOMMU allocator bugs. Instead of trying to fix this overly complicated code, just mirror the PCI IOMMU arena allocator which is very stable and well stress tested. I tried to make the code as identical as possible so we can switch sun4u PCI and SBUS over to a common piece of IOMMU code. All that will be need are two callbacks, one to do a full IOMMU flush and one to do a streaming buffer flush. This patch gets rid of a lot of hangs and mysterious crashes on SBUS sparc64 systems, at least for me. Signed-off-by: David S. Miller commit c48ea60359a303f3faf5991205b0cdb58dfe6eed Author: Dmitry Torokhov Date: Wed Apr 11 01:37:18 2007 -0400 [PATCH] PM: use kobject_name() to access kobject names Noone should use kobj.name directly since it may contain garbage. Objects with longer names have them stored in separately allocated memory pointed to by kobj->k_name. Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds commit 2ea547d2dec97b279ba90c7768960856f2116c79 Author: Emil Larsson Date: Thu Mar 29 22:48:46 2007 -0700 USB: Nikon D80 unusual device patch the Nikon D80 camera will not work without an UNUSUAL_DEV entry embodied in the attached patch (made against 2.6.20.3). Hope you find it helpful, or if not, pass it along to someone who does. From: Emil Larsson Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 61e8b858abe38c1042135065c59f7d339194b50b Author: Alan Stern Date: Mon Apr 9 11:52:31 2007 -0400 EHCI: fix remote wakeup regression in 2.6.21-rc There is one significant difference between the behavior of root hubs (as embodied in host controller hardware) and external hubs: When a remote-wakeup signal is received, an external hub sends an interrupt message at the _end_ of the resume sequence but a root hub generates and interrupt at the _beginning_ of the resume sequence. The host system must poll for the end of the sequence. When ehci-hcd was converted to interrupt-driven operation instead of using polling, the remaining need for this particular poll was overlooked. This patch (as894) fixes the problem. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit 22132178b26c907d19f661a4ae7fd265962d417e Author: Domen Puncer Date: Wed Apr 11 00:27:49 2007 +0200 [POWERPC] mpc52xx_pic: fix main interrupt masking The bit setting was off by one. Tested with RTC and GPIO_WKUP interrupts. Signed-off-by: Domen Puncer Signed-off-by: Sylvain Munaut Signed-off-by: Paul Mackerras commit 4b2281c7aa6a6e2615b35f8cebd93656dc6d714c Author: Brice Goglin Date: Tue Apr 10 21:22:19 2007 +0200 myri10ge: update driver version to 1.3.0-1.233 Update the myri10ge driver version number to 1.3.0-1.233. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit f19baaeaadf9d77bcc6c122500c70b27c5bbc7a4 Author: Brice Goglin Date: Tue Apr 10 21:21:39 2007 +0200 myri10ge: more Intel chipsets providing aligned PCIe completions Add the Intel 5000 southbridge (aka Intel 6310/6311/6321ESB) PCIe ports and the Intel E30x0 chipsets to the whitelist of aligned PCIe completion. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit ae8509b1876e6e1074edc9846296e80983e30502 Author: Brice Goglin Date: Tue Apr 10 21:21:08 2007 +0200 myri10ge: fix management of the firmware 4KB boundary crossing restriction Simpler way of dealing with the firmware 4KB boundary crossing restriction for rx buffers. This fixes a variety of memory corruption issues when using an "uncommon" MTU with a 16KB page size. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit 6cdbd77e8883aac2e24f8b19b91e5b1c839213a0 Author: Divy Le Ray Date: Mon Apr 9 20:10:33 2007 -0700 cxgb3 - missing CPL hanler and register setting. Remove specific CPL handler. Add missing CPL handler. Add missing register setting when the interface is brought up. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 59cf81076a85e1df273155298c462574b49cc0fe Author: Divy Le Ray Date: Mon Apr 9 20:10:27 2007 -0700 cxgb3 - MAC watchdog update The MAC watchdog was failing if the peer interface was brought down. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit f2d961c9827bab4b64a1b4ea30c68cf5ab2b2330 Author: Divy Le Ray Date: Mon Apr 9 20:10:22 2007 -0700 cxgb3 - avoid deadlock with mac watchdog Fix a deadlock when the interface s configured down and the watchdog tack is sleeping on rtnl_lock. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 692412b31ffb5df00197ea591dd635fc07506c02 Author: Stephen Hemminger Date: Mon Apr 9 15:32:45 2007 -0700 skge: fix wake on lan Need to rework wake on lan code to setup properly and get activated on shutdown (and suspend), not when ethtool is run. This does not need to go to stable queue because wake on lan was not even included in 2.6.20 (or earlier versions). Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 9467a8fc89844ff2ea9c6d13460dddb3b674cc37 Author: Stephen Hemminger Date: Sat Apr 7 16:02:28 2007 -0700 sky2: phy workarounds for Yukon EC-U A1 The workaround Yukon EC-U wasn't comparing with correct version and wasn't doing correct setup. Without it, 88e8056 throws all sorts of errors. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 1ad5b4a5c224c5f98f9745adbcf99899624c8138 Author: Stephen Hemminger Date: Sat Apr 7 16:02:27 2007 -0700 sky2: turn on clocks when doing resume Some of these chips are disabled until clock is enabled. This fixes: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404107 Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 9a87240c67565578a9533101b930ef4a975be333 Author: Stephen Hemminger Date: Sat Apr 7 16:02:26 2007 -0700 sky2: turn carrier off when down Driver needs to turn off carrier when down. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit e5b9ddd9a0f95e133db7b43d05978f24cd6f1369 Author: Stephen Hemminger Date: Sat Apr 7 16:02:25 2007 -0700 skge: turn carrier off when down Driver needs to turn off carrier when down, otherwise it can confuse bonding and bridging and looks like carrier is on immediately when it is brought back up. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 5ab7ffea520948115a51a9931e1bb4c818aa8e35 Author: David Howells Date: Tue Apr 10 15:10:45 2007 +0100 [PATCH] FRV: Update the FRV arch MAINTAINER record to get a hit on "grep -i frv" Update the FRV arch MAINTAINER record to get a hit on "grep -i frv". Whilst FR-V is technically correct, it's normally thought of as FRV. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit ff78b20235f84966c4b7962ce94e800adecc5383 Author: Cliff Brake Date: Mon Apr 9 23:50:50 2007 -0400 [PATCH] Input: ucb1400 - set up driver's name to show in sysfs The UCB1400 is missing a name parameter in the device_driver struct. This causes missing information in the /sys tree and seems to cause other problems with the AC97 functionality. This was tested on a PXA270 system. Signed-off-by: Cliff Brake Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds commit a7a832de9e9624bcf069a5369c3c38ba2f44d460 Author: Danny Kukawka Date: Tue Apr 10 22:39:14 2007 +0200 ide: add "optical" to sysfs "media" attribute Add "optical" to sysfs "media" attribute as already in /proc Signed-off-by: Danny Kukawka Signed-off-by: Bartlomiej Zolnierkiewicz commit 76ca1af10e28021e1894c5703da42b5e7bff1771 Author: Stuart Hayes Date: Tue Apr 10 22:38:43 2007 +0200 ide: ugly messages trying to open CD drive with no media present I get the following error messages when trying to open a CD device (specifically, the Teac CD-ROM CD-224E) that has no media present: hda: packet command error: status=3D0x51 { DriveReady SeekComplete Error } hda: packet command error: error=3D0x54 { AbortedCommand LastFailedSense=0x05 } ide: failed opcode was: unknown This happens when a "start stop unit" command (0x1b 0 0 0 3 0 0 0 0 0) is sent to the drive to try to close the CD-ROM tray, but this drive doesn't have that capability (it's a slim portable-type CD-ROM), so it reports sense key 5 (illegal request) with asc/ascq 24/0. This is exactly how SFF8090i says it should respond. But ide-cd.c (in cdrom_decode_status() ) just sees sense key 5 and spews out an error. It then goes on to request sense data, and cdrom_log_sense() understands this error and doesn't log it. The patch, for kernel 2.6.20.4, suppresses this error message. Signed-off-by: Stuart Hayes Cc: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit 23450319e2890986c247ec0aa1442f060e657e6d Author: Suleiman Souhlal Date: Tue Apr 10 22:38:37 2007 +0200 ide: correctly prevent IDE timer expiry function to run if request was already handled It is possible for the timer expiry function to run even though the request has already been handled: ide_timer_expiry() only checks that the handler is not NULL, but it is possible that we have handled a request (thus clearing the handler) and then started a new request (thus starting the timer again, and setting a handler). A simple way to exhibit this is to set the DMA timeout to 1 jiffy and run dd: The kernel will panic after a few minutes because ide_timer_expiry() tries to add a timer when it's already active. To fix this, we simply add a request generation count that gets incremented at every interrupt, and check in ide_timer_expiry() that we have not already handled a new interrupt before running the expiry function. Signed-off-by: Suleiman Souhlal Signed-off-by: Bartlomiej Zolnierkiewicz commit 50c9cc2e540aeaab78ab548a8d42568977c6844f Author: Jaroslav Kysela Date: Tue Apr 10 13:26:48 2007 -0700 [NETFILTER]: ipt_CLUSTERIP: fix oops in checkentry function The clusterip_config_find_get() already increases entries reference counter, so there is no reason to do it twice in checkentry() callback. This causes the config to be freed before it is removed from the list, resulting in a crash when adding the next rule. Signed-off-by: Jaroslav Kysela Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit ec759a2b383b50950be37fbe470c4cc2ca18e2ce Author: Larry Finger Date: Sat Apr 7 14:11:03 2007 -0500 [PATCH] bcm43xx: Fix PPC machine checks and match loopback gain specs The specifications for loopback_gain calculation and for G PHY initialization have been updated. This patch implements them and fixes a machine check error that occurs for PPC architecture with a phy->rev of 1. Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit 81e880064dd32b3efdc41ad4cc2416c4744693ee Author: Larry Finger Date: Sat Apr 7 13:54:35 2007 -0500 [PATCH] bcm43xx: Fix 802.11b/g scan limits to match regulatory reqs In 802.11b/g mode, bcm43xx actively scans channels 1-14 no matter what locale has been set, either in the sprom or by the locale option. This behaviorviolates regulatory rules everywhere in the world except Japan. This patch changes the default range to the correct value if the locale has been set, and to channels 1-13 if no locale has been set. Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit 92b3e2e9253a9f4c9224071842fd263c334dece0 Author: Daniel Drake Date: Tue Apr 3 23:17:37 2007 +0100 [PATCH] zd1211rw: Fix E2P_PHY_REG patching Due to conflicting/confusing defines in the vendor driver, we were reading E2P_PHY_REG from the wrong location. CR157 patching was slightly incorrect in that the vendor driver only patches in an 8-bit value, whereas we were patching 24 bits. Additionally, CR157 patching was happening on both zd1211 and zd1211b, but this should only happen on zd1211. Signed-off-by: Daniel Drake Signed-off-by: Ulrich Kunitz Signed-off-by: John W. Linville commit 6371ea3d48e17d4638a91a4a1e0364e56204e418 Author: Michael S. Tsirkin Date: Tue Apr 10 18:32:42 2007 +0300 IPoIB/cm: Fix DMA direction typo Receive buffers need to be mapped with DMA_FROM_DEVICE. Incorrectly mapping with DMA_TO_DEVICE causes a hard lock on ppc64 machines with an IOMMU. This fixes Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit ae6ead4623bfbc57f3945ff86f27e51811e2e91b Author: Daniel Drake Date: Sun Mar 11 19:54:11 2007 +0000 [PATCH] zd1211rw: Reject AL2230S devices zd1211rw currently detects AL2230S-based devices as AL2230, and hence programs the RF incorrectly. Transmit silently fails on this misconfiguration. After this patch, AL2230S devices are rejected with an error message, to avoid any confusion with an apparent driver bug. Signed-off-by: Daniel Drake Signed-off-by: John W. Linville commit 52ea0718ea506df0915eacedb439e65c5f214e0e Author: Wang Zhenyu Date: Tue Apr 10 09:42:48 2007 +0800 [AGPGART] intel_agp: fix G965 GTT size detect On G965, I810_PGETBL_CTL is a mmio offset, but we wrongly take it as pci config space offset in detecting GTT size. This one line patch fixs this. Signed-off-by: Wang Zhenyu Signed-off-by: Dave Jones commit 15d33c070ddde99f7368e6b17b71d22c866f97d9 Author: David S. Miller Date: Mon Apr 9 13:23:14 2007 -0700 [TCP]: slow_start_after_idle should influence cwnd validation too For the cases that slow_start_after_idle are meant to deal with, it is almost a certainty that the congestion window tests will think the connection is application limited and we'll thus decrease the cwnd there too. This defeats the whole point of setting slow_start_after_idle to zero. So test it there too. We do not cancel out the entire tcp_cwnd_validate() function so that if the sysctl is changed we still have the validation state maintained. Signed-off-by: David S. Miller commit 699784b7614ce61b16a075445b8e5b6c379c5086 Author: Herbert Xu Date: Mon Apr 9 11:51:15 2007 -0700 [SC92031]: Fix priv->lock context The spin_lock calls made in dev->open and dev->close must disable BH since open/close are made in process context. Conversely, the call in dev->hard_start_xmit does not need to disable BH since it is already executing with BH disabled. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit bb8a954f27ed8fb8f57e80e6b63d837cfdcad689 Author: Patrick McHardy Date: Mon Apr 9 11:42:25 2007 -0700 [NET_SCHED]: cls_tcindex: fix compatibility breakage Userspace uses an integer for TCA_TCINDEX_SHIFT, the kernel was changed to expect and use a u16 value in 2.6.11, which broke compatibility on big endian machines. Change back to use int. Reported by Ole Reinartz Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 199c1167f5e8123a9b0a9ab1e8b78a6aa4b2733f Author: Stefan Richter Date: Thu Mar 22 00:40:06 2007 +0100 ieee1394: change deprecation status of dv1394 Nobody ported ffmpeg from dv1394 to rawiso yet, and there is no justification to remove dv1394 right now. Nevertheless, a strong deprecation of this ABI makes a lot of sense, especially as Kristian H's drivers shape up to be an attractive alternative to the existing ones. But we don't have a schedule at the moment. Signed-off-by: Stefan Richter commit c2481cc4a8727141474472cb1301fce989ce0865 Author: Andrew Morton Date: Sun Apr 8 16:04:04 2007 -0700 [PATCH] i386: irqbalance_disable() section fix WARNING: arch/i386/kernel/built-in.o - Section mismatch: reference to .init.text:irqbalance_disable from .text between 'quirk_intel_irqbalance' (at offset 0x80a5) and 'i8237A_suspend' Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c993c7355df55283bc9a539652be44cd81b8c6dd Author: Andrew Morton Date: Sun Apr 8 16:04:03 2007 -0700 [PATCH] x86_64 early quirks: fix early_qrk[] section tag WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:nvidia_bugs from .data between 'early_qrk' (at offset 0x8428) and 'enable_cpu_hotplug' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:via_bugs from .data between 'early_qrk' (at offset 0x8438) and 'enable_cpu_hotplug' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:ati_bugs from .data between 'early_qrk' (at offset 0x8448) and 'enable_cpu_hotplug' The compiler is putting it into .data because the __initdata is in the wrong place. Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b6d2cccb55b518956a7de75182757276a2057869 Author: David Brownell Date: Sun Apr 8 16:04:02 2007 -0700 [PATCH] omap_cf: oops-on-suspend fix Convert omap_cf into a platform_driver ... this resolves oopsing during suspend/resume. Evidently folk haven't tried suspend/resume on an OSK (the main platform for this driver) since September or so, which is when platform_device learned about suspend_late()/resume_early() and stopped being able to suspend/resume without a platform_driver. Signed-off-by: David Brownell Cc: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 49f19710512c825aaea73b9207b3a848027cda1d Author: Zachary Amsden Date: Sun Apr 8 16:04:01 2007 -0700 [PATCH] Proper fix for highmem kmap_atomic functions for VMI for 2.6.21 Since lazy MMU batching mode still allows interrupts to enter, it is possible for interrupt handlers to try to use kmap_atomic, which fails when lazy mode is active, since the PTE update to highmem will be delayed. The best workaround is to issue an explicit flush in kmap_atomic_functions case; this is the only way nested PTE updates can happen in the interrupt handler. Thanks to Jeremy Fitzhardinge for noting the bug and suggestions on a fix. This patch gets reverted again when we start 2.6.22 and the bug gets fixed differently. Signed-off-by: Zachary Amsden Cc: Andi Kleen Cc: Jeremy Fitzhardinge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a5bfffac645a7b2d8119f8bbae34df5c94832799 Author: Timo Savola Date: Sun Apr 8 16:04:00 2007 -0700 [PATCH] fuse: validate rootmode mount option If rootmode isn't valid, we hit the BUG() in fuse_init_inode. Now EINVAL is returned. Signed-off-by: Timo Savola Signed-off-by: Miklos Szeredi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4598af33d9143942f00cf7692b247027aba35316 Author: Wang Zhenyu Date: Mon Apr 9 08:51:36 2007 +0800 [AGPGART] intel_agp: PCI id update for Intel 965GM Update PCI id info for Intel 965GM chipset. Signed-off-by: Wang Zhenyu Signed-off-by: Dave Jones commit d354d2f4a6fc1b722c2e464a8b3cfd2f6afb304b Author: Linus Torvalds Date: Sat Apr 7 10:18:33 2007 -0700 sched.c: Remove unused variable 'relative' Getting rid of the p->children printout in show_task() left behind an unused variable. Signed-off-by: Linus Torvalds commit 35f6f753b79705bc4b62da5dcc218d75ffa88370 Author: Ingo Molnar Date: Fri Apr 6 21:18:06 2007 +0200 [PATCH] sched: get rid of p->children use in show_task() the p->parent PID printout gives us all the information about the task tree that we need - the eldest_child()/older_sibling()/ younger_sibling() printouts are mostly historic and i do not remember ever having used those fields. (IMO in fact they confuse the SysRq-T output.) So remove them. This code has sentimental value though, those fields and printouts are one of the oldest ones still surviving from Linux v0.95's kernel/sched.c: if (p->p_ysptr || p->p_osptr) printk(" Younger sib=%d, older sib=%d\n\r", p->p_ysptr ? p->p_ysptr->pid : -1, p->p_osptr ? p->p_osptr->pid : -1); else printk("\n\r"); written 15 years ago, in early 1992. Signed-off-by: Ingo Molnar Signed-off-by: Linus 'snif' Torvalds commit 7f30e49ee1c2c1e95ce9d2ccce5221ddb793dd60 Author: Tejun Heo Date: Sat Apr 7 14:59:41 2007 +0900 [PATCH] irq-devres: fix failure path of devm_request_irq() devres should be deallocated with devres_free() not kfree(). This bug corrupts slab on IRQ request failure. Fix it. Signed-off-by: Tejun Heo Cc: Andrew Morton Cc: Greg KH Signed-off-by: Linus Torvalds commit 995f054f2a342f8505fed4f8395d12c0f5966414 Author: Ingo Molnar Date: Sat Apr 7 12:05:00 2007 +0200 [PATCH] high-res timers: resume fix Soeren Sonnenburg reported that upon resume he is getting this backtrace: [] smp_apic_timer_interrupt+0x57/0x90 [] retrigger_next_event+0x0/0xb0 [] apic_timer_interrupt+0x28/0x30 [] retrigger_next_event+0x0/0xb0 [] __kfifo_put+0x8/0x90 [] on_each_cpu+0x35/0x60 [] clock_was_set+0x18/0x20 [] timekeeping_resume+0x7c/0xa0 [] __sysdev_resume+0x11/0x80 [] sysdev_resume+0x47/0x80 [] device_power_up+0x5/0x10 it turns out that on resume we mistakenly re-enable interrupts too early. Do the timer retrigger only on the current CPU. Signed-off-by: Ingo Molnar Acked-by: Thomas Gleixner Acked-by: Soeren Sonnenburg Signed-off-by: Linus Torvalds commit b8fa2f3a82069304acac1f9e957d491585f4f49a Author: Michael Chan Date: Fri Apr 6 17:35:37 2007 -0700 [TG3]: Fix crash during tg3_init_one(). The driver will crash when the chip has been initialized by EFI before tg3_init_one(). In this case, the driver will call tg3_chip_reset() before allocating consistent memory. The bug is fixed by checking for tp->hw_status before accessing it during tg3_chip_reset(). Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 2e0d232bff31973f58c33412b45fce51b6770698 Author: Mike Habeck Date: Fri Apr 6 12:04:39 2007 -0500 [IA64] SGI Altix : fix pcibr_dmamap_ate32() bug On a SGI Altix TIOCP based PCI bus we need to include the ATE_PIO attribute bit if we're mapping a 32bit MSI address. Signed-off-by: Mike Habeck Signed-off-by: Tony Luck commit 8a3a78d1498c4c13c3ec235a4b6338624b6ef68d Author: Venki Pallipadi Date: Fri Apr 6 10:04:49 2007 -0700 [IA64] Fix CPU freq displayed in /proc/cpuinfo My patch: git commit=95235ca2c20ac0b31a8eb39e2d599bcc3e9c9a10 introduced a bug in IA64 cpuinfo output. Patch changed the proc_freq from 1HZ resolution to 1KHz resolution, but left format string unchanged at " %lu.%06lu". Below is the fix. Thanks to Bjorn for catching this. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Tony Luck commit 9438a1218eceb1b3891d242da01bc3cc82cb7342 Author: Ishimatsu Yasuaki Date: Fri Apr 6 16:51:12 2007 +0900 [IA64] Fix wrong assumption about irq and vector in msi_ia64.c This patch fixes a wrong assumption in ia64 MSI code that IRQ equals vector. Signed-off-by: Kenji Kaneshige Signed-off-by: Yasuaki Ishimatsu Signed-off-by: Tony Luck commit fbff71e1ec1c4695d51d496a53228ecdcb6361eb Author: Russ Anderson Date: Fri Mar 30 17:13:18 2007 -0500 [IA64] BTE error timer fix The bte recovery_timer was not being set correctly. Signed-off-by: Russ Anderson Signed-off-by: Tony Luck commit 161980f4c6b846625efe6227420175cb41477de3 Author: David S. Miller Date: Fri Apr 6 11:42:27 2007 -0700 [IPV6]: Revert recent change to rt6_check_dev(). This reverts a0d78ebf3a0e33a1aeacf2fc518ad9273d6a1c2f It causes pings to link-local addresses to fail. Signed-off-by: David S. Miller commit a21bd69e1509b43823c317c3bf3f7ffa99884356 Author: Linus Torvalds Date: Thu Apr 5 19:36:56 2007 -0700 Linux 2.6.21-rc6 .. perfect? Ahh, sure. Signed-off-by: Linus Torvalds commit 254d0d24e31c3df64ccfff349c9aa9d1e5989819 Author: Patrick McHardy Date: Thu Apr 5 16:03:33 2007 -0700 [XFRM]: beet: fix IP option decapsulation Beet mode looks for the beet pseudo header after the outer IP header, which is wrong since that is followed by the ESP header. Additionally it needs to adjust the packet length after removing the pseudo header and point the data pointer to the real data location. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit d4b1e840629562953d81c9fe0a3a67473f3d993c Author: Patrick McHardy Date: Thu Apr 5 15:59:41 2007 -0700 [XFRM]: beet: fix beet mode decapsulation Beet mode decapsulation fails to properly set up the skb pointers, which only works by accident in combination with CONFIG_NETFILTER, since in that case the skb is fixed up in xfrm4_input before passing it to the netfilter hooks. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 04fef9893a1fa5d429522e09bc9591736408f2e8 Author: Patrick McHardy Date: Thu Apr 5 15:54:39 2007 -0700 [XFRM]: beet: use IPOPT_NOP for option padding draft-nikander-esp-beet-mode-07.txt states "The padding MUST be filled with NOP options as defined in Internet Protocol [1] section 3.1 Internet header format.", so do that. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit c5027c9a896fbe05367fb893a274deca5114bfd0 Author: Patrick McHardy Date: Thu Apr 5 15:54:02 2007 -0700 [XFRM]: beet: fix IP option encapsulation Beet mode calculates an incorrect value for the transport header location when IP options are present, resulting in encapsulation errors. The correct location is 4 or 8 bytes before the end of the original IP header, depending on whether the pseudo header is padded. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 1d426d6418d1914b592c9c307c02e488d9182fa8 Author: Erez Zilber Date: Sun Apr 1 12:53:43 2007 +0200 IB/iser: Don't defer connection failure notification to workqueue When a connection is terminated asynchronously from the iSCSI layer's perspective, iSER needs to notify the iSCSI layer that the connection has failed. This is done using a workqueue (switched to from the iSER tasklet context). Meanwhile, the connection object (that holds the work struct) is released. If the workqueue function wasn't called yet, it will be called later with a NULL pointer, which will crash the kernel. The context switch (tasklet to workqueue) is not required, and everything can be done from the iSER tasklet. This eliminates the NULL work struct bug (and simplifies the code). Signed-off-by: Erez Zilber Signed-off-by: Roland Dreier commit 8da7d1bae512aee155ef02f7ab1266358842e1fd Author: Adam Kropelin Date: Thu Apr 5 16:06:30 2007 +0200 HID: Do not discard truncated input reports Truncated reports should not be discarded since it prevents buggy devices from communicating with userspace. Prior to the regession introduced in 2.6.20, a shorter-than-expected report in hid_input_report() was passed thru after having the missing bytes cleared. This behavior was established over a few patches in the 2.6.early-teens days, including commit cd6104572bca9e4afe0dcdb8ecd65ef90b01297b. This patch restores the previous behavior and fixes the regression. Signed-off-by: Adam Kropelin Signed-off-by: Jiri Kosina commit 4c4d51a7316b164ba08af61aa0c124a88bc60450 Author: Herbert Xu Date: Thu Apr 5 00:07:39 2007 -0700 [IPSEC]: Reject packets within replay window but outside the bit mask Up until this point we've accepted replay window settings greater than 32 but our bit mask can only accomodate 32 packets. Thus any packet with a sequence number within the window but outside the bit mask would be accepted. This patch causes those packets to be rejected instead. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 60e5c166413f17d5ef00b4c1f398dbd44291309a Author: Mitsuru Chinen Date: Wed Apr 4 23:54:59 2007 -0700 [IPv6]: Exclude truncated packets from InHdrErrors statistics Incoming trancated packets are counted as not only InTruncatedPkts but also InHdrErrors. They should be counted as InTruncatedPkts only. Signed-off-by: Mitsuru Chinen Acked-by: YOSHIFUJI Hideaki Signed-off-by: David S. Miller commit 75559c167bddc1254db5bcff032ad5eed8bd6f4a Author: Jean Delvare Date: Wed Apr 4 23:52:46 2007 -0700 [APPLETALK]: Fix a remotely triggerable crash When we receive an AppleTalk frame shorter than what its header says, we still attempt to verify its checksum, and trip on the BUG_ON() at the end of function atalk_sum_skb() because of the length mismatch. This has security implications because this can be triggered by simply sending a specially crafted ethernet frame to a target victim, effectively crashing that host. Thus this qualifies, I think, as a remote DoS. Here is the frame I used to trigger the crash, in npg format: { # Ethernet header ----- XX XX XX XX XX XX # Destination MAC 00 00 00 00 00 00 # Source MAC 00 1D # Length # LLC header ----- AA AA 03 08 00 07 80 9B # Appletalk # Appletalk header ----- 00 1B # Packet length (invalid) 00 01 # Fake checksum 00 00 00 00 # Destination and source networks 00 00 00 00 # Destination and source nodes and ports # Payload ----- 0C 0D 0E 0F 10 11 12 13 14 } The destination MAC address must be set to those of the victim. The severity is mitigated by two requirements: * The target host must have the appletalk kernel module loaded. I suspect this isn't so frequent. * AppleTalk frames are non-IP, thus I guess they can only travel on local networks. I am no network expert though, maybe it is possible to somehow encapsulate AppleTalk packets over IP. The bug has been reported back in June 2004: http://bugzilla.kernel.org/show_bug.cgi?id=2979 But it wasn't investigated, and was closed in July 2006 as both reporters had vanished meanwhile. This code was new in kernel 2.6.0-test5: http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=7ab442d7e0a76402c12553ee256f756097cae2d2 And not modified since then, so we can assume that vanilla kernels 2.6.0-test5 and later, and distribution kernels based thereon, are affected. Note that I still do not know for sure what triggered the bug in the real-world cases. The frame could have been corrupted by the kernel if we have a bug hiding somewhere. But more likely, we are receiving the faulty frame from the network. Signed-off-by: Jean Delvare Signed-off-by: David S. Miller commit 58e949139014a852a83b5ef071136b1f50c86ad1 Author: Maciej Zenczykowski Date: Wed Apr 4 19:08:27 2007 -0700 [PATCH] ia64: desc_empty thinko/typo fix Just a one-byter for an ia64 thinko/typo - already fixed for i386 and x86_64. Acked-by: Tony Luck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ba6e8564f459211117ce300eae2c7fdd23befe34 Author: Yoichi Yuasa Date: Wed Apr 4 19:08:25 2007 -0700 [PATCH] Fix build error on zs serial driver drivers/tc/zs.c:73:24: error: asm/dec/tc.h: No such file or directory Signed-off-by: Yoichi Yuasa Acked-by: Maciej W. Rozycki Cc: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 98de9e3ba23422b5c45b91c93aec1cb1e17514dc Author: john stultz Date: Wed Apr 4 19:08:24 2007 -0700 [PATCH] fix jiffies clocksource inittime In debugging a problem w/ the -rt tree, I noticed that on systems that mark the tsc as unstable before it is registered, the TSC would still be selected and used for a short period of time. Digging in it looks to be a result of the mix of the clocksource list changes and my clocksource initialization changes. With the -rt tree, using a bad TSC, even for a short period of time can results in a hang at boot. I was not able to reproduce this hang w/ mainline, but I'm not completely certain that someone won't trip on it. This patch resolves the issue by initializing the jiffies clocksource earlier so a bad TSC won't get selected just because nothing else is yet registered. Signed-off-by: John Stultz Acked-by: Thomas Gleixner Cc: Ingo Molnar Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7f42d3b8a72ab585f3166a269276c8cca12088af Author: Mike Miller (OS Dev) Date: Wed Apr 4 19:08:23 2007 -0700 [PATCH] cciss: add init of drv->cylinders back to cciss_geometry_inquiry This patch adds initialization of drv->cylinders back into the failing case in cciss_geometry_inquiry. I inadvertently removed it in one my 2TB updates. Signed-off-by: Mike Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2363cc0264c42636e9e7622f78dde5c2f66beb8e Author: Andrew Morton Date: Wed Apr 4 19:08:22 2007 -0700 [PATCH] remove protection of LANANA-reserved majors Revert all this. It can cause device-mapper to receive a different major from earlier kernels and it turns out that the Amanda backup program (via GNU tar, apparently) checks major numbers on files when performing incremental backups. Which is a bit broken of Amanda (or tar), but this feature isn't important enough to justify the churn. Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c75fd0ee6e1750e6e527ed1d4aeee66739d9ad79 Author: Rafael J. Wysocki Date: Wed Apr 4 19:08:21 2007 -0700 [PATCH] swsusp: fix memory shrinker Fix a bug in the swsusp's memory shrinker that causes some systems using highmem to refuse to suspend to disk if image_size is set above 1/2 of available RAM. Special thanks to Jiri Slaby for reporting the problem and assistance in debugging it. Signed-off-by: Rafael J. Wysocki Cc: Jiri Slaby Cc: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 418106d6248618bca1add65168a82974c72206db Author: Adrian Bunk Date: Wed Apr 4 19:08:21 2007 -0700 [PATCH] net/sunrpc/svcsock.c: fix a check The return value of kernel_recvmsg() should be assigned to "err", not compared with the random value of a never initialized "err" (and the "< 0" check wrongly always returned false since == comparisons never have a result < 0). Spotted by the Coverity checker. Signed-off-by: Adrian Bunk Acked-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5792a2856a63cdc568e08a7d6f9b2413d9217b3e Author: NeilBrown Date: Wed Apr 4 19:08:18 2007 -0700 [PATCH] md: avoid a deadlock when removing a device from an md array via sysfs A device can be removed from an md array via e.g. echo remove > /sys/block/md3/md/dev-sde/state This will try to remove the 'dev-sde' subtree which will deadlock since commit e7b0d26a86943370c04d6833c6edba2a72a6e240 With this patch we run the kobject_del via schedule_work so as to avoid the deadlock. Cc: Alan Stern Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 456a09dce9ca9b0013cabcda918aee851a04471d Author: Thomas Bittermann Date: Wed Apr 4 22:20:54 2007 +0200 [PATCH] kernel/time.c: add missing symbol exports This patch adds 2 missing symbol exports: jiffies_to_timeval() and timeval_to_jiffies(). The (not yet merged) dm-raid4-5 module will need them, and they used to be indirectly exported by virtue of being inline functions. Commit 8b9365d753d9870bb6451504c13570b81923228f ("[PATCH] Uninline jiffies.h functions") uninlined them, and thus modules now need them explicitly exported to use them. Signed-off-by: Thomas Bittermann Acked-by: Andrew Morton Acked-by: Ingo Molnar Acked-by: Thomas Gleixner Acked-by: john stultz Signed-off-by: Linus Torvalds commit 927498217c104aab27b81c785ce3a489491a8964 Author: Eric W. Biederman Date: Tue Apr 3 00:07:30 2007 -0600 [PATCH] net: Ignore sysfs network device rename bugs. The generic networking code ensures that no two networking devices have the same name, so there is no time except when sysfs has implementation bugs that device_rename when called from dev_change_name will fail. The current error handling for errors from device_rename in dev_change_name is wrong and results in an unusable and unrecoverable network device if device_rename is happens to return an error. This patch removes the buggy error handling. Which confines the mess when device_rename hits a problem to sysfs, instead of propagating it the rest of the network stack. Making linux a little more robust. Without this patch you can observe what happens when sysfs has a bug when CONFIG_SYSFS_DEPRECATED is not set and you attempt to rename a real network device to a name like (broken_parity_status, device, modalias, power, resource2, subsystem_vendor, class, driver, irq, msi_bus, resource, subsystem, uevent, config, enable, local_cpus, numa_node, resource0, subsystem_device, vendor) Greg has a patch that fixes the sysfs bugs but he doesn't trust it for a 2.6.21 timeframe. This patch which just ignores errors should be safe and it keeps the system from going completely wacky. Signed-off-by: Eric W. Biederman Signed-off-by: Linus Torvalds commit e94a40c508dbdce872c79a13b35830c050d71e23 Author: David Howells Date: Mon Apr 2 23:46:28 2007 +0100 [PATCH] SLAB: Mention slab name when listing corrupt objects Mention the slab name when listing corrupt objects. Although the function that released the memory is mentioned, that is frequently ambiguous as such functions often release several pieces of memory. Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 36e337d0244ddcf4317f7d7c1144b9adfc8e5e3a Author: Robert Hancock Date: Mon Apr 2 22:05:29 2007 -0600 [PATCH] libata: add NCQ blacklist entries from Silicon Image Windows driver (v2) This adds some NCQ blacklist entries taken from the Silicon Image 3124/3132 Windows driver .inf files. There are some confirming reports of problems with these drives under Linux (for example http://lkml.org/lkml/2007/3/4/178) so let's disable NCQ on these drives. [ I'm personally starting to wonder whether we shouldn't disable NCQ by default, and perhaps have a white-list. There seems to be a *lot* of drives that do this wrong.. - Linus ] Signed-off-by: Robert Hancock Acked-by: Tejun Heo Signed-off-by: Linus Torvalds commit 8c3ce5bece2e6e233c1d05b460883046d020fbf9 Author: Cornelia Huck Date: Wed Apr 4 14:37:11 2007 +0200 [S390] cio: Fix handling of interrupt for csch(). Wipe internal irb if the clear function bit is set before accumulating bits from the irb in order to follow hardware behaviour. Signed-off-by: Cornelia Huck Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 6e1beb3c22496f6e1f1feba8ae74da16f131684c Author: Martin Schwidefsky Date: Wed Apr 4 14:37:10 2007 +0200 [S390] page_mkclean data corruption. The git commit c2fda5fed81eea077363b285b66eafce20dfd45a which added the page_test_and_clear_dirty call to page_mkclean and the git commit 7658cc289288b8ae7dd2c2224549a048431222b3 which fixes the "nasty and subtle race in shared mmap'ed page writeback" problem in clear_page_dirty_for_io cause data corruption on s390. The effect of the two changes is that for every call to clear_page_dirty_for_io a page_test_and_clear_dirty is done. If the per page dirty bit is set set_page_dirty is called. Strangly clear_page_dirty_for_io is called for not-uptodate pages, e.g. over this call-chain: [<000000000007c0f2>] clear_page_dirty_for_io+0x12a/0x130 [<000000000007c494>] generic_writepages+0x258/0x3e0 [<000000000007c692>] do_writepages+0x76/0x7c [<00000000000c7a26>] __writeback_single_inode+0xba/0x3e4 [<00000000000c831a>] sync_sb_inodes+0x23e/0x398 [<00000000000c8802>] writeback_inodes+0x12e/0x140 [<000000000007b9ee>] wb_kupdate+0xd2/0x178 [<000000000007cca2>] pdflush+0x162/0x23c The bad news now is that page_test_and_clear_dirty might claim that a not-uptodate page is dirty since SetPageUptodate which resets the per page dirty bit has not yet been called. The page writeback that follows clobbers the data on disk. The simplest solution to this problem is to move the call to page_test_and_clear_dirty under the "if (page_mapped(page))". If a file backed page is mapped it is uptodate. Signed-off-by: Martin Schwidefsky commit 6f23a31d1cbe791a1ce86ffa9b23251ab0a1ef45 Author: Albert Lee Date: Mon Apr 2 11:39:25 2007 +0800 libata: Limit ATAPI DMA to R/W commands only for TORiSAN DVD drives (take 3) patch 4/4: Limit ATAPI DMA to R/W commands only for TORiSAN DRD-N216 DVD-ROM drives (http://bugzilla.kernel.org/show_bug.cgi?id=6710) Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik commit 18d6e9d51891f91af4e7351cbab3cb180bb9f430 Author: Albert Lee Date: Mon Apr 2 11:34:15 2007 +0800 libata: Limit max sector to 128 for TORiSAN DVD drives (take 3) patch 3/4: The TORiSAN drive locks up when max sector == 256. Limit max sector to 128 for the TORiSAN DRD-N216 drives. (http://bugzilla.kernel.org/show_bug.cgi?id=6710) Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik commit 56287768e31268969abd94b38b931a29d1ced1ce Author: Albert Lee Date: Mon Apr 2 11:30:46 2007 +0800 libata: Clear tf before doing request sense (take 3) patch 2/4: Clear tf before doing request sense. This fixes the AOpen 56X/AKH timeout problem. (http://bugzilla.kernel.org/show_bug.cgi?id=8244) Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik commit 7152764700559b6a4041fdaba345df9a5cd962f0 Author: Albert Lee Date: Mon Apr 2 11:28:52 2007 +0800 libata: reorder HSM_ST_FIRST for easier decoding (take 3) patch 1/4: Reorder HSM_ST_FIRST, such that the task state transition is easier decoded with human eyes. Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik commit 277239f228654fc03affdf2aa0e7a3969f420415 Author: Mark Lord Date: Fri Mar 30 17:45:52 2007 -0400 libata bugfix: preserve LBA bit for HDIO_DRIVE_TASK Preserve the LBA bit in the DevSel/Head register for HDIO_DRIVE_TASK. Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik commit 4742d54fa4b391342dfb8f34de14d51da101fb39 Author: Mark Lord Date: Mon Apr 2 16:20:35 2007 -0400 2.6.21 fix lba48 bug in libata fill_result_tf() Current 2.6.21 libata does the following: void ata_tf_read(struct ata_port *ap, struct ata_taskfile *tf) { struct ata_ioports *ioaddr = &ap->ioaddr; tf->command = ata_check_status(ap); ... if (tf->flags & ATA_TFLAG_LBA48) { iowrite8(tf->ctl | ATA_HOB, ioaddr->ctl_addr); tf->hob_feature = ioread8(ioaddr->error_addr); ... } } ... static void fill_result_tf(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; ap->ops->tf_read(ap, &qc->result_tf); qc->result_tf.flags = qc->tf.flags; } Based on this, those last two statements fill_result_tf() appear to me to be in the wrong order, in that the tf->flags are uninitialized at the point where tf_read() is invoked. So for lba48 commands, tf_read() won't be reading back the full lba48 register contents.. Correct? This patch corrects fill_result_tf() so that the flags get copied to result_tf before they are used by tf_read(). Signed-off-by: Mark Lord Signed-off-by: Jeff Garzik commit 1371fa6db0bbb8e23f988a641f5ae7361bc629dd Author: Francois Romieu Date: Mon Apr 2 23:01:11 2007 +0200 r8169: fix suspend/resume for down interface The PM hooks are no-op if the r8169 interface is down (i.e. !IFF_UP). However, as the chipset is enabled, the device will not work after a suspend/resume cycle. The patch always issue the required PCI suspend sequence and removes the module unload/reload workaround. Signed-off-by: Arnaud Patard Signed-off-by: Francois Romieu Signed-off-by: Jeff Garzik commit 99f252b097a3bd6280047ba2175b605671da4a23 Author: Francois Romieu Date: Mon Apr 2 22:59:59 2007 +0200 r8169: issue request_irq after the private data are completely initialized The irq handler schedules a NAPI poll request unconditionally as soon as the status register is not clean. It has been there - and wrong - for ages but a recent timing change made it apparently easier to trigger. Signed-off-by: Francois Romieu Cc: Jay Cliburn Signed-off-by: Jeff Garzik commit cda22aa94d3fe3942476b3652b8b92c653b96ee3 Author: Bill Helfinstine Date: Sun Apr 1 13:10:28 2007 -0400 b44: fix IFF_ALLMULTI handling of CAM slots If you set the IFF_ALLMULTI flag on a b44 device, or if you join more than B44_MCAST_TABLE_SIZE multicast groups, the device will stop receiving unicast messages. This is because the __b44_set_mac_addr call sets the zeroth CAM entry to the MAC address of the device, and then the loop at line 1722 proceeds to overwrite it unless the value of i is set by the __b44_load_mcast call. However, when IFF_ALLMULTI is set, that call is bypassed, leaving i set to zero. Fixed by starting the loop at 1 to make it skip the CAM entry for the MAC address. Signed-off-by: Bill Helfinstine Signed-off-by: Jeff Garzik commit 7f672cf5b2382310d530469f1f78f69bf48adedc Author: Divy Le Ray Date: Sat Mar 31 00:23:30 2007 -0700 cxgb3 - Firwmare update Introduce FW micro version. Bump up FW version to 3.3.0 Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 6d6dabac382604db22ff51c5e0d25af18529ac8b Author: Divy Le Ray Date: Sat Mar 31 00:23:24 2007 -0700 cxgb3 - Tighten xgmac workaround Run the watchdog task when the link is up. Flush the XGMAC Tx FIFO when the link drops. Also remove a statistics update that should have gone in the previous modification of xgmac.c. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 8ac3ba68e25a73594646ec30b7c482b364644c92 Author: Divy Le Ray Date: Sat Mar 31 00:23:19 2007 -0700 cxgb3 - detect NIC only adapters Differentiate NIC only adapters from RNICs. Initialize offload capabilities for RNICs only. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 9f238486f5438b2e44f760b11fa3a08714c1ddb6 Author: Divy Le Ray Date: Sat Mar 31 00:23:13 2007 -0700 cxgb3 - Safeguard TCAM size usage Ensure that the TCAM active region size is at least 16. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 348e3fd19487534d9d4dd70c3ad0b751afd35792 Author: Eric W. Biederman Date: Tue Apr 3 01:41:49 2007 -0600 [PATCH] msi: synchronously mask and unmask msi-x irqs. This is a simplified and actually more comprehensive form of a bug fix from Mitch Williams . When we mask or unmask a msi-x irqs the writes may be posted because we are writing to memory mapped region. This means the mask and unmask don't happen immediately but at some unspecified time in the future. Which is out of sync with how the mask/unmask logic work for ioapic irqs. The practical result is that we get very subtle and hard to track down irq migration bugs. This patch performs a read flush after writes to the MSI-X table for mask and unmask operations. Since the SMP affinity is set while the interrupt is masked, and since it's unmasked immediately after, no additional flushes are required in the various affinity setting routines. The testing by Mitch Williams on his especially problematic system should still be valid as I have only simplified the code, not changed the functionality. We currently have 7 drivers: cciss, mthca, cxgb3, forceth, s2io, pcie/portdrv_core, and qla2xxx in 2.6.21 that are affected by this problem when the hardware they driver is plugged into the right slot. Given the difficulty of reproducing this bug and tracing it down to anything that even remotely resembles a cause, even if people are being affected we aren't likely to see many meaningful bug reports, and the people who see this bug aren't likely to be able to reproduce this bug in a timely fashion. So it is best to get this problem fixed as soon as we can so people don't have problems. Then if people do have a kernel message stating "No irq for vector" we will know it is yet another novel cause that needs a complete new investigation. Cc: Greg KH Cc: Andrew Morton Signed-off-by: "Eric W. Biederman" Acked-by: Mitch Williams Acked-by: "Siddha, Suresh B" Signed-off-by: Linus Torvalds commit 8cc574a3c5cea70229f243a6b57fd69e60491d82 Author: David S. Miller Date: Mon Apr 2 14:21:55 2007 -0700 [SCSI]: Fix scsi_send_eh_cmnd scatterlist handling This fixes a regression caused by commit: 2dc611de5a3fd955cd0298c50691d4c05046db97 The sense buffer code in scsi_send_eh_cmnd was changed to use alloc_page() and a scatter list, but the sense data copy was not updated to match so what we actually get in the sense buffer is total grabage starting with the kernel address of the struct page we got. Basically the stack frame of scsi_send_eh_cmd() is what ends up in the sense buffer. Depending upon how pointers look on a given platform, you can end up getting sr_ioctl.c errors when you mount a cdrom. If the CDROM gives a check condition for GPCMD_GET_CONFIGURATION issued by drivers/cdrom/cdrom.c:cdrom_mmc_profile(), sr_ioctl will spit out this error message in sr_do_ioctl() with the way pointers are on sparc64: default: printk(KERN_ERR "%s: CDROM (ioctl) error, command: ", cd->cdi.name); __scsi_print_command(cgc->cmd); scsi_print_sense_hdr("sr", &sshdr); err = -EIO; This is the error Tom Callaway reported in: http://marc.info/?l=linux-sparc&m=117407453208101&w=2 Anyways, fix this by using page_address(sgl.page) which is OK because we know this is low-mem due to GFP_ATOMIC. Signed-off-by: David S. Miller Acked-by: Christoph Hellwig commit d80f0a4beb15d817bfbb18a29e5ffc1d9dc353ea Author: Robert Reif Date: Wed Mar 28 14:21:08 2007 -0700 [SPARC]: Add unsigned to unused bit field in a.out.h Add unsigned to unused bit field in a.out.h to make sparse happy. [ I took care of the sparc64 side as well -DaveM ] Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit 84565070e442583ec67fb08a5962c80203e491c3 Author: John Heffner Date: Mon Apr 2 13:56:32 2007 -0700 [TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS. Signed-off-by: John Heffner Signed-off-by: David S. Miller commit c873879c4db31bab414655e191cf56019b48c751 Author: Michael Chan Date: Fri Mar 30 14:53:06 2007 -0700 [BNX2]: Fix nvram write logic. The nvram dword alignment logic was broken when writing less than 4 bytes on a non-aligned offset. It was missing logic to round the length to 4 bytes. The page erase code is also moved so that it is only called when using non-buffered flash for better code clarity. Update version to 1.5.7. Based on initial patch from Tony Cureington . Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b59e139bbd5c789700aa9cefe7eb6590bc516b86 Author: YOSHIFUJI Hideaki Date: Fri Mar 30 14:45:35 2007 -0700 [IPv6]: Fix incorrect length check in rawv6_sendmsg() In article <20070329.142644.70222545.davem@davemloft.net> (at Thu, 29 Mar 2007 14:26:44 -0700 (PDT)), David Miller says: > From: Sridhar Samudrala > Date: Thu, 29 Mar 2007 14:17:28 -0700 > > > The check for length in rawv6_sendmsg() is incorrect. > > As len is an unsigned int, (len < 0) will never be TRUE. > > I think checking for IPV6_MAXPLEN(65535) is better. > > > > Is it possible to send ipv6 jumbo packets using raw > > sockets? If so, we can remove this check. > > I don't see why such a limitation against jumbo would exist, > does anyone else? > > Thanks for catching this Sridhar. A good compiler should simply > fail to compile "if (x < 0)" when 'x' is an unsigned type, don't > you think :-) Dave, we use "int" for returning value, so we should fix this anyway, IMHO; we should not allow len > INT_MAX. Signed-off-by: YOSHIFUJI Hideaki Acked-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 31ba548f9683c5c5809567549b404404b6017088 Author: Patrick McHardy Date: Fri Mar 30 13:36:23 2007 -0700 [NET_SCHED]: cls_basic: fix memory leak in basic_destroy tp->root is not freed on destruction. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 83886b6b636173b206f475929e58fac75c6f2446 Author: Steven Whitehouse Date: Fri Mar 30 13:34:27 2007 -0700 [NET]: Change "not found" return value for rule lookup This changes the "not found" error return for the lookup function to -ESRCH so that it can be distinguished from the case where a rule or route resulting in -ENETUNREACH has been found during the search. It fixes a bug where if DECnet was compiled with routing support, but no routes were added to the routing table, it was failing to fall back to endnode routing. Signed-off-by: Steven Whitehouse Signed-off-by: Patrick Caulfield Signed-off-by: David S. Miller commit b6a8b316c667f914c198a2de62e6729f359b7931 Author: Thomas Gleixner Date: Mon Apr 2 14:25:31 2007 +0200 [PATCH] i386: fix file_read_actor() and pipe_read() for original i386 systems The __copy_to_user_inatomic() calls in file_read_actor() and pipe_read() are broken on original i386 machines, where WP-works-ok == false, as __copy_to_user_inatomic() on such systems calls functions which might sleep and/or contain cond_resched() calls inside of a kmap_atomic() region. The original check for WP-works-ok was in access_ok(), but got moved during the 2.5 series to fix a race vs. swap. Return the number of bytes to copy in the case where we are in an atomic region, so the non atomic code pathes in file_read_actor() and pipe_read() are taken. This could be optimized to avoid the kmap_atomicby moving the check for WP-works-ok into fault_in_pages_writeable(), but this is more intrusive and can be done later. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit f991519c197534811046e5e47389b6fafcdf1e48 Author: Michal Januszewski Date: Sun Apr 1 23:49:51 2007 -0700 [PATCH] vt: fix potential race in VT_WAITACTIVE handler On a multiprocessor machine the VT_WAITACTIVE ioctl call may return 0 if fg_console has already been updated in redraw_screen() but the console switch itself hasn't been completed. Fix this by checking fg_console in vt_waitactive() with the console sem held. Signed-off-by: Michal Januszewski Acked-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1d64b9cb1dc2a7cd521444e3d908adeccd026356 Author: Rafael J. Wysocki Date: Sun Apr 1 23:49:49 2007 -0700 [PATCH] Fix microcode-related suspend problem Fix the regression resulting from the recent change of suspend code ordering that causes systems based on Intel x86 CPUs using the microcode driver to hang during the resume. The problem occurs since the microcode driver uses request_firmware() in its CPU hotplug notifier, which is called after tasks has been frozen and hangs. It can be fixed by telling the microcode driver to use the microcode stored in memory during the resume instead of trying to load it from disk. Signed-off-by: Rafael J. Wysocki Adrian Bunk Cc: Tigran Aivazian Cc: Pavel Machek Cc: Maxim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0c84ce268b69855919b6ac7edc8f11caf21e9c88 Author: Kay Sievers Date: Sun Apr 1 23:49:48 2007 -0700 [PATCH] driver core: fix built-in drivers sysfs links built-in drivers had broken sysfs links that caused bootup hangs for certain driver unregistry sequences. Signed-off-by: Ingo Molnar Acked-by: Kay Sievers Signed-off-by: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bcd9b89c02295b075fda4bdb666f6641f8212226 Author: David Brownell Date: Sun Apr 1 23:49:47 2007 -0700 [PATCH] rtc-cmos lockdep fix, irq updates Lockdep reported cmos_suspend() and cmos_resume() calling rtc_update_irq() with IRQs enabled; not allowed. Also fix problems seen on some hardware, whereby false alarm IRQs could be reported (primarily to userspace); and update two comments to match changes in ACPI. Those make up most of this patch, by volume. Signed-off-by: David Brownell Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a2b091dbfb355d0cd35756c6ace0988c9855f3f7 Author: Petr Vandrovec Date: Sun Apr 1 23:49:46 2007 -0700 [PATCH] Correctly report PnP 64bit resources Change PnP resource handling code to use proper type for resource start and length. Fixes bogus regions reported in /proc/iomem. I've also made some pointer constant, as they are constant... Signed-off-by: Petr Vandrovec Cc: Bjorn Helgaas Cc: Adam Belay Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7479d2b90b103f84d956a7177b3f99cbd472b345 Author: Andrew Morton Date: Sun Apr 1 23:49:44 2007 -0700 [PATCH] revert "retries in ext4_prepare_write() violate ordering requirements" Revert b46be05004abb419e303e66e143eed9f8a6e9f3f. Same reasoning as for ext3. Cc: Kirill Korotaev Cc: Ingo Molnar Cc: Ken Chen Cc: Andrey Savochkin Cc: Cc: Dmitriy Monakhov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1aa9b4b9bc10a0cf6e6109c2997d759a76e840e5 Author: Andrew Morton Date: Sun Apr 1 23:49:43 2007 -0700 [PATCH] revert "retries in ext3_prepare_write() violate ordering requirements" Revert e92a4d595b464c4aae64be39ca61a9ffe9c8b278. Dmitry points out "When we block_prepare_write() failed while ext3_prepare_write() we jump to "failure" label and call ext3_prepare_failure() witch search last mapped bh and invoke commit_write untill it. This is wrong!! because some bh from begining to the last mapped bh may be not uptodate. As a result we commit to disk not uptodate page content witch contains garbage from previous usage." and "Unexpected file size increasing." Call trace the same as it was in first issue but result is different. For example we have file with i_size is zero. we want write two blocks , but fs has only one free block. ->ext3_prepare_write(...from == 0, to == 2048) retry: ->block_prepare_write() == -ENOSPC# we failed but allocated one block here. ->ext3_prepare_failure() ->commit_write( from == 0, to == 1024) # after this i_size becomes 1024 :) if (ret == -ENOSPC && ext3_should_retry_alloc(inode->i_sb, &retries)) goto retry; Finally when all retries will be spended ext3_prepare_failure return -ENOSPC, but i_size was increased and later block trimm procedures can't help here. We don't appear to have the horsepower to fix these issues, so let's put things back the way they were for now. Cc: Kirill Korotaev Cc: Ingo Molnar Cc: Ken Chen Cc: Andrey Savochkin Cc: Cc: Dmitriy Monakhov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 03221702608c60b470fc86a23bdf4bc30e5bd59f Author: Brian Pomerantz Date: Sun Apr 1 23:49:41 2007 -0700 [PATCH] fix page leak during core dump When the dump cannot occur most likely because of a full file system and the page to be written is the zero page, the call to page_cache_release() is missed. Signed-off-by: Brian Pomerantz Cc: Hugh Dickins Cc: Nick Piggin Cc: David Howells Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2400ff77e7025bf6ffb71afdcbfbdd9aa47dfc36 Author: Simon Horman Date: Sun Apr 1 23:49:40 2007 -0700 [PATCH] CPUSETS: add mems to basic usage documentation It seems that there must be at least one node in mems and at least one CPU in cpus in order to be able to assign tasks to a cpuset. This makes sense. And I think it would also make sense to include a mems setting in the basic usage section of the documentation. I also wonder if something logged to dmsg, explaining why a write failed, would be a good enhancement. I ended up having rummage arround in cpuset.c in order to work out why my configuration was failing. Signed-off-by: Simon Horman Acked-by: Paul Jackson Cc: Paul Menage Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bf703c3f199342da440a30798b6120f391741ffe Author: Adrian Bunk Date: Sun Apr 1 23:49:38 2007 -0700 [PATCH] drivers/mfd/sm501.c: fix an off-by-one Fix an off-by-one spotted by the Coverity checker. Signed-off-by: Adrian Bunk Cc: Ben Dooks Cc: Vincent Sanders Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 10fa1155a2c3282f421a74fedfad1957e8bdc86c Author: Paolo 'Blaisorblade' Giarrusso Date: Sun Apr 1 23:49:37 2007 -0700 [PATCH] uml: fix unreasonably long udelay Currently we have a confused udelay implementation. * __const_udelay does not accept usecs but xloops in i386 and x86_64 * our implementation requires usecs as arg * it gets a xloops count when called by asm/arch/delay.h Bugs related to this (extremely long shutdown times) where reported by some x86_64 users, especially using Device Mapper. To hit this bug, a compile-time constant time parameter must be passed - that's why UML seems to work most times. Fix this with a simple udelay implementation. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 05565b65a5309e3e5c86db1975b57f75661bee8f Author: Andrew Morton Date: Sun Apr 1 23:49:35 2007 -0700 [PATCH] proc: fix linkage with CONFIG_SYSCTL=y, CONFIG_PROC_SYSCTL=n We're using #ifdef CONFIG_SYSCTL, but we should be using CONFIG_PROC_SYSCTL, so we get fs/built-in.o: In function `proc_root_init': /usr/src/linux/fs/proc/root.c:83: undefined reference to `proc_sys_init' Fix that up and remove an ifdef-in-C. Cc: "Eric W. Biederman" Cc: Helge Hafting Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1489f90a49f0603a393e1800d729050f6e332bec Author: Andreas Oberritter Date: Mon Apr 2 10:44:35 2007 -0300 V4L/DVB (5496): Pluto2: fix incorrect TSCR register setting The ADEF bits in the TSCR register have different meanings in read and write mode. For this reason ADEF has to be reset on every read-modify-write operation. This patch introduces a special write function for this register, which takes care of it. Thanks to Holger Magnussen for pointing my nose at this problem. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab commit d420cb44693b8370cbf06c3e31b4b5dec66c9f86 Author: Andreas Oberritter Date: Sun Apr 1 19:29:16 2007 -0300 V4L/DVB (5495): Tda10086: fix DiSEqC message length Setting the message length to zero means to send one byte, so you need a subtraction instead of an addition. Signed-off-by: Andreas Oberritter Signed-off-by: Mauro Carvalho Chehab commit a369a7100da3b4f5c2269be25160653d2c7013fc Author: Zwane Mwaikambo Date: Mon Apr 2 12:14:12 2007 +0200 [PATCH] x86: Don't probe for DDC on VBE1.2 VBE1.2 doesn't support function 15h (DDC) resulting in a 'hang' whilst uncompressing kernel with some video cards. Make sure we check VBE version before fiddling around with DDC. http://bugzilla.kernel.org/show_bug.cgi?id=1458 Opened: 2003-10-30 09:12 Last update: 2007-02-13 22:03 Much thanks to Tobias Hain for help in testing and investigating the bug. Tested on; i386, Chips & Technologies 65548 VESA VBE 1.2 CONFIG_VIDEO_SELECT=Y CONFIG_FIRMWARE_EDID=Y Untested on x86_64. Signed-off-by: Zwane Mwaikambo Signed-off-by: Andi Kleen commit 0fb2ebfcb5f0b1916ed5ff260ec953ef616fec7c Author: Andi Kleen Date: Mon Apr 2 12:14:12 2007 +0200 [PATCH] x86-64: Increase NMI watchdog probing timeout A 4 core Opteron needs longer than 10 ticks for this. Signed-off-by: Andi Kleen commit 89e07569e4e4e935b2cec18e9d94f131aecb2e40 Author: Andi Kleen Date: Mon Apr 2 12:14:12 2007 +0200 [PATCH] x86-64: Let oprofile reserve MSR on all CPUs The MSR reservation is per CPU and oprofile would only allocate them on the CPU it was initialized on. Change this to handle all CPUs. This also fixes a warning about unprotected use of smp_processor_id() in preemptible kernels. Signed-off-by: Andi Kleen commit 3556ddfa9284a86a59a9b78fe5894430f6ab4eef Author: Andi Kleen Date: Mon Apr 2 12:14:12 2007 +0200 [PATCH] x86-64: Disable local APIC timer use on AMD systems with C1E AMD dual core laptops with C1E do not run the APIC timer correctly when they go idle. Previously the code assumed this only happened on C2 or deeper. But not all of these systems report support C2. Use a AMD supplied snippet to detect C1E being enabled and then disable local apic timer use. This supercedes an earlier workaround using DMI detection of specific systems. Thanks to Mark Langsdorf for the detection snippet. Signed-off-by: Andi Kleen commit 398e692fd5cecdd25d311b47bbae69f7bac3a3cb Author: Lennert Buytenhek Date: Sat Mar 31 12:03:20 2007 +0100 [ARM] 4298/1: fix memory barriers for DMA coherent and SMP platforms This patch: - Switches mb/rmb/wmb back to being full-blown DMBs on ARM SMP systems, since mb/rmb/wmb are required to order Normal memory accesses as well. - Enables the use of DMB and ISB on XSC3 (which is an ARMv5TE ISA core but conforms to the ARMv6 memory ordering model and supports the various ARMv6 barriers.) - Makes DMA coherent platforms (only ixp23xx at the moment) map mb/rmb/wmb to dmb(), as on DMA coherent platforms, DMA consistent mappings are done as Normal mappings, which are weakly ordered. Signed-off-by: Lennert Buytenhek Acked-by: David Howells Acked-by: Catalin Marinas Acked-by: Paul E. McKenney Acked-by: Dan Williams Signed-off-by: Russell King commit 9a4d93d49d140c196020a1bae339efcf211cac03 Author: Guennadi Liakhovetski Date: Fri Mar 30 08:49:55 2007 +0100 [ARM] 4295/2: Fix error-handling in pxaficp_ir.c (version 2) This patch addresses the following issues with the pxa2xx FIr driver: 1. increment overrun error counter and not frame error counter on ICSR1_ROR bit set in ICSR1. 2. drop frames reported with the frame error from the IC. 3. when resetting the receiver and preparing it for the next DMA in pxa_irda_fir_irq() actually clear the Rx FIFO. See description in Table 11-2 in PXA270 Developer's Manual of the RXE bit. Correction added in version 2: clearing the IC Rx FIFO also has to be done in pxa_irda_fir_dma_tx_irq() Signed-off-by: G. Liakhovetski Signed-off-by: Russell King commit 6c330ba72c45007a9ef681396925c22d11029008 Author: Russell King Date: Sun Apr 1 22:35:01 2007 +0100 [ARM] Fix __NR_kexec_load It's __NR_kexec_load, not __NR_sys_kexec_load Signed-off-by: Russell King commit c21b1e4d9b0c263a35f67eed2b025d053566c557 Author: Jan Beulich Date: Thu Mar 29 10:27:14 2007 +0100 [PATCH] kbuild: fix dependency generation Commit 2e3646e51b2d6415549b310655df63e7e0d7a080 changed the way the split config tree is built, but failed to also adjust fixdep accordingly - if changing a config option from or to m, files referencing the respective CONFIG_..._MODULE (but not the corresponding CONFIG_...) didn't get rebuilt. The problem is that trisate symbol are represent with three different symbols: SYMBOL=n => no symbol defined SYMBOL=y => CONFIG_SYMBOL defined to '1' SYMBOL=m => CONFIG_SYMBOL_MODULE defined to '1' But conf_split_config do not distingush between the =y and =m case, so only the =y case is honoured. This is fixed in fixdep so when a CONFIG symbol with _MODULE is found we skip that part and only look for the CONFIG_SYMBOL version. Signed-off-by: Jan Beulich Signed-off-by: Sam Ravnborg Signed-off-by: Linus Torvalds commit f5ef2abcbeb5b0be23f7cc610a024b2406e3d8e6 Author: Linus Torvalds Date: Sun Apr 1 10:54:13 2007 -0700 driver core: do not wait unnecessarily in driver_unregister() Ingo reported that built-in drivers suffered bootup hangs with certain driver unregistry sequences, due to sysfs breakage. Do the minimal fix for v2.6.21: only wait if the driver is a module. Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit ec14d7964bc3c89fb24c95af00d39033afc32f8e Author: Russell King Date: Sat Mar 31 21:36:53 2007 +0100 [ARM] Export dma_channel_active() dma_channel_active() is used by some modules and is part of our DMA API, so export it. Signed-off-by: Russell King commit 9f1167272890c210399e6b8a32d7cf7295713f5d Author: Herbert Xu Date: Sat Mar 31 12:58:20 2007 +1000 [CRYPTO] api: Flush the current page right than the next On platforms where flush_dcache_page is needed we're currently flushing the next page right than the one we've just processed. This patch fixes the off-by-one error. Signed-off-by: Herbert Xu commit beff804d8dd360ccb4dd0096c9fd77a93fe9049e Author: Herbert Xu Date: Sat Mar 31 12:14:37 2007 +1000 [PATCH] crypto api: Use the right value when advancing scatterwalk_copychunks In the scatterwalk_copychunks loop, We should be advancing by len_this_page and not nbytes. The latter is the total length. Signed-off-by: Herbert Xu Signed-off-by: Linus Torvalds commit c35e584c087381aaa5f1ed40a28b978535c18fb2 Author: Paolo 'Blaisorblade' Giarrusso Date: Sat Mar 31 03:20:27 2007 +0200 [PATCH] uml: fix static linking for real There was a typo in commit 7632fc8f809a97f9d82ce125e8e3e579390ce2e5, preventing it from working - 32bit binaries crashed hopelessly before the below fix and work perfectly now. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Linus Torvalds commit 4ee531a3e661207d4b2174486b0f86017a3adb82 Author: Herbert Xu Date: Sat Mar 31 12:16:20 2007 +1000 [CRYPTO] api: Use the right value when advancing scatterwalk_copychunks In the scatterwalk_copychunks loop, We should be advancing by len_this_page and not nbytes. The latter is the total length. Signed-off-by: Herbert Xu commit 4e381a4f06e3c7b350b55a2636b9d45691780eba Author: Len Brown Date: Fri Mar 30 14:16:10 2007 -0400 Revert "ACPI: parse 2nd MADT by default" This reverts commit 09fe58356d148ff66901ddf639e725ca1a48a0af. http://bugzilla.kernel.org/show_bug.cgi?id=8283 Signed-off-by: Len Brown commit 964429252a88cbb4eccd9f024a00813e10d16c71 Author: Jens Axboe Date: Fri Mar 30 09:27:58 2007 +0200 [PATCH] Maxtor 6B250S0/BANC1B70 hangs with NCQ I've seen this several times on this drive, completely reproducible. Once it has hung, power needs to be cut from the drive to recover it, a simple reboot is not enough. So I'd suggest disabling NCQ on this drive. Signed-off-by: Jens Axboe Acked-by: Tejun Heo Signed-off-by: Linus Torvalds commit 6b8777b46823fb0b42fba69b5311682124e5a71c Author: Vladimir Barinov Date: Thu Mar 29 16:29:20 2007 +0100 [ARM] 4296/1: ixp4xx: compile fix Fix compilation fail for ixp4xx platforms for the case when CONFIG_IXP4XX_INDIRECT_PCI is set. That is due to the check_signature() is appeared in include/linux/io.h. Signed-off-by: Vladimir Barinov Signed-off-by: Russell King commit 8a1e97ee2e025f116765c92409a3cf8f6cb07ad6 Author: Ralf Baechle Date: Thu Mar 29 23:42:42 2007 +0100 [MIPS] SMTC: Fix recursion in instant IPI replay code. local_irq_restore -> raw_local_irq_restore -> irq_restore_epilog -> smtc_ipi_replay -> smtc_ipi_dq -> spin_unlock_irqrestore -> _spin_unlock_irqrestore -> local_irq_restore The recursion does abort when there is no more IPI queued for a CPU, so this isn't usually fatal which is why we got away with this for so long until this was discovered by code inspection. Signed-off-by: Ralf Baechle commit 6c9fde4bfff11b2fd93b4e518ae7ecb25a9244e4 Author: Mark Mason Date: Mon Mar 26 13:28:26 2007 -0700 [MIPS] BCM1480: Fix setting of irq affinity. Signed-off-by: Mark Mason Signed-off-by: Ralf Baechle commit d6f703602fee8f8bd5c108af927a420cb8cb0d36 Author: Ralf Baechle Date: Thu Mar 29 22:30:01 2007 +0100 [MIPS] do_page_fault() needs to use raw_smp_processor_id(). Original patch posted by Deepak Saxena . Signed-off-by: Ralf Baechle commit 20bb25d10fe5569df8f3f186a36e5548582854d9 Author: Ralf Baechle Date: Tue Mar 27 15:19:58 2007 +0100 [MIPS] SMTC: Fix false trigger of debug code on single VPE. Make smtc_setup_irq() update the list of interrupts which need to be watched by the debug code itself. Also there is no need to initialize the IPI swint when running with a single VPE, so don't initialize it. Signed-off-by: Ralf Baechle commit ae036b790891565c5b4b64e616ed497138d1f8d6 Author: Ralf Baechle Date: Tue Mar 27 15:11:54 2007 +0100 [MIPS] SMTC: irq_{enter,leave} and kstats keeping for relayed timer ints. Signed-off-by: Ralf Baechle commit fe99f1b184efb75c50dd8cbdfff99b559c2cb3b3 Author: Chris Dearman Date: Mon Mar 26 14:48:50 2007 +0100 [MIPS] lockdep: Deal with interrupt disable hazard in TRACE_IRQFLAGS Between the mtc0 or di instruction that disables interrupts and the following hazard barrier a processor may still take interrupts. If an interrupt is taken after interrupts are disabled but before the state is updated it will appear to restore_all that it is incorrectly returning with interrupts disabled. Signed-off-by: Chris Dearman Signed-off-by: Ralf Baechle commit cbde5ebc972c0577741a69c85d5e5afad19d813b Author: Chris Dearman Date: Mon Mar 26 14:47:06 2007 +0100 [MIPS] lockdep: Handle interrupts in R3000 style c0_status register. Check the IEP bit for R3000 style processors when checking to see if interrupts will be reenabled in restore_all. Signed-off-by: Chris Dearman Signed-off-by: Ralf Baechle commit eb541cb24078eae83b9ef0573af36347d8dc01ee Author: Ralf Baechle Date: Mon Mar 26 09:30:32 2007 +0100 [MIPS] MV64340: Add missing prototype for mv64340_irq_init(). Signed-off-by: Ralf Baechle commit 619af723ac1fe75262441453c9d35870593822e2 Author: Ralf Baechle Date: Mon Mar 26 15:13:57 2007 +0100 [MIPS] MT: MIPS_MT_SMTC_INSTANT_REPLAY currently conflicts with PREEMPT. So until MIPS_MT_SMTC_INSTANT_REPLAY has been rewritten to solve this issue, don't allow selecting it with PREEMPT. Signed-off-by: Ralf Baechle commit af2944ac5488f8d7e5f109f8a55f98d072ec377c Author: Ralf Baechle Date: Mon Mar 26 09:22:00 2007 +0100 [MIPS] EV64120: Include to fix warning. arch/mips/pci/pci-ev64120.c:10: warning: implicit declaration of function 'allocate_irqno' Signed-off-by: Ralf Baechle commit 9486d594baf268e46a01ada5c8c50dcf5d066748 Author: Ralf Baechle Date: Mon Mar 26 09:14:24 2007 +0100 [MIPS] Ocelot: Fix warning. Remove unused variable. Signed-off-by: Ralf Baechle commit 448f283c11ac66793c7231bcbd729a417a9f9a04 Author: Ralf Baechle Date: Mon Mar 26 08:59:52 2007 +0100 [MIPS] Ocelot: Give PMON_v1_setup a proper prototype. Signed-off-by: Ralf Baechle commit dbfc2f6f95c7e62b9a379d9a34f8427f1d844ee1 Author: Tony Luck Date: Thu Mar 29 15:41:37 2007 -0700 [IA64] Fix arch/ia64/pci/pci.c:571: warning: `return' with a value Typo/thinko in bba6f6fc68e74d4572028646f61dd3505a68747e Signed-off-by: Tony Luck commit ead6caae1e52a982bf09137c9b5382e9e2d52fdb Author: Jack Steiner Date: Tue Mar 27 14:30:19 2007 -0500 [IA64] Speed up boot - skip unnecessary clock calibration Skip clock calibration if cpu being brought online is exactly the same speed, stepping, etc., as the previous cpu. This significantly reduces the time to boot very large systems. Signed-off-by: Jack Steiner Signed-off-by: Tony Luck commit 83d2cd3de48a7fb73838c45145780cfa9b1f61fd Author: KAMEZAWA Hiroyuki Date: Fri Mar 23 12:17:46 2007 +0900 [IA64] bugfix stack layout upside-down ia64 expects following vm layout: == low memory [register-stack grows up] [memory-stack grows down] == high memory But the code assigns the base of the register stack at the maximum stack size offset from the fixed address where the stack *might* start. Stack randomization will result in the memory stack starting at a lower address than this, and if the user has set a low stack limit with "ulimit -s", then you can end up with the register stack above the memory stack (or if you were very unlucky right on top of it!). Fix: Calculate the base address for the register stack starting from the actual address of the memory stack. Signed-off-by: KAMEZAWA Hiroyuki Signed-off-by: Tony Luck commit 8a3a0ee736b9a0150c9d894f2c6cc836a62125a1 Author: Kenji Kaneshige Date: Mon Mar 26 09:38:42 2007 +0900 [IA64] Fix possible invalid memory access in ia64_setup_msi_irq() The following 'if' statement in ia64_setup_msi_irq() always fails even if create_irq() returns <0 value, because variable 'irq' is defined as unsigned int. It would cause invalid memory access. irq = create_irq(); if (irq < 0) return irq; Signed-off-by: Kenji Kaneshige Signed-off-by: Tony Luck commit 297640e89ea21e314bdda45468e5f78c978dae16 Author: Timur Tabi Date: Mon Mar 26 14:25:42 2007 -0500 [POWERPC] qe: ucc_slow.guemr is in the wrong place The definition of struct ucc_slow puts the guemr register immediately after the utpt register, when it should be at offset 0x90. This patch adds the missing 0x52-byte padding. Signed-off-by: Timur Tabi Signed-off-by: Kumar Gala commit 7f013bc9d05825b19433bc0deb1f5f4d2103726e Author: Chuck Meade Date: Tue Mar 27 10:46:10 2007 -0400 [POWERPC] qe: Fix QUICC Engine SDMA setup errors Correct the alignment of the internal buffer used by the QUICC Engine SDMA controller to 4Kbytes. Correct the shift direction in the logic that sets up the SDMR register for the QUICC Engine SDMA controller. Signed-off-by: Chuck Meade Signed-off-by: Kumar Gala commit c01003c20563d1e75ec9828d21743919d2b43977 Author: Patrick McHardy Date: Thu Mar 29 11:46:52 2007 -0700 [IFB]: Fix crash on input device removal The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit 399afa4fc9238fbae42116cf25a54671c0e8f56e Author: Maxim Levitsky Date: Thu Mar 29 15:46:48 2007 +0200 [PATCH] Add suspend/resume for HPET This adds support of suspend/resume on i386 for HPET, which fixes a number of timer-related failures around STR. Signed-off-by: Maxim Levitsky Acked-by: Michael S. Tsirkin Acked-by: Jeff Chua Signed-off-by: Linus Torvalds commit a76c0b976310bbb1b6eaecaaae465af194134477 Author: Carsten Otte Date: Thu Mar 29 01:20:39 2007 -0700 [PATCH] mm: fix xip issue with /dev/zero Fix the bug, that reading into xip mapping from /dev/zero fills the user page table with ZERO_PAGE() entries. Later on, xip cannot tell which pages have been ZERO_PAGE() filled by access to a sparse mapping, and which ones origin from /dev/zero. It will unmap ZERO_PAGE from all mappings when filling the sparse hole with data. xip does now use its own zeroed page for its sparse mappings. Please apply. Signed-off-by: Carsten Otte Signed-off-by: Hugh Dickins Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 90ed52ebe48181d3c5427b3bd1d24f659e7575ad Author: Hugh Dickins Date: Thu Mar 29 01:20:38 2007 -0700 [PATCH] holepunch: fix mmap_sem i_mutex deadlock sys_madvise has down_write of mmap_sem, then madvise_remove calls vmtruncate_range which takes i_mutex and i_alloc_sem: no, we can easily devise deadlocks from that ordering. madvise_remove drop mmap_sem while calling vmtruncate_range: luckily, since madvise_remove doesn't split or merge vmas, it's easy to handle this case with a NULL prev, without restructuring sys_madvise. (Though sad to retake mmap_sem when it's unlikely to be needed, and certainly down_read is sufficient for MADV_REMOVE, unlike the other madvices.) Signed-off-by: Hugh Dickins Cc: Miklos Szeredi Cc: Badari Pulavarty Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 16a100190d39592d1d56ff5a0b978b20288c3427 Author: Hugh Dickins Date: Thu Mar 29 01:20:37 2007 -0700 [PATCH] holepunch: fix disconnected pages after second truncate shmem_truncate_range has its own truncate_inode_pages_range, to free any pages racily instantiated while it was in progress: a SHMEM_PAGEIN flag is set when this might have happened. But holepunching gets no chance to clear that flag at the start of vmtruncate_range, so it's always set (unless a truncate came just before), so holepunch almost always does this second truncate_inode_pages_range. shmem holepunch has unlikely swap<->file races hereabouts whatever we do (without a fuller rework than is fit for this release): I was going to skip the second truncate in the punch_hole case, but Miklos points out that would make holepunch correctness more vulnerable to swapoff. So keep the second truncate, but follow it by an unmap_mapping_range to eliminate the disconnected pages (freed from pagecache while still mapped in userspace) that it might have left behind. Signed-off-by: Hugh Dickins Cc: Miklos Szeredi Cc: Badari Pulavarty Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ae7000630e3c05b6f7e3dfc76472f1bca6c1788 Author: Hugh Dickins Date: Thu Mar 29 01:20:36 2007 -0700 [PATCH] holepunch: fix shmem_truncate_range punch locking Miklos Szeredi observes that during truncation of shmem page directories, info->lock is released to improve latency (after lowering i_size and next_index to exclude races); but this is quite wrong for holepunching, which receives no such protection from i_size or next_index, and is left vulnerable to races with shmem_unuse, shmem_getpage and shmem_writepage. Hold info->lock throughout when holepunching? No, any user could prevent rescheduling for far too long. Instead take info->lock just when needed: in shmem_free_swp when removing the swap entries, and whenever removing a directory page from the level above. But so long as we remove before scanning, we can safely skip taking the lock at the lower levels, except at misaligned start and end of the hole. Signed-off-by: Hugh Dickins Cc: Miklos Szeredi Cc: Badari Pulavarty Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a2646d1e6c8d2239d8054a7d342eb9775a1d273a Author: Hugh Dickins Date: Thu Mar 29 01:20:35 2007 -0700 [PATCH] holepunch: fix shmem_truncate_range punching too far Miklos Szeredi observes BUG_ON(!entry) in shmem_writepage() triggered in rare circumstances, because shmem_truncate_range() erroneously removes partially truncated directory pages at the end of the range: later reclaim on pages pointing to these removed directories triggers the BUG. Indeed, and it can also cause data loss beyond the hole. Fix this as in the patch proposed by Miklos, but distinguish between "limit" (how far we need to search: ignore truncation's next_index optimization in the holepunch case - if there are races it's more consistent to act on the whole range specified) and "upper_limit" (how far we can free directory pages: generally we must be careful to keep partially punched pages, but can relax at end of file - i_size being held stable by i_mutex). Signed-off-by: Hugh Dickins Cc: Miklos Szeredi Cc: Badari Pulavarty Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96fac9dc95b91fc198bfbf4ba90263b06eff023d Author: Ralf Baechle Date: Thu Mar 29 01:20:34 2007 -0700 [PATCH] Wire up DEC serial drivers in Kconfig Signed-off-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 35dc8457822aedbc89afa9f69e7fa494b3da7b02 Author: Tilman Schmidt Date: Thu Mar 29 01:20:34 2007 -0700 [PATCH] drivers/isdn/gigaset: mark some static data as const (v2) Mark some static arrays as const that aren't and shouldn't be modified, and remove incorrect static attribute from some variables. Signed-off-by: Tilman Schmidt Signed-off-by: Hansjoerg Lipp Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75e8defbe4236a358b1396bc6d9a1231e5eca225 Author: Paolo 'Blaisorblade' Giarrusso Date: Thu Mar 29 01:20:33 2007 -0700 [PATCH] uml: hostfs variable renaming * rename name to host_root_path * rename data to req_root. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 622e696938c6a9c5357d2ec4a07ed2f27d56925a Author: Jeff Dike Date: Thu Mar 29 01:20:32 2007 -0700 [PATCH] uml: fix compilation problems Fix a few miscellaneous compilation problems - an assignment with mismatched types in ldt.c a missing include in mconsole.h which needs a definition of uml_pt_regs I missed removing an include of user_util.h in hostfs Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit af84eab208916acad91f6342bbd57bc865caf150 Author: Jason Lunz Date: Thu Mar 29 01:20:31 2007 -0700 [PATCH] uml: fix LVM crash Permit lvm to create logical volumes without crashing UML. When device-mapper's DM_DEV_CREATE_CMD ioctl is called to create a new device, dev_create()->dm_create()->alloc_dev()-> blk_queue_bounce_limit(md->queue, BLK_BOUNCE_ANY) is called. blk_queue_bounce_limit(BLK_BOUNCE_ANY) calls init_emergency_isa_pool() if blk_max_pfn < blk_max_low_pfn. This is the case on UML, but init_emergency_isa_pool() hits BUG_ON(!isa_page_pool) because there doesn't seem to be a dma zone on UML for mempool_create() to allocate from. Most architectures seem to have max_low_pfn == max_pfn, but UML doesn't because of the uml_reserved chunk it keeps for itself. From what I can see, max_pfn and max_low_pfn don't get much use after the bootmem-allocator stops being used anyway, except that they initialize the block layer's blk_max_low_pfn/blk_max_pfn. This ensures init_emergency_isa_pool() doesn't crash uml in this situation by setting max_low_pfn == max_pfn in mem_init(). Signed-off-by: Jason Lunz Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Cc: Alasdair G Kergon Cc: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3076212f8d3d9fe4d7b11c6b560c0f424edfcb4e Author: Jeff Dike Date: Thu Mar 29 01:20:30 2007 -0700 [PATCH] uml: irq locking fixes As the comment immediately preceding this points out, this list is changed in irq context, so it needs to be protected with spin_lock_irqsave in process context when it is processed. Sometimes, gcc should just compile the comments and forget the code. The IRQ side of this was better, in the sense that it blocked and unblocked interrupts, but it still should have saved and restored them. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 602ed87ecd93a857dc687afb938d2c0f45552986 Author: Miklos Szeredi Date: Thu Mar 29 01:20:29 2007 -0700 [PATCH] uml: fix pte bit collision _PAGE_PROTNONE conflicts with the lowest bit of pgoff. This causes all sorts of weirdness when nonlinear mappings are used. Took me a good half day to track this down. Signed-off-by: Miklos Szeredi Signed-off-by: Jeff Dike Acked-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d40f6d71da81deb66c4fa54b46e22977cdb8b451 Author: Jeff Dike Date: Thu Mar 29 01:20:28 2007 -0700 [PATCH] uml: fix device unplug crash Fix a NULL dereference when unplugging a device. The default value of err_msg wants to be "" in case the driver doesn't modify it. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2a9529a0c890007ade5425b75272c3def283f8b1 Author: Jeff Dike Date: Thu Mar 29 01:20:27 2007 -0700 [PATCH] uml: fix I/O hang when multiple devices are in use Commit 62f96cb01e8de7a5daee472e540f726db2801499 introduced per-devices queues and locks, which was fine as far as it went, but left in place a global which controlled access to submitting requests to the host. This should have been made per-device as well, since it causes I/O hangs when multiple block devices are in use. This patch fixes that by replacing the global with an activity flag in the device structure in order to tell whether the queue is currently being run. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb3fecc2f29056e89658e7eb371e7f9be66cda6d Author: Jiri Kosina Date: Thu Mar 29 01:20:25 2007 -0700 [PATCH] bluetooth hid quirks: mightymouse quirk I have a bugreport that scrollwheel of bluetooth version of apple mightymouse doesn't work. The USB version of mightymouse works, as there is a quirk for handling scrollwheel in hid/usbhid for it. Now that bluetooth git tree is hooked to generic hid layer, it could easily use the quirks which are already present in generic hid parser, hid-input, etc. Below is a simple patch against bluetooth git tree, which adds quirk handling to current bluetooth hidp code, and sets quirk flags for device 0x05ac/0x030c, which is the bluetooth version of the apple mightymouse. Signed-off-by: Jiri Kosina Signed-off-by: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e6d1fc3d83317678a57db1c1deb2fc0bede73aaf Author: Salyzyn, Mark Date: Thu Mar 29 01:20:24 2007 -0700 [PATCH] adaptec MAINTAINERS updates The IPS and DPT_I2O drivers are missing, so here is my 'hand coded' addition to deal with overlap to the patch below (apply both). I selected Maintained rather than supported for the ips and dpt_i2o driver due to their legacy nature. Cc: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 14e9d5730adfca26452b3a2838a80af6950556f5 Author: Eric W. Biederman Date: Wed Mar 28 23:38:16 2007 -0600 [PATCH] pid: Properly detect orphaned process groups in exit_notify In commit 0475ac0845f9295bc5f69af45f58dff2c104c8d1 when converting the orphaned process group handling to use struct pid I made a small mistake. I accidentally replaced an == with a !=. Besides just being a dumb thing to do apparently this has a bad side effect. The improper orphaned process group detection causes kwin to die after a suspend/resume cycle. I'm amazed this patch has been around as long as it has without anyone else noticing something funny going on. And the following people deserve credit for spotting and helping to reproduce this. Thanks to: Sid Boyce Thanks to: "Michael Wu" Signed-off-by: "Eric W. Biederman" Signed-off-by: Linus Torvalds commit c97beb4710bc673867207d7d729f2ace4ca1f197 Author: Yinghai Lu Date: Wed Mar 28 23:10:29 2007 -0600 [PATCH] x86_64 irq: Fix comments after changing IRQ0_VECTOR from 0x20 to 0x30 Signed-off-by: Yinghai Lu Signed-off-by: "Eric W. Biederman" Signed-off-by: Linus Torvalds commit d9993c37ef87c758d4a6e63972395b1cf8a4cb7b Author: Dmitriy Monakhov Date: Thu Mar 29 14:24:09 2007 +0200 [PATCH] splice: partial write fix Currently if partial write has happened while ->commit_write() then page wasn't marked as accessed and rebalanced. Signed-off-by: Monakhov Dmitriy Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Jens Axboe commit d8d79201eb391ae0eca05f9e51f1f94ab42b6b4e Author: Linsys Contractor Adhiraj Joshi Date: Fri Mar 23 07:21:24 2007 -0800 NetXen: Fix hardware access for ppc architecture. NetXen: Fix for hardware access on big endian machine. Signed-off-by: Adhiraj Joshi Signed-off-by: Jeff Garzik commit bd7a44488975759da10b5f25bcebec19930a5328 Author: Francois Romieu Date: Thu Mar 29 00:18:50 2007 +0200 sis190: new PHY support Reported to work on the WinFast 761GXK8MB-RS motherboard. Plain 10/100 Mbps. Signed-off-by: Paul Gibbons Signed-off-by: Francois Romieu Signed-off-by: Jeff Garzik commit 8c754a04ff11a9c1107c134ad5a858e9dc08c1de Author: Chris Snook Date: Wed Mar 28 20:51:51 2007 -0400 atl1: save mac address on remove Some atl1 boards get their MAC address written directly to the register by the BIOS during POST, rather than storing it in EEPROM that's accessible to the driver. If the MAC register on one of these boards is changed and then the module is unloaded, the permanent MAC address will be forgotten until the box is rebooted. We should save the permanent address during removal if we've been messing with it. Signed-off-by: Chris Snook Signed-off-by: Jeff Garzik commit 2848e647402719d4a8d03141361caed60f2668da Author: Andrew Victor Date: Mon Mar 26 11:02:48 2007 +0100 [ARM] 4289/1: AT91: SAM9260 NAND flash timing Fix the NAND flash timings on the AT91SAM9260. The current timings lead to the detection of a number of bad blocks. These timings are now set the same as on the AT91SAM9263. Patch from Nicolas Ferre. Signed-off-by: Andrew Victor Signed-off-by: Russell King commit db8b22550d4b83f0910d27a34d05aa16f7f7159f Author: Michael Chan Date: Wed Mar 28 14:17:36 2007 -0700 [BNX2]: Fix link interrupt problem. bnx2_has_work()'s logic is flawed and can cause the driver to miss a link event. The fix is to compare the status block's attn_bits and attn_bits_ack to determine if there is a link event. Update version to 1.5.6. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 190a4408ecb577391ea5fbd1f90148a6992a5756 Author: Jean-Christophe Dubois Date: Wed Mar 28 11:07:41 2007 +0100 [POWERPC] Fix dcr_unmap() Fix a bug in dcr_unmap(). At unmap time the DCR offset need to be added instead of substracted. Signed-off-by: Jean-Christophe Dubois Acked-by: Benjamin Herrenschmidt Signed-off-by: Paul Mackerras commit bba6f6fc68e74d4572028646f61dd3505a68747e Author: Eric W. Biederman Date: Wed Mar 28 15:36:09 2007 +0200 [PATCH] MSI-X: fix resume crash So I think the right solution is to simply make pci_enable_device just flip enable bits and move the rest of the work someplace else. However a thorough cleanup is a little extreme for this point in the release cycle, so I think a quick hack that makes the code not stomp the irq when msi irq's are enabled should be the first fix. Then we can later make the code not change the irqs at all. Signed-off-by: Eric W. Biederman Signed-off-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 4dfc896e90359df04c80da5ab08ec31e87846c43 Author: Jiri Kosina Date: Wed Mar 28 18:12:34 2007 +0200 [PATCH] oprofile: fix potential deadlock on oprofilefs_lock nmi_cpu_setup() is called from hardirq context and acquires oprofilefs_lock. alloc_event_buffer() and oprofilefs_ulong_from_user() acquire this lock without disabling irqs, which could deadlock. Signed-off-by: Jiri Kosina Signed-off-by: Linus Torvalds commit 935c631db827cc3a96df4dcc6fec374b994fdbd1 Author: Ingo Molnar Date: Wed Mar 28 13:17:18 2007 +0200 [PATCH] hrtimers: fix reprogramming SMP race hrtimer_start() incorrectly set the 'reprogram' flag to enqueue_hrtimer(), which should only be 1 if the hrtimer is queued to the current CPU. Doing otherwise could result in a reprogramming of the current CPU's clockevents device, with a timer that is not queued to it - resulting in a bogus next expiry value. Signed-off-by: Ingo Molnar Cc: Michal Piotrowski Acked-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a71775147f6ae2a2901e7b917c0a76df353f8801 Author: Robert Reif Date: Wed Mar 28 12:50:56 2007 -0700 [VIDEO]: Fix section mismatch in cg3.c Fix section mismatch warning by moving data into __devinitdata section. Add __devinit to initialization functions. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit 39ebc0276bada8bb70e067cb6d0eb71839c0fb08 Author: Arnaldo Carvalho de Melo Date: Wed Mar 28 11:54:32 2007 -0700 [DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV We were only checking if there was enough space to put the int, but left len as specified by the (malicious) user, sigh, fix it by setting len to sizeof(val) and transfering just one int worth of data, the one asked for. Also check for negative len values. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: David S. Miller commit b863f46e6a523276b77dd128ec268f8c509b4554 Author: Kristoffer Ericson Date: Wed Mar 28 19:45:59 2007 +0900 sh: Trivial fix for hp6xx build. The IRQ3 define was removed when asm-sh/irq.h was cleaned up, this updates the hp6xx header to use the IRQ number directly. Signed-off-by: Kristoffer Ericson Signed-off-by: Paul Mundt commit 310f7963c24ab8fa56a539fa060dd84560ce26e9 Author: Paul Mundt Date: Wed Mar 28 17:26:19 2007 +0900 sh: Fixup __cmpxchg() compile breakage with gcc4. As reported by Manuel: When I build linux with GCC-4.x and enable CONFIG_CC_OPTIMIZE_FOR_SIZE linking fails with this error: LD .tmp_vmlinux1 kernel/built-in.o: In function '__cmpxchg_called_with_bad_pointer' make[1]: *** [.tmp_vmlinux1] Error 1 make: *** [_all] Error 2 This ended up being an inlining problem, fixed by explicitly including linux/compiler.h and grabbing the definitions from there. Signed-off-by: Paul Mundt commit 9c5b406b9a857a67caf778f096bfc7f4e6b0401a Author: Paul Mundt Date: Wed Mar 28 17:24:47 2007 +0900 sh: Kill bogus GCC4 symbol exports. __sdivsi3_i4i, __udiv_qrnnd_16, and __udivsi3_i4i don't exist outside of the ST compiler, so kill them off. This causes compile failures with other GCC4 compilers. Signed-off-by: Paul Mundt commit c14bac628b9fad6fd4dad8fbb9e864c61a8924c9 Author: Cyrill V. Gorcunov Date: Mon Mar 26 21:47:26 2007 -0800 SUN3/3X Lance trivial fix improved This patch adds checking for allocated DVMA memory and granted IRQ line. Signed-off-by: Cyrill V. Gorcunov Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit fadac4060c0456ce0a190ee581746ae8663f84e1 Author: Gabriel Paubert Date: Fri Mar 23 12:03:52 2007 -0700 mv643xx_eth: Fix use of uninitialized port_num field In this driver, the default ethernet address is first set by by calling eth_port_uc_addr_get() which reads the relevant registers of the corresponding port as initially set by firmware. However that function used the port_num field accessed through the private area of net_dev before it was set. The result was that one board I have ended up with the unicast address set to 00:00:00:00:00:00 (only port 1 is connected on this board). The problem appeared after commit 84dd619e4dc3b0b1c40dafd98c90fd950bce7bc5. This patch fixes the bug by setting mp->port_num prior to calling eth_port_uc_get_addr(). Signed-off-by: Gabriel Paubert Signed-off-by: Dale Farnsworth Signed-off-by: Jeff Garzik commit 3ba4d093fe8a26f5f2da94411bf8732fa6e9da86 Author: Ayaz Abdulla Date: Fri Mar 23 05:50:02 2007 -0500 forcedeth: fix tx timeout The tx timeout routine was waking the tx queue conditionally. However, it must call it unconditionally since the dev_watchdog has halted the tx queue before calling the timeout function. Signed-Off-By: Ayaz Abdulla Signed-off-by: Jeff Garzik commit fcc5f2665c81e087fb95143325ed769a41128d50 Author: Ayaz Abdulla Date: Fri Mar 23 05:49:37 2007 -0500 forcedeth: fix nic poll The nic poll routine was missing the call to the optimized irq routine. This patch adds the missing call for the optimized path. See http://bugzilla.kernel.org/show_bug.cgi?id=7950 for more information. Signed-Off-By: Ayaz Abdulla Signed-off-by: Jeff Garzik commit b3b1514c90ab534ec6c9e4452953069f85aacf4d Author: Ron Mercer Date: Mon Mar 26 13:43:00 2007 -0700 qla3xxx: bugfix: Jumbo frame handling. Fixed rx checksum bits. Turn on TCP processing for rx checksum. Fixed max frame length register write. It wasn't getting set in multi-port system. Set rx buffer queue length properly for jumbo frames. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit f67cac0190623a3cde4d783c7c7205691aa02cc2 Author: Ron Mercer Date: Mon Mar 26 13:42:59 2007 -0700 qla3xxx: bugfix: Dropping interrupt under heavy network load. Update the rx queue pointer when exiting NAPI poll rather than at the end of each iteration. Remove unnecessary PCI flushes that occurred after every write. Now write all regs and flush once. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit b6967eb9cbf38643fc1b5432c36f610a9c565579 Author: Ron Mercer Date: Mon Mar 26 13:42:58 2007 -0700 qla3xxx: bugfix: Multi segment sends were getting whacked. The proper header length was not being used. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit d8a759ff414141c8a0f6683e9f35b895b5f23b57 Author: Ron Mercer Date: Mon Mar 26 13:42:57 2007 -0700 qla3xxx: bugfix: Add tx control block memset. This was removed in a previous patch to increase performance, but caused a transmit error for the 4032 chip. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit de815a14e9d03df0560e6ef689d1da32553878b7 Author: Jay Cliburn Date: Tue Mar 27 19:43:49 2007 -0500 atl1: remove unnecessary crc inversion The original vendor driver contained a private ether_crc_le() function that produced an inverted crc. When we changed to the kernel version of ether_crc_le(), we neglected to undo the inversion. Let's do it now. Discovered by and patch proffered by Jose Alberto Reguero. Signed-off-by: Jose Alberto Reguero Signed-off-by: Jay Cliburn Signed-off-by: Jeff Garzik commit 917690cd035b422b1ac933ac160d26016aa454ac Author: Brice Goglin Date: Tue Mar 27 21:54:53 2007 +0200 myri10ge: correctly detect when TSO should be used Correctly detect when TSO should be used on transmit by looking at the skb->gso_size rather than seeing if the frame was larger than our MTU. The old method causes problems when a host with a large (jumbo) MTU is sending to a host with a small (standard) MTU. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit 7acfaf3037ff19b749117a286f0f24e201ada0ec Author: Paul Rolland Date: Mon Mar 26 21:43:44 2007 -0800 ata: NCQ is broken on Maxtor 6L250S0 With this applied, my machine has stopped all those painful messages. dmesg now says : root@riri:/Kernels# dmesg | grep LBA ata1.00: 490234752 sectors, multi 0: LBA48 NCQ (not used) ata2.00: 640 sectors, multi 1: LBA ata3.00: 490234752 sectors, multi 0: LBA48 NCQ (not used) Signed-off-by: Paul Rolland Acked-by: Alan Cox Cc: Jeff Garzik Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 5e5188108bcf9ab2e6f87b4b54924354040b0aa7 Author: Alan Cox Date: Fri Mar 23 18:57:23 2007 +0000 pata_pdc202xx_old: LBA48 bug In LBA48 mode we have to help the controller to get anything to work. The chip provides a register giving word counts meant for ATAPI use which we can use. However we need to load the count in words not bytes.. Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit 8c3c52a8f00536ce55dafa055b4a211f878f3901 Author: Tejun Heo Date: Thu Mar 22 22:24:19 2007 +0900 libata: IDENTIFY backwards for drive side cable detection For drive side cable detection to work correctly, drives need to be identified backwards such that the slave device releases PDIAG- before the mater drive tries to detect cable type. ata_bus_probe() was fixed by commit f31f0cc2f0b7527072d94d02da332d9bb8d7d94c but the new EH path wasn't fixed. This patch makes new EH path do IDENTIFY backwards. ata_dev_configure() for new devices are still performed master first. This is to keep the detection messages in forward order. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 55a61604cd1354e1783364e1c901034f2f474b7d Author: Conke Hu Date: Tue Mar 27 18:33:05 2007 +0800 ahci.c: walkaround for SB600 SATA internal error issue There is a HW issue in ATI SB600 SATA that PxSERR.E should not be set on some conditions, for example, when there is no media in SATA CD/DVD drive or media is not ready, AHCI controller fails to execute ATAPI commands and reports PORT_IRQ_TF_ERR, but ATI SB600 SATA controller sets PxSERR.E at the same time, which is not necessary. This patch is just to ignore the INTERNAL ERROR in such case. Without this patch, ahci error handler will report many errors as below: ----------- cut from dmesg ----------- ata9: soft resetting port ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) ata9.00: configured for UDMA/33 ata9: EH complete ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 ata9.00: (irq_stat 0x40000001) ata9.00: cmd a0/00:00:00:00:20/00:00:00:00:00/a0 tag 0 cdb 0x0 data 0 res 51/24:03:00:00:20/00:00:00:00:00/a0 Emask 0x40 (internal error) ata9: soft resetting port ata9: SATA link up 1.5 Gbps (SStatus 113 SControl 300) ata9.00: configured for UDMA/33 ata9: EH complete ata9.00: exception Emask 0x40 SAct 0x0 SErr 0x800 action 0x2 ata9.00: (irq_stat 0x40000001) ata9.00: cmd a0/01:00:00:00:00/00:00:00:00:00/a0 tag 0 cdb 0x43 data 12 in res 51/24:03:00:00:00/00:00:00:00:00/a0 Emask 0x40 (internal error) -------- end cut --------- Signed-off-by: Conke Hu Signed-off-by: Jeff Garzik commit d7d0dad62a641c156386288a747c1a2f6bb2e42d Author: Jeff Garzik Date: Wed Mar 28 01:57:37 2007 -0400 [libata] Disable ACPI by default; fix namespace problems Not yet ready to turn on ATA ACPI by default, for either PATA or SATA. Also, rename the global-scope module parameter variable 'noacpi' to something more libata-specific, reducing the potential for namespace collision. Signed-off-by: Jeff Garzik commit 28defbea64622f69d65a6079bf800cedb9915a5f Author: Zach Brown Date: Tue Mar 27 15:44:01 2007 -0700 [PATCH] aio: remove bare user-triggerable error printk The user can generate console output if they cause do_mmap() to fail during sys_io_setup(). This was seen in a regression test that does exactly that by spinning calling mmap() until it gets -ENOMEM before calling io_setup(). We don't need this printk at all, just remove it. Signed-off-by: Zach Brown Signed-off-by: Linus Torvalds commit 53aadcc90931dfa150f76ce9a5f9e8f3e43d57df Author: Herbert Xu Date: Tue Mar 27 14:31:52 2007 -0700 [IPV6]: Set IF_READY if the device is up and has carrier We still need to set the IF_READY flag in ipv6_add_dev for the case where all addresses (including the link-local) are deleted and then recreated. In that case the IPv6 device too will be destroyed and then recreated. In order to prevent the original problem, we simply ensure that the device is up before setting IF_READY. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit c38c83cb705a41e30a99545ae2314c00e3b9bf1c Author: Patrick McHardy Date: Tue Mar 27 14:04:24 2007 -0700 [NET_SCHED]: sch_htb/sch_hfsc: fix oops in qlen_notify During both HTB and HFSC class deletion the class is removed from the class hash before calling qdisc_tree_decrease_qlen. This makes the ->get operation in qdisc_tree_decrease_qlen fail, so it passes a NULL pointer to ->qlen_notify, causing an oops. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit c2805fbb8630abb95d94ce7adc3f97976f7e0367 Author: Jean Tourrilhes Date: Fri Mar 23 00:31:16 2007 +0000 [PATCH] WE-22 : prevent information leak on 64 bit Johannes Berg discovered that kernel space was leaking to userspace on 64 bit platform. He made a first patch to fix that. This is an improved version of his patch. Signed-off-by: Jean Tourrilhes Signed-off-by: John W. Linville commit ed4bb1063171b2f44a40b0a9c400dedb0590dce6 Author: Jean Tourrilhes Date: Fri Mar 23 00:26:49 2007 +0000 [PATCH] wext: Add missing ioctls to 64<->32 conversion Johannes Berg and Michael Buesch noticed that the WPA ioctls were missing from the 64<->32 bit conversion. This means that when using a 32 bits userspace on a 64 bit kernel, those ioctls fail. Signed-off-by: Jean Tourrilhes Signed-off-by: John W. Linville commit 83b5db89c851f9a2080e2e43427346269ab84447 Author: David Woodhouse Date: Sun Mar 25 08:45:54 2007 -0500 [PATCH] bcm43xx: Fix machine check on PPC for version 1 PHY Recent changes in the specs that were introduced in commit 740ac4fb08866d702be90f167665d03759bd27d0 were incorrect and resulted in machine check errors on the PPC architecture for G PHY's with a revision number equal to 1. The two offending changes are reverted. Signed-off-by: David Woodhouse Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit 7265c5d10dd893b91aab15735ed9346a0e07bf07 Author: Stefano Brivio Date: Fri Mar 23 20:21:39 2007 +0100 [PATCH] bcm43xx: fix radio_set_tx_iq Fix a duplicated leftshift in bcm43xx_radio_set_tx_iq. data_high values are already leftshifted. Thanks to Michael Buesch for spotting this. Signed-off-by: Stefano Brivio Signed-off-by: John W. Linville commit be10d3860ef07ff43f240fbc0c0b72df1a5fe3df Author: Larry Finger Date: Sat Mar 17 11:28:21 2007 -0500 [PATCH] bcm43xx: Fix code for confusion between PHY revision and PHY version There are several places where the PHY version and revision were interchanged. These are changed in the specifications on 2/13/07 and now use "analog" instead instead of "version" to help reduce confusion. Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit 436ce71638eceb0f9dd7608157807c37b29c3db7 Author: Rafael J. Wysocki Date: Tue Mar 27 12:09:13 2007 +0200 [PATCH] Revert "swsusp: disable nonboot CPUs before entering platform suspend" This reverts commit 94985134b7b46848267ed6b734320db01c974e72 and insteads removes the WARN_ON() that caused that commit in the first place. The problem is that we call disable_nonboot_cpus() in swsusp before powering down the system in order to avoid triggering the WARN_ON() in arch/x86_64/kernel/acpi/sleep.c:init_low_mapping() and this doesn't work well on Thomas' system. So instead, remove the WARN_ON() in arch/x86_64/kernel/acpi/sleep.c: init_low_mapping(), which triggers every time during the suspend to disk in the platform mode, as the potential problem it is related to doesn't seem to occur in practice. [ I think we might want to disallow the case of multiple users of that mm, or something. Normally, playing with the current process page tables on the current CPU should be fine as long as we don't have other threads using those tables at the same time.. Anyway, not pretty, but better than the warning or the lockup - Linus ] Signed-off-by: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit c7f6d15ff2664467a2cb669abcabb5ffaf719b2d Author: Thomas Gleixner Date: Tue Mar 27 09:08:26 2007 +0200 [PATCH] i386: Fix bogus return value in hpet_next_event() The clockevents / tick management code expects an error value, when the event is already expired. hpet_next_event() returns 1 in that case. Fix it to return the proper -ETIME error code. Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 5c46010af210712c8a390c7fe50ff05448983061 Author: Mika Kukkonen Date: Mon Mar 26 21:32:33 2007 -0800 [PATCH] Fix kernel build with EMBEDDED & PROC_FS & !PROC_SYSCTL Without attached patch against current -git I get following with !PROC_SYSCTL (with EMBEDDED and PROC_FS set): CC init/version.o LD init/built-in.o LD vmlinux fs/built-in.o: In function `do_proc_sys_lookup': proc_sysctl.c:(.text+0x26583): undefined reference to `sysctl_head_next' fs/built-in.o: In function `proc_sys_revalidate': proc_sysctl.c:(.text+0x265bb): undefined reference to `sysctl_head_finish' fs/built-in.o: In function `proc_sys_readdir': proc_sysctl.c:(.text+0x26720): undefined reference to `sysctl_head_next' proc_sysctl.c:(.text+0x267d8): undefined reference to `sysctl_head_finish' proc_sysctl.c:(.text+0x268e7): undefined reference to `sysctl_head_next' proc_sysctl.c:(.text+0x26910): undefined reference to `sysctl_head_finish' fs/built-in.o: In function `proc_sys_write': proc_sysctl.c:(.text+0x2695d): undefined reference to `sysctl_perm' proc_sysctl.c:(.text+0x2699c): undefined reference to `sysctl_head_finish' fs/built-in.o: In function `proc_sys_read': proc_sysctl.c:(.text+0x269e9): undefined reference to `sysctl_perm' proc_sysctl.c:(.text+0x26a25): undefined reference to `sysctl_head_finish' fs/built-in.o: In function `proc_sys_permission': proc_sysctl.c:(.text+0x26ad1): undefined reference to `sysctl_perm' proc_sysctl.c:(.text+0x26adb): undefined reference to `sysctl_head_finish' fs/built-in.o: In function `proc_sys_lookup': proc_sysctl.c:(.text+0x26b39): undefined reference to `sysctl_head_finish' make: *** [vmlinux] Virhe 1 All those functions are in fs/proc/proc_sysctl.c, which has no CONFIG_ #define's in it, so the patch makes the compilation of that file to depend on CONFIG_PROC_SYSCTL (the simplest choice). Acked-by: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b8f2f5165c3eb22d7b19405d80fd82339507a950 Author: Markus Lidel Date: Mon Mar 26 21:32:32 2007 -0800 [PATCH] I2O: remove Markus from MAINTAINERS Because i don't have much time lately and my responses are pretty slow it's probably best to remove me from MAINTAINERS to give someone else the chance to jump in. Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a28d193cbf01375974683c13e99a52ef489e5eb0 Author: Serge E. Hallyn Date: Mon Mar 26 21:32:31 2007 -0800 [PATCH] ipcns: fix !CONFIG_IPC_NS behavior When CONFIG_IPC_NS=n, clone(CLONE_NEWIPC) claims success, but did not actually clone a new IPC namespace. Fix this to return -EINVAL so the caller knows his request was denied. Signed-off-by: Serge E. Hallyn Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1985ad1da28eac507d855af8099f6010c51b167 Author: Vasily Averin Date: Mon Mar 26 21:32:30 2007 -0800 [PATCH] i2o: block IO errors on i2o disk I2O subsystem has been broken in mainstream several months ago (after 2.6.18). Commit 4aff5e2333c9a1609662f2091f55c3f6fffdad36 from Jens Axboe split struct request ->flags into two parts: cmd_type and cmd_flags. In i2o layer this patch has replaced flag REQ_SPECIAL by the according cmd_type. However i2o has used REQ_SPECIAL not as command type but as driver-specific flag for the debug purposes. As result all i2o requests have type "special" now, are not processed to the hardware and fail with I/O error: i2o/hda:<3>Buffer I/O error on device i2o/hda, logical block 0 Buffer I/O error on device i2o/hda, logical block 0 Buffer I/O error on device i2o/hda, logical block 0 unable to read partition table block-osm: device added (TID: 207): i2o/hda The following patch removes the extra debug checks without any drawbacks and restores the normal driver's work. Signed-off-by: Vasily Averin Acked-by: Markus Lidel Cc: Jens Axboe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 88f45005ce8ec97fc3a2aac3c0e9e645ed83a64a Author: Yoichi Yuasa Date: Mon Mar 26 21:32:28 2007 -0800 [PATCH] Fix struct device member name in PCMCIA au1000_generic drivers/pcmcia/au1000_generic.c: In function 'au1x00_pcmcia_socket_probe': drivers/pcmcia/au1000_generic.c:375: error: 'struct device' has no member named 'dev' Signed-off-by: Yoichi Yuasa Cc: Ralf Baechle Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Greg KH Cc: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74b9a297866d0416edd0be5014cb0810de049c6a Author: Adrian Bunk Date: Mon Mar 26 21:32:27 2007 -0800 [PATCH] drivers/eisa/pci_eisa.c:pci_eisa_init() should be init WARNING: drivers/built-in.o - Section mismatch: reference to .init.text:eisa_root_register from .text between 'pci_eisa_init' (at offset 0xabf670) and 'virtual_eisa_release' AFAIK a PCI to EISA bridge isn't anything hotpluggable, so pci_eisa_init() can become __init. Signed-off-by: Adrian Bunk Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d62ac21aa075c8ddf3d02a98d28afce635e77e8e Author: john stultz Date: Mon Mar 26 21:32:26 2007 -0800 [PATCH] ntp: avoid time_offset overflows I've been seeing some odd NTP behavior recently on a few boxes and finally narrowed it down to time_offset overflowing when converted to SHIFT_UPDATE units (which was a side effect from my HZfreeNTP patch). This patch converts time_offset from a long to a s64 which resolves the issue. [tglx@linutronix.de: signedness fixes] Signed-off-by: John Stultz Cc: Roman Zippel Cc: john stultz Cc: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b92c4f922b2e8c70f8790d42e45bb9401c57be63 Author: Jeff Dike Date: Mon Mar 26 21:32:25 2007 -0800 [PATCH] uml: use correct register file size everywhere This patch uses MAX_REG_NR consistently to refer to the register file size. FRAME_SIZE isn't sufficient because on x86_64, it is smaller than the ptrace register file size. MAX_REG_NR was introduced as a consistent way to get the number of registers, but wasn't used everywhere it should be. When this causes a problem, it makes PTRACE_SETREGS fail on x86_64 because of a corrupted segment register value in the known-good register file. The patch also adds a register dump at that point in case there are any future problems here. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7632fc8f809a97f9d82ce125e8e3e579390ce2e5 Author: Jeff Dike Date: Mon Mar 26 21:32:24 2007 -0800 [PATCH] uml: fix static linking During a static link, ld has started putting a .note section in the .uml.setup.init section. This has the result that the UML setups begin with 32 bytes of garbage and UML crashes immediately on boot. This patch creates a specific .note section for ld to drop this stuff into. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e9d5a461157c1244475bc400fcac7f871608715e Author: Adrian Bunk Date: Mon Mar 26 21:32:23 2007 -0800 [PATCH] drivers/spi/: fix section mismatches WARNING: drivers/built-in.o - Section mismatch: reference to .init.text:spi_register_master from .text between 'spi_bitbang_start' (at offset 0x84e11a) and 'bitbang_work' WARNING: drivers/built-in.o - Section mismatch: reference to .init.text:spi_alloc_master from .text between 'butterfly_attach' (at offset 0x84e681) and 'at25_remove' WARNING: drivers/built-in.o - Section mismatch: reference to .init.text:spi_new_device from .text between 'butterfly_attach' (at offset 0x84e7e4) and 'at25_remove' Signed-off-by: Adrian Bunk Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 78d832f62643ac6209beccbfb29228314423935e Author: Serge E. Hallyn Date: Mon Mar 26 21:32:22 2007 -0800 [PATCH] utsns: fix !CONFIG_UTS_NS behavior When CONFIG_UTS_NS=n, clone(CLONE_NEWUTS) quietly refuses. So correctly does not unshare a new uts namespace, but also does not return -EINVAL. Fix this to return -EINVAL so the caller knows his request was denied. Signed-off-by: Serge E. Hallyn Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 62b3e920ed7612f318126f9c9b37c6a8dcd4199e Author: Alan Cox Date: Mon Mar 26 21:32:21 2007 -0800 [PATCH] tty: minor merge correction Its now used.. because we added the new definitions so enabled all the goodies on i386 Signed-off-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d75e26a8298f84bca66374e98fa69049f26083ba Author: Jeff Dike Date: Mon Mar 26 21:32:20 2007 -0800 [PATCH] uml: fix epoll UML/x86_64 needs the same packing of struct epoll_event as x86_64. Signed-off-by: Jeff Dike Cc: Davide Libenzi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3899210ad9850e3b8909674c92dccbd3caaf9750 Author: Jiri Kosina Date: Mon Mar 26 21:32:19 2007 -0800 [PATCH] ISDN: fix BChannel_bh() call from isar_bh() isar_bh() bh handler calls another (compatible) bh handler - BChannel_bh() - but passes struct BCState* instead of struct work_struct*, which seems wrong. Cc: Karsten Keil Signed-off-by: Jiri Kosina Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1ff100d76ff76477a2ead3aac94d04f2e891f44e Author: john stultz Date: Mon Mar 26 21:32:19 2007 -0800 [PATCH] correct slow acpi_pm rating On Bob's machine clocksource is selecting PIT over the ACPI PM timer, because he has the PIIX4 bug. That bug drops the ACPI PM timers rating to the same as the PIT, so that's why you're getting the PIT. Realistically, the PIT is much slower then even the triple read ACPI PM, so the de-ranking code is probably dropping it too far. So don't drop ACPI PM quite so low if we see the PIIX4 bug. Signed-off-by: John Stultz Cc: Bob Tracy Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d340d89087534e8b12e1b6ed1c1569dd892b5465 Author: Daniel Drake Date: Mon Mar 26 21:32:15 2007 -0800 [PATCH] generic_serial: fix decoding of baud rate Commit d720bc4b8fc5d6d179ef094908d4fbb5e436ffad partially removed a private implementation of baud speed decoding. However it doesn't seem to be complete: after the speed is decoded, it is still being used as an index to a local speed table (array overrun, no doubt). This was found by Graham Murray who noticed it caused a 2.6.19 regression with the SX driver: https://bugs.gentoo.org/170554 Signed-off-by: Daniel Drake Acked-by: Alan Cox Cc: Russell King Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e55e2f5fc95b355d8aa649f346cff69904c8ade Author: NeilBrown Date: Mon Mar 26 21:32:14 2007 -0800 [PATCH] md: convert compile time warnings into runtime warnings ... still not sure why we need this .... Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 041ae52e265fc432ea5525b1c66720385c2d11f0 Author: NeilBrown Date: Mon Mar 26 21:32:14 2007 -0800 [PATCH] md: clear the congested_fn when stopping a raid5 If this mddev and queue got reused for another array that doesn't register a congested_fn, this function would get called incorretly. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3d37890baa4ca962f8a6b77525b8f3d0698eee09 Author: NeilBrown Date: Mon Mar 26 21:32:13 2007 -0800 [PATCH] md: allow raid4 arrays to be reshaped All that is missing the the function pointers in raid4_pers. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 79f6523a16b2010969418f8df25fe61498dec66b Author: J. Bruce Fields Date: Mon Mar 26 21:32:10 2007 -0800 [PATCH] knfsd: nfsd4: remove superfluous cancel_delayed_work() call This cancel_delayed_work call is called from a function that is only called from a piece of code that immediate follows a cancel and destruction of the workqueue, so it's clearly a mistake. Cc: Oleg Nesterov Signed-off-by: "J. Bruce Fields" Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 21315edd4877b593d5bf17a601a48fc836b8ba58 Author: Bruce Fields Date: Mon Mar 26 21:32:09 2007 -0800 [PATCH] knfsd: nfsd4: demote "clientid in use" printk to a dprintk The reused clientid here is a more of a problem for the client than the server, and the client can report the problem itself if it's serious. Signed-off-by: "J. Bruce Fields" Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 54c044094947826105317dadd01deca083627ea1 Author: Bruce Fields Date: Mon Mar 26 21:32:09 2007 -0800 [PATCH] knfsd: nfsd4: fix inheritance flags on v4 ace derived from posix default ace A regression introduced in the last set of acl patches removed the INHERIT_ONLY flag from aces derived from the posix acl. Fix. Signed-off-by: "J. Bruce Fields" Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 598b9a56373f0596ed48f7af730706aaee998d5f Author: NeilBrown Date: Mon Mar 26 21:32:08 2007 -0800 [PATCH] knfsd: allow nfsd READDIR to return 64bit cookies ->readdir passes lofft_t offsets (used as nfs cookies) to nfs3svc_encode_entry{,_plus}, but when they pass it on to encode_entry it becomes an 'off_t', which isn't good. So filesystems that returned 64bit offsets would lose. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ec28297a562f2b022115b9eb82e4ea724d996240 Author: Venki Pallipadi Date: Mon Mar 26 12:03:19 2007 -0700 [PATCH] Fix maxcpus=1 trigerring BUG() in cpufreq Ingo reported it on lkml in the thread "2.6.21-rc5: maxcpus=1 crash in cpufreq: kernel BUG at drivers/cpufreq/cpufreq.c:82!" This check added to remove_dev is symmetric to one in add_dev and handles callbacks for offline cpus cleanly. Signed-off-by: Venkatesh Pallipadi Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 6d9658df07789a124e5c1f8677afcd7773439f3e Author: Ingo Molnar Date: Sun Mar 11 13:52:33 2007 +0100 KVM: always reload segment selectors failed VM entry on VMX might still change %fs or %gs, thus make sure that KVM always reloads the segment selectors. This is crutial on both x86 and x86_64: x86 has __KERNEL_PDA in %fs on which things like 'current' depends and x86_64 has 0 there and needs MSR_GS_BASE to work. Signed-off-by: Ingo Molnar commit 6af11b9e827aac1d664ccd31e94f122c7698416b Author: Avi Kivity Date: Mon Mar 19 13:18:10 2007 +0200 KVM: Prevent system selectors leaking into guest on real->protected mode transition on vmx Intel virtualization extensions do not support virtualizing real mode. So kvm uses virtualized vm86 mode to run real mode code. Unfortunately, this virtualized vm86 mode does not support the so called "big real" mode, where the segment selector and base do not agree with each other according to the real mode rules (base == selector << 4). To work around this, kvm checks whether a selector/base pair violates the virtualized vm86 rules, and if so, forces it into conformance. On a transition back to protected mode, if we see that the guest did not touch a forced segment, we restore it back to the original protected mode value. This pile of hacks breaks down if the gdt has changed in real mode, as it can cause a segment selector to point to a system descriptor instead of a normal data segment. In fact, this happens with the Windows bootloader and the qemu acpi bios, where a protected mode memcpy routine issues an innocent 'pop %es' and traps on an attempt to load a system descriptor. "Fix" by checking if the to-be-restored selector points at a system segment, and if so, coercing it into a normal data segment. The long term solution, of course, is to abandon vm86 mode and use emulation for big real mode. Signed-off-by: Avi Kivity commit 09d4895488d4df5c58b739573846f514ceabc911 Author: Thomas Viehweger Date: Thu Mar 22 11:20:32 2007 -0300 V4L/DVB (5472): Isl6421: don't reference freed memory After freeing a block there should be no reference to this block. Signed-off-by: Thomas Viehweger Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799 Author: Oliver Endriss Date: Tue Mar 13 23:44:57 2007 -0300 V4L/DVB (5441): Saa7146: Fix allocation of clipping memory Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become very large for PAGE_SIZE > 4K. In fact, the number of clipping windows is limited to 16, and calculate_clipping_registers_rect() does not use more than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly. Thanks-to: Olaf Hering Acked-by: Michael Hunold Signed-off-by: Oliver Endriss Signed-off-by: Mauro Carvalho Chehab commit 21b48a70f7e26906d522c81b22228b375b450a8f Author: Jean Delvare Date: Mon Mar 12 19:20:15 2007 -0300 V4L/DVB (5421): Fix suspend/resume in msp3400 and tuner Signed-off-by: Jean Delvare Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 3284b4e077cb2322754ea7455b8f8af7ce3777b8 Author: Hans Verkuil Date: Sat Mar 10 20:21:07 2007 -0300 V4L/DVB (5415): Msp_attach must return 0 if no msp3400 was found. Returning -1 causes the probe to stop, but it should just continue instead. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit a9aaec4e83e687d23b78b38e331bbd6a10b96380 Author: Mauro Carvalho Chehab Date: Tue Mar 13 13:41:49 2007 -0300 V4L/DVB (5408): Fix SECAM handling on saa7115 Signed-off-by: Mauro Carvalho Chehab commit c278850206fd9df0bb62a72ca0b277fe20c5a452 Author: Simon Arlott Date: Sat Mar 10 06:21:25 2007 -0300 V4L/DVB (5400): Core: fix several locking related problems Fix several instances of dvb-core functions using mutex_lock_interruptible and returning -ERESTARTSYS where the calling function will either never retry or never check the return value. These cause a race condition with dvb_dmxdev_filter_free and dvb_dvr_release, both of which are filesystem release functions whose return value is ignored and will never be retried. When this happens it becomes impossible to open dvr0 again (-EBUSY) since it has not been released properly. Signed-off-by: Simon Arlott Signed-off-by: Andrew Morton Acked-By: Johannes Stezenbach Signed-off-by: Mauro Carvalho Chehab commit b10fece583fdfdb3d2f29b0da3896ec58b8fe122 Author: Trent Piepho Date: Wed Mar 7 18:19:46 2007 -0300 V4L/DVB (5390): Radio: Fix error in Kbuild file All the radio drivers need video_dev, but they were depending on VIDEO_DEV!=n. That meant that one could try to compile the driver into the kernel when VIDEO_DEV=m, which will not work. If video_dev is a module, then the radio drivers must be modules too. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab commit 726cf56f24cbadaad1719724a30c29eb92911524 Author: Vincent Penne Date: Sun Mar 25 11:58:23 2007 -0300 V4L/DVB (5332): Ir_rc5_timer_end decoder lockup fix ir_rc5_timer_end decoder lockup fix Signed-off-by: Vincent Penne Signed-off-by: Hermann Pitton Signed-off-by: Hartmut Hackmann Signed-off-by: Mauro Carvalho Chehab commit 7945d5626c4e09eca5eb70f65ae7344e9e246d8f Author: Mikael Pettersson Date: Tue Mar 27 01:13:55 2007 -0700 [SPARC]: sparc64 gcc-4.2.0 20070317 -Werror failure Compiling 2.6.21-rc5 with gcc-4.2.0 20070317 (prerelease) for sparc64 fails as follows: gcc -Wp,-MD,arch/sparc64/kernel/.time.o.d -nostdinc -isystem /home/mikpe/pkgs/linux-sparc64/gcc-4.2.0/lib/gcc/sparc64-unknown-linux-gnu/4.2.0/include -D__KERNEL__ -Iinclude -include include/linux/autoconf.h -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs -fno-strict-aliasing -fno-common -Os -m64 -pipe -mno-fpu -mcpu=ultrasparc -mcmodel=medlow -ffixed-g4 -ffixed-g5 -fcall-used-g7 -Wno-sign-compare -Wa,--undeclared-regs -fomit-frame-pointer -fno-stack-protector -Wdeclaration-after-statement -Wno-pointer-sign -Werror -D"KBUILD_STR(s)=#s" -D"KBUILD_BASENAME=KBUILD_STR(time)" -D"KBUILD_MODNAME=KBUILD_STR(time)" -c -o arch/sparc64/kernel/time.o arch/sparc64/kernel/time.c cc1: warnings being treated as errors arch/sparc64/kernel/time.c: In function 'kick_start_clock': arch/sparc64/kernel/time.c:559: warning: overflow in implicit constant conversion make[1]: *** [arch/sparc64/kernel/time.o] Error 1 make: *** [arch/sparc64/kernel] Error 2 gcc gets unhappy when the MSTK_SET macro's u8 __val variable is updated with &= ~0xff (MSTK_YEAR_MASK). Making the constant unsigned fixes the problem. [ I fixed up the sparc32 side as well -DaveM ] Signed-off-by: Mikael Pettersson Signed-off-by: David S. Miller commit 40bee44eaef91b6030037c8bb47f909181fb1edc Author: Mark Fasheh Date: Wed Mar 21 13:11:02 2007 +0100 Export __splice_from_pipe() Ocfs2 wants to implement it's own splice write actor so that it can better manage cluster / page locks. This lets us re-use the rest of splice write while only providing our own code where it's actually important. Signed-off-by: Mark Fasheh Signed-off-by: Jens Axboe commit 08c72591636829d40bd695d43ec6d2a8191b668b Author: Nick Piggin Date: Tue Mar 27 08:55:39 2007 +0200 2/2 splice: dont readpage Splice does not need to readpage to bring the page uptodate before writing to it, because prepare_write will take care of that for us. Splice is also wrong to SetPageUptodate before the page is actually uptodate. This results in the old uninitialised memory leak. This gets fixed as a matter of course when removing the readpage logic. Signed-off-by: Nick Piggin Signed-off-by: Jens Axboe commit 485ddb4b9741bafb70b22e5c1f9b4f37dc3e85bd Author: Nick Piggin Date: Tue Mar 27 08:55:08 2007 +0200 1/2 splice: dont steal Stealing pages with splice is problematic because we cannot just insert an uptodate page into the pagecache and hope the filesystem can take care of it later. We also cannot just ClearPageUptodate, then hope prepare_write does not write anything into the page, because I don't think prepare_write gives that guarantee. Remove support for SPLICE_F_MOVE for now. If we really want to bring it back, we might be able to do so with a the new filesystem buffered write aops APIs I'm working on. If we really don't want to bring it back, then we should decide that sooner rather than later, and remove the flag and all the stealing infrastructure before anybody starts using it. Signed-off-by: Nick Piggin Signed-off-by: Jens Axboe commit 1ffb96c587fa2af0d690dc3548a4a781c477bfb7 Author: Thibaut VARENE Date: Thu Mar 15 12:59:19 2007 +0100 make elv_register() output atomic Booting 2.6.21-rc3-g45592145 I noticed the following on one of my machines in the bootlog: io scheduler noop registered<6>Time: jiffies clocksource has been installed. io scheduler deadline registered (default) Looking at block/elevator.c, it appears that elv_register() uses two consecutive printks in a non-atomic way, leading to the above glitch. The attached trivial patch fixes this issue, by using a single printk. Signed-off-by: Thibaut VARENE Signed-off-by: Jens Axboe commit f772b3d9ca135087a70406d8466e57d1cf29237e Author: Vasily Tarasov Date: Tue Mar 27 08:52:47 2007 +0200 block: blk_max_pfn is somtimes wrong There is a small problem in handling page bounce. At the moment blk_max_pfn equals max_pfn, which is in fact not maximum possible _number_ of a page frame, but the _amount_ of page frames. For example for the 32bit x86 node with 4Gb RAM, max_pfn = 0x100000, but not 0xFFFF. request_queue structure has a member q->bounce_pfn and queue needs bounce pages for the pages _above_ this limit. This routine is handled by blk_queue_bounce(), where the following check is produced: if (q->bounce_pfn >= blk_max_pfn) return; Assume, that a driver has set q->bounce_pfn to 0xFFFF, but blk_max_pfn equals 0x10000. In such situation the check above fails and for each bio we always fall down for iterating over pages tied to the bio. I want to notice, that for quite a big range of device drivers (ide, md, ...) such problem doesn't happen because they use BLK_BOUNCE_ANY for bounce_pfn. BLK_BOUNCE_ANY is defined as blk_max_pfn << PAGE_SHIFT, and then the check above doesn't fail. But for other drivers, which obtain reuired value from drivers, it fails. For example sata_nv uses ATA_DMA_MASK or dev->dma_mask. I propose to use (max_pfn - 1) for blk_max_pfn. And the same for blk_max_low_pfn. The patch also cleanses some checks related with bounce_pfn. Signed-off-by: Vasily Tarasov Signed-off-by: Andrew Morton Signed-off-by: Jens Axboe commit 37db9a348ad4250bd6009cec1bb108a653d1d220 Author: David S. Miller Date: Mon Mar 26 23:18:09 2007 -0700 [VIDEO] ffb: Fix two DAC handling bugs. The determination of whether the DAC has inverted cursor logic is broken, import the version checks the X.org driver uses to fix this. Next, when we change the timing generator, borrow code from X.org that does 10 NOP reads of the timing generator register afterwards to make sure the video-enable transition occurs cleanly. Finally, use macros for the DAC registers and fields in order to provide documentation for the next person who reads this code. Signed-off-by: David S. Miller commit 74e61dee2a98b5e538ee1448ca803fc0ad8e307f Author: Robert Reif Date: Mon Mar 26 19:10:43 2007 -0700 [SPARC32]: Fix SMP build regression commit b19cbe2a1695c09c74f83646c4b82b51123b3690 [BRIDGE]: Fix fdb RCU race breaks sparc SMP build because atomic_add_unless is not exported. This patch exports atomic_add_unless and atomic_cmpxchg. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit b82f87f6d40f944a591d8d36c0fed2d4374efcb7 Author: David S. Miller Date: Mon Mar 26 16:54:39 2007 -0700 [DRM]: Delete sparc64 FFB driver code that never gets built. The Kconfig bits were removed long ago, so we should kill off the driver too. Signed-off-by: David S. Miller commit 2f5bf1f2d061dea5146aa283685ce2b00cea2f3d Author: Sunil Mushran Date: Thu Mar 22 17:08:32 2007 -0700 ocfs2_dlm: Check for migrateable lockres in dlm_empty_lockres() In dlm_migrate_lockres(), we check upfront whether the lockres is a candidate for migration. This patch encapsulates that code in a separate function so that dlm_empty_lockres() can also use it during umount. This patch addresses the umount process spinning problem. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit 78062cb2e54ffe0df811dce5e68b54da9b8c9025 Author: Sunil Mushran Date: Thu Mar 22 17:01:07 2007 -0700 ocfs2_dlm: Fix lockres ref counting bug During umount, the umount thread migrates the lockres' and the dlm_thread frees the empty lockres'. Due to a race, the reference counting on the lockres goes awry leading to extra puts. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit 3104a2175dc04b7a597acea90f19b033abcfc7d8 Author: Erez Zilber Date: Sun Mar 25 12:07:10 2007 +0200 IB/iser: Handle aborting a command after it is sent The SCSI midlayer may abort a command that was already sent. If the initiator is still trying to send the command (or data-out PDUs for that command), the QP may time out after the midlayer times out. Therefore, when aborting the command, iSER may still have references for the command's buffers. When sending these PDUs, the sends will complete with an error and their resources will be released then. Signed-off-by: Erez Zilber Signed-off-by: Roland Dreier commit 9b2f7bcf0efea98666da56073448647e2b373b67 Author: Robert P. J. Day Date: Mon Mar 26 16:20:34 2007 -0700 [NET]: Remove dead net/sched/Makefile entry for sch_hpfq.o. Remove the worthless net/sched/Makefile entry for the non-existent source file sch_hpfq.c. Signed-off-by: Robert P. J. Day Signed-off-by: David S. Miller commit 0264d8853137a9a328d9f0ed29e083dd505512cb Author: Michael S. Tsirkin Date: Sun Mar 25 11:17:43 2007 +0200 IB/mthca: Fix thinko in init_mr_table() Commit c20e20ab ("IB/mthca: Merge MR and FMR space on 64-bit systems") swapped the number of MTTs and MPTs when initializing the MR table. As a result, we get a kernel oops when the number of MTT segments allocated exceeds 0x20000. Noted by Troy Benjegerdes , and reproduced by Dotan Barak . This fixes https://bugs.openfabrics.org/show_bug.cgi?id=490 Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit ed6ee5178e6d78ba7f79a5ece3f0b70ece531a6a Author: Steve Wise Date: Mon Mar 26 17:48:52 2007 -0500 RDMA/cxgb3: Fix resource leak in cxio_hal_init_ctrl_qp() This was spotted by the Coverity checker (CID 1554). Signed-off-by: Steve Wise Signed-off-by: Roland Dreier commit 09c72ec8ed8f7499d115309a6e19cd5e66808d88 Author: Ruben Vandeginste Date: Mon Mar 26 14:43:49 2007 -0700 [SUNGEM]: Fix MAC address setting when interface is up. This patch implements set_mac_address for the sungem driver. This allows changing the mac address of the interface, even when the interface is up. Signed-off-by: Ruben Vandeginste Signed-off-by: Benjamin Herrenschmidt Signed-off-by: David S. Miller commit 04a395233089ed160ef87a6c2155e5dedc6f7d15 Author: Russ Cox Date: Mon Mar 26 11:23:56 2007 -0400 [PATCH] Add const to pointer qualifiers for __chk_user_ptr and __chk_io_ptr. Change prototypes for __chk_user_ptr and __chk_io_ptr to take const void* instead of void*, so that code can pass "const void *" to them. (Right now sparse does not warn about passing const void* to void* functions, but that is a separate bug that I believe Josh is working on, and once sparse does check this, the changed prototypes will be necessary.) Signed-off-by: Russ Cox Signed-off-by: Josh Triplett Acked-by: Christopher Li Signed-off-by: Linus Torvalds commit d562f1f8a92035d5d4681c178fccb991ce57f33a Author: Robert Olsson Date: Mon Mar 26 14:22:22 2007 -0700 [IPV4] fib_trie: Document locking. Paul E. McKenney writes: > Those of use who dive into networking only occasionally would much > appreciate this. ;-) No problem here... Acked-by: Robert Olsson Signed-off-by: Paul E. McKenney (but trivial) Signed-off-by: David S. Miller commit 3b009c637fee4990265591cc282d0c0f9e3c5384 Author: David Brownell Date: Fri Mar 23 12:54:27 2007 -0700 USB: fix usb-serial/ftdi build warning Fix annoying build warning: drivers/usb/serial/ftdi_sio.c:890: warning: enumeration value `FT232RL' not handled in switch Also add logic to detect FT232R chips (version 6.00, usb 2.0 full speed), so that case isn't completely useless. (NOTE: FT232RL and FT232RQ are the same chip in different packages: L is SSOP, Q is QFN.) Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit b46d60fc4b2665107a04f75e5381294bfaf20177 Author: David Brownell Date: Fri Mar 23 12:51:55 2007 -0700 USB: fix usb-serial/generic build warning Fix annoying build warning when CONFIG_USB_SERIAL_GENERIC is undefined. drivers/usb/serial/generic.c:24: warning: `generic_probe' declared `static' but never defined Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 8a61499bc769f3e12c7f866f7283728308fff6ad Author: Oliver Neukum Date: Tue Mar 20 19:32:51 2007 +0100 USB: another entry for the quirk list this scanner disconnects upon suspend. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 4928245163b1595f0846aa87ddd1d4f682364fe1 Author: Jon K Hellan Date: Tue Mar 20 12:45:42 2007 +0100 USB: remove duplicated device id in airprime driver Both airprime and option now want to handle vendor ID 0x1410, device ID 0x1100. Airprime calls it 'ExpressCard34 Qualcomm 3G CDMA'. Option calls it 'Novatel Merlin XS620/S640'. Patch attached to remove it from airprime. From: Jon K Hellan Signed-off-by: Greg Kroah-Hartman commit 8a3c1f573c771e60f67ef172d2392d1a28385b4a Author: David Brownell Date: Wed Mar 21 12:26:32 2007 -0700 USB: omap_udc: workaround dma_free_coherent() bogosity Various fixes to omap_udc, noted with some recent testing: - Cope with some SMP-induced braindamage in ARM's dma_{alloc,free}_coherent() implementation: alloc() can be called with IRQs blocked, but since late last year that's no longer true for free(). This resolves really NASTY problems with logspamming via WARN_ON(), indicating N-page leaks. - Be more correct in handling GET_STATUS request for RECIP_ENDPOINT ... the previous code only handled RECIP_INTERFACE, this version should be correct except for (sigh) bulk/interrupt endpoints. - Provide a better name for the function reporting whether the board has vbus sensing wired up. GET_STATUS requests for endpoint status still acts strangely though, at least given one flakey host doesn't always ack the first DATA packet, then the packet that gets retransmitted doesn't have data! Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit e009f1b202219c62ea7e277adbb953d703dac983 Author: Alan Stern Date: Mon Mar 19 15:31:42 2007 -0400 UHCI: Fix problem caused by lack of terminating QH This patch (as871) fixes a problem introduced by an earlier change. It turns out that some systems really do need to have a terminating skeleton QH present whenever FSBR is on. I don't know any way to tell which systems do need it and which don't; the easiest answer is to have it there always. This fixes the NumLock-hang bug reported by Jiri Slaby. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit bf5b4ba3d9f37d41d940a92822b534561abf4f4c Author: Prarit Bhargava Date: Fri Mar 23 12:15:05 2007 -0400 PCI: Fix warning message in PCIE port driver PCIE error output should conform to vendor_id:device_id. Signed-off-by: Prarit Bhargava Signed-off-by: Greg Kroah-Hartman commit 9208ee8286ea2c0136a4bc58638b0295bad791c8 Author: Jean Delvare Date: Sat Mar 24 16:56:44 2007 +0100 PCI: Stop unhiding the SMBus on Toshiba laptops It was found that the Toshiba laptops with hidden Intel SMBus have SMM code handling the thermal management which accesses the SMBus. Thus it is not safe to unhide it and let Linux access it. We have to leave the SMBus hidden. SMM is a pain, really. This fixes bugs #6315 and #6395, for good this time. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 5fabdb94394bef0651479fc14394121c60d5aff7 Author: Jonathan Corbet Date: Thu Mar 22 16:53:40 2007 -0600 PCI: Fix up PCI power management doc Update the documentation of PCI power management functions. Signed-off-by: Jonathan Corbet Signed-off-by: Greg Kroah-Hartman commit f7a9dae7c41580761e7f6de1d508c010b1b44993 Author: Matt Domsch Date: Fri Mar 23 23:58:07 2007 -0500 pci: set pci=bfsort for PowerEdge R900 This patch automatically enables pci=bfsort for the Dell PowerEdge R900. This is necessary to ensure the onboard NICs enumerate in the proper order, similar to the other systems already on the list. Signed-off-by: Matt Domsch Signed-off-by: Greg Kroah-Hartman commit 79f4f6428f6ceb9af57330092271bda028c23a96 Author: Alexey Dobriyan Date: Mon Mar 26 14:09:52 2007 -0700 [NET]: Correct accept(2) recovery after sock_attach_fd() * d_alloc() in sock_attach_fd() fails leaving ->f_dentry of new file NULL * bail out to out_fd label, doing fput()/__fput() on new file * but __fput() assumes valid ->f_dentry and dereferences it Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit 291bc047e125ff02c9affe06a7df28bed57b054d Author: Thomas Gleixner Date: Mon Mar 26 11:21:08 2007 +0200 [PATCH] clockevents: remove bad designed sysfs support for now The current sysfs support of clockevents does not obey the "only one value per file" rule. The real fix is not 2.6.21 material. Therefor remove the sysfs support for now. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Acked-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 513daadd152ddbf32cb6d0447ddba3427ce5b8e8 Author: Suleiman Souhlal Date: Mon Mar 26 23:03:20 2007 +0200 ide: use correct IDE error recovery IDE error recovery is using IDLE IMMEDIATE if the drive is busy or has DRQ set. This violates the ATA spec (can only send IDLE IMMEDIATE when drive is not busy) and really hoses up some drives (modern drives will not be able to recover using this error handling). The correct thing to do is issue a SRST followed by a SET FEATURES command. This is what Western Digital recommends for error recovery and what Western Digital says Windows does.  It also does not violate the ATA spec as far as I can tell. Bart: * port the patch over the current tree * undo the recalibration code removal * send SET FEATURES command after checking for good drive status * don't check whether the current request is of REQ_TYPE_ATA_{CMD,TASK} type because we need to send SET FEATURES before handling any requests * some pre-ATA4 drives require INITIALIZE DEVICE PARAMETERS command before other commands (except IDENTIFY) so send SET FEATURES only if there are no pending drive->special requests * update comments and patch description * any bugs introduced by this patch are mine and not Suleiman's :-) Signed-off-by: Suleiman Souhlal Acked-by: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit 362ebd83adb4ff2761b6f49a3570f501c3c7e467 Author: Albert Lee Date: Mon Mar 26 23:03:19 2007 +0200 pdc202xx_new: Enable ATAPI DMA [ bart: the ressurection of 2 years old patch which slipped thru the cracks (thanks to Sergei Shtylyov for finding it) ] These is the patch to turn on pdc202xx_new for ATAPI DMA. When testing, it works fine without the (request_bufflen % 256) workaround as needed in libata. ide-scsi filters out (pc->request_transfer % 1024) and use PIO, so the pdc202xx ATAPI DMA problem is avoid. Both ide-cd and ide-scsi won't hit the ATAPI DMA problem on pdc202xx_new. Signed-off-by: Albert Lee Signed-off-by: Bartlomiej Zolnierkiewicz commit b43c5f3dbe0c93dc205a7c69f892b94b7037d862 Author: Patrick Ringl Date: Mon Mar 26 23:03:19 2007 +0200 ide: cosmetic adaption of drivers/ide/Kconfig concerning SATA Since especially Serial ATA has it's own menu point now, I guess we can change the description of the deprecated SATA driver as well, since the new libATA subsystem is not configured through a SCSI low-level driver anymore, but has it's own menu point. From: Patrick Ringl Signed-off-by: Bartlomiej Zolnierkiewicz commit 8799620400b0b1a4729d8be828b5bfb3d2a8db1a Author: Bartlomiej Zolnierkiewicz Date: Mon Mar 26 23:03:19 2007 +0200 ide: fix locking for manual DMA enable/disable ("hdparm -d") Since hwif->ide_dma_check and hwif->ide_dma_on never queue any commands (ide_config_drive_speed() sets transfer mode using polling and has no error recovery) we are safe with setting hwgroup->busy for the time while DMA setting for a drive is changed (so it won't race against I/O commands in fly). I audited briefly all ->ide_dma_check/->ide_dma_on/->tuneproc/->speedproc implementations and they all look OK wrt to this change. This patch finally allowed me to close kernel bugzilla bug #8169 (once again thanks to Patrick Horn for reporting the issue & testing patches). Cc: Sergei Shtylyov Cc: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit f68d9320cd06fdec19735143b42e5197b63165b4 Author: Bartlomiej Zolnierkiewicz Date: Mon Mar 26 23:03:18 2007 +0200 ide: revert "ide: fix drive side 80c cable check, take 2" for now "ide: fix drive side 80c cable check, take 2" patch from Tejun Heo (commit fab59375b9543f84d1714f7dd00f5d11e531bd3e) fixed 80c bit test (bit13 of word93) but we also need to fix master/slave IDENTIFY order (slave device should be probed first in order to make it release PDIAG- signal) and we should also check for pre-ATA3 slave devices (which may not release PDIAG- signal). [ Unfortunately the fact that IDE driver doesn't reset devices itself helps only a bit as it seems that some BIOS-es reset ATA devices after programming the chipset, some BIOS-es can be set to not probe/configure selected devices, there may be no BIOS in case of add-on cards etc. ] Since we are quite late in the release cycle and the required changes will affect a lot of systems just revert the fix for now. [ Please also see libata commit f31f0cc2f0b7527072d94d02da332d9bb8d7d94c. ] Thanks goes out to Fernando Mitio Yamada for reporting the problem and patiently testing patches. Acked-by: Tejun Heo Cc: Alan Cox Signed-off-by: Bartlomiej Zolnierkiewicz commit e675c0d2bf523a80098c843603ccc091d3720fb4 Author: Ralph Wuerthner Date: Mon Mar 26 20:42:43 2007 +0200 [S390] zcrypt: Fix ap_poll_requests counter in lost requests error path. In the unlikely event that an AP device lost requests, don't forget to update the ap_poll_requests counter too. Same must happen in case an AP device is removed while there are still outstanding requests. Cc: Martin Schwidefsky Signed-off-by: Ralph Wuerthner Signed-off-by: Heiko Carstens commit c6a48264739e3486f66e5b21a543c9573b713621 Author: Ralph Wuerthner Date: Mon Mar 26 20:42:42 2007 +0200 [S390] zcrypt: Fix possible dead lock in AP bus module. If a AP device is unconfigured __ap_poll_all() will call device_unregister() in software interrupt context which can cause dead locks. To fix this the device will be only marked as unconfigured and the device_unregister() call will be done later by either ap_scan_bus() or ap_queue_message() in process context. Cc: Martin Schwidefsky Signed-off-by: Ralph Wuerthner Signed-off-by: Heiko Carstens commit 25c61a1fe8c97d1352a2dc0eda25128b3be0db27 Author: Cornelia Huck Date: Mon Mar 26 20:42:41 2007 +0200 [S390] cio: Device status validity. Only accumulate device status field in irb if it is valid. Cc: Martin Schwidefsky Signed-off-by: Cornelia Huck Signed-off-by: Heiko Carstens commit b70842df77615309d76bcdd63bd289993e0844f2 Author: David Wilder Date: Mon Mar 26 20:42:40 2007 +0200 [S390] kprobes: Align probe address. Running a probe on s390 with a probe address that is not 4 byte aligned results in a Kernel BUG. The problem is that the stura instruction used by swap_instruction requires the destination address to be 4 byte aligned. As stura only writes 4 bytes, aligning to the next 4 byte aligned address results in the breakpoint instruction being stored past the probe address. The fix is to align the address backward (to the previous 4 byte aligned address) and writing the two byte breakpoint instruction in the appropriate bytes. Cc: Martin Schwidefsky Signed-off-by: David Wilder Signed-off-by: Heiko Carstens commit afbc1e994ddcf3b6fe2dc928ee8dc31a5d0c3118 Author: Heiko Carstens Date: Mon Mar 26 20:42:39 2007 +0200 [S390] Fix TCP/UDP pseudo header checksum computation. git commit f994aae1bd8e4813d59a2ed64d17585fe42d03fc changed the function declaration of csum_tcpudp_nofold. Argument types were changed from unsigned long to __be32 (unsigned int). Therefore we lost the implicit type conversion that zeroed the upper half of the registers that are used to pass parameters. Since the inline assembly relied on this we ended up adding random values and wrong checksums were created. Showed only up on machines with more than 4GB since gcc produced code where the registers that are used to pass 'saddr' and 'daddr' previously contained addresses before calling this function. Fix this by using 32 bit arithmetics and convert code to C, since gcc produces better code than these hand-optimized versions. Cc: Martin Schwidefsky Signed-off-by: Heiko Carstens commit 04439694ea82fed62a97fd474147966381201954 Author: Peter Oberparleiter Date: Mon Mar 26 20:42:38 2007 +0200 [S390] dasd: Work around gcc bug. gcc incorrectly removes initialization of register 0 in dasd diag inline assembly. Use different register to work around this compiler bug. Cc: Martin Schwidefsky Signed-off-by: Peter Oberparleiter Signed-off-by: Heiko Carstens commit d32b687e2e16e8174e88f186c3bae39a13e57b3d Author: Adrian Bunk Date: Mon Mar 5 02:49:48 2007 +0100 9p: make struct v9fs_cached_file_operations static This patch makes te needlessly global struct v9fs_cached_file_operations static. Signed-off-by: Adrian Bunk Signed-off-by: Eric Van Hensbergen commit 165de5b7f2719c1984956504128545839762d635 Author: G. Liakhovetski Date: Sun Mar 25 19:04:09 2007 -0700 [PPP]: Don't leak an sk_buff on interface destruction. Signed-off-by: G. Liakhovetski Acked-by: Paul Mackerras Signed-off-by: David S. Miller commit 035832a2806408ff209a0cb94bd64ea7dcf4d222 Author: Patrick McHardy Date: Sat Mar 24 22:13:25 2007 -0700 [NET_SCHED]: Fix ingress locking Ingress queueing uses a seperate lock for serializing enqueue operations, but fails to properly protect itself against concurrent changes to the qdisc tree. Use queue_lock for now since the real fix it quite intrusive. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit d3fa76ee6b4a8dd0efda4e78e96f5b19533b3dea Author: Patrick McHardy Date: Sat Mar 24 22:13:06 2007 -0700 [NET_SCHED]: cls_basic: fix NULL pointer dereference cls_basic doesn't allocate tp->root before it is linked into the active classifier list, resulting in a NULL pointer dereference when packets hit the classifier before its ->change function is called. Reported by Chris Madden Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit c93a882ebe673b5e6da0a70fd433f7517e032d23 Author: Adrian Bunk Date: Sat Mar 24 21:01:31 2007 -0700 [DCCP]: make dccp_write_xmit_timer() static again dccp_write_xmit_timer() needlessly became global. Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller commit 20bd7dd4cabfd0d6b6b70b99e88df901480a9841 Author: Michael Chan Date: Sat Mar 24 20:58:51 2007 -0700 [TG3]: Update version and reldate. Update version to 3.75. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit d18edcb212d7dc864a59e6aa9b6b9826299e0210 Author: Michael Chan Date: Sat Mar 24 20:57:11 2007 -0700 [TG3]: Exit irq handler during chip reset. On most tg3 chips, the memory enable bit in the PCI command register gets cleared during chip reset and must be restored before accessing PCI registers using memory cycles. The chip does not generate interrupt during chip reset, but the irq handler can still be called because of irq sharing or irqpoll. Reading a register in the irq handler can cause a master abort in this scenario and may result in a crash on some architectures. Use the TG3_FLAG_CHIP_RESETTING flag to tell the irq handler to exit without touching any registers. The checking of the flag is in the "slow" path of the irq handler and will not affect normal performance. The msi handler is not shared and therefore does not require checking the flag. Thanks to Bernhard Walle for reporting the problem. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit 1c46ae05d96f77f349ae60c799acb6ac6ddf07a8 Author: Michael Chan Date: Sat Mar 24 20:54:37 2007 -0700 [TG3]: Eliminate the unused TG3_FLAG_SPLIT_MODE flag. This flag to support multiple PCIX split completions was never used because of hardware bugs. This will make room for a new flag. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f11e6659ce9058928d73ff440f9b40a818d628ab Author: David S. Miller Date: Sat Mar 24 20:36:25 2007 -0700 [IPV6]: Fix routing round-robin locking. As per RFC2461, section 6.3.6, item #2, when no routers on the matching list are known to be reachable or probably reachable we do round robin on those available routes so that we make sure to probe as many of them as possible to detect when one becomes reachable faster. Each routing table has a rwlock protecting the tree and the linked list of routes at each leaf. The round robin code executes during lookup and thus with the rwlock taken as a reader. A small local spinlock tries to provide protection but this does not work at all for two reasons: 1) The round-robin list manipulation, as coded, goes like this (with read lock held): walk routes finding head and tail spin_lock(); rotate list using head and tail spin_unlock(); While one thread is rotating the list, another thread can end up with stale values of head and tail and then proceed to corrupt the list when it gets the lock. This ends up causing the OOPS in fib6_add() later onthat many people have been hitting. 2) All the other code paths that run with the rwlock held as a reader do not expect the list to change on them, they expect it to remain completely fixed while they hold the lock in that way. So, simply stated, it is impossible to implement this correctly using a manipulation of the list without violating the rwlock locking semantics. Reimplement using a per-fib6_node round-robin pointer. This way we don't need to manipulate the list at all, and since the round-robin pointer can only ever point to real existing entries we don't need to perform any locking on the changing of the round-robin pointer itself. We only need to reset the round-robin pointer to NULL when the entry it is pointing to is removed. The idea is from Thomas Graf and it is very similar to how this was implemented before the advanced router selection code when in. Signed-off-by: David S. Miller commit a979101106f549f4ed80d6dcbc35077be34d4346 Author: Thomas Graf Date: Sat Mar 24 20:33:27 2007 -0700 [DECNet] fib: Fix out of bound access of dn_fib_props[] Fixes a typo which caused fib_props[] to have the wrong size and makes sure the value used to index the array which is provided by userspace via netlink is checked to avoid out of bound access. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller commit a0ee18b9b7d3847976c6fb315c06a34fb296de0e Author: Thomas Graf Date: Sat Mar 24 20:32:54 2007 -0700 [IPv4] fib: Fix out of bound access of fib_props[] Fixes a typo which caused fib_props[] to have the wrong size and makes sure the value used to index the array which is provided by userspace via netlink is checked to avoid out of bound access. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller commit 954b2e7f4c37cbcdcf4ca7ac47524f3f6bf30119 Author: Ralf Baechle Date: Sat Mar 24 12:54:26 2007 -0700 [NET] AX.25 Kconfig and docs updates and fixes o The AX.25 Howto is unmaintained since several years. I've replaced it with a wiki at http://www.linux-ax25.org which provides more uptodate information. o Change default for AX25_DAMA_SLAVE to Y. AX25_DAMA_SLAVE only compiles in support for DAMA but doesn't activate it. I hope this gets Linux distributions to ship their AX.25 kernels with AX25_DAMA_SLAVE enabled. The price for this would be very small. o Delete historic changelog from comments, that's what SCM systems are meant to do. o ---help--- in Kconfig looks so yellingly eye insulting. Use just help. o Rewrite the commented out piece of old Linux 2.4 configuration language to Kconfig for consistency. o Fixup dependencies. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit ecbb416939da77c0d107409976499724baddce7b Author: Alexey Kuznetsov Date: Sat Mar 24 12:52:16 2007 -0700 [NET]: Fix neighbour destructor handling. ->neigh_destructor() is killed (not used), replaced with ->neigh_cleanup(), which is called when neighbor entry goes to dead state. At this point everything is still valid: neigh->dev, neigh->parms etc. The device should guarantee that dead neighbor entries (neigh->dead != 0) do not get private part initialized, otherwise nobody will cleanup it. I think this is enough for ipoib which is the only user of this thing. Initialization private part of neighbor entries happens in ipib start_xmit routine, which is not reached when device is down. But it would be better to add explicit test for neigh->dead in any case. Signed-off-by: David S. Miller commit e1701c68c1d1aeb3213d7016593ea9a1d4309417 Author: Thomas Graf Date: Sat Mar 24 12:46:02 2007 -0700 [NET]: Fix fib_rules compatibility breakage Based upon a patch from Patrick McHardy. The fib_rules netlink attribute policy introduced in 2.6.19 broke userspace compatibilty. When specifying a rule with "from all" or "to all", iproute adds a zero byte long netlink attribute, but the policy requires all addresses to have a size equal to sizeof(struct in_addr)/sizeof(struct in6_addr), resulting in a validation error. Check attribute length of FRA_SRC/FRA_DST in the generic framework by letting the family specific rules implementation provide the length of an address. Report an error if address length is non zero but no address attribute is provided. Fix actual bug by checking address length for non-zero instead of relying on availability of attribute. Signed-off-by: Thomas Graf Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 5f85813c33ddbf6d11ccfdbcc01f176e24a76bd2 Author: Sridhar Samudrala Date: Fri Mar 23 11:39:51 2007 -0700 [SCTP]: Update SCTP Maintainers entry Add Vlad Yasevich as the primary maintainer of SCTP and add a link to the project website. Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit ea3d0d77086d2c2fbe73adcc1ad075ce1f5be0e0 Author: Robert P. J. Day Date: Thu Mar 22 23:35:08 2007 -0700 [NET]: remove unused header file: drivers/net/wan/lmc/lmc_media.h Signed-off-by: Robert P. J. Day Cc: Krzysztof Halasa Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit e0f2e3a06be513352cb4955313ed7e55909acd84 Author: Linus Torvalds Date: Sun Mar 25 15:56:23 2007 -0700 Linux 2.6.21-rc5 .. hopefully most of the fallout of the timer changes is contained now. Signed-off-by: Linus Torvalds commit 948ac6d71cf868b431adb3139d8dfbd9c4e4a6ca Author: Thomas Gleixner Date: Sun Mar 25 14:42:51 2007 +0200 [PATCH] clocksource: Fix thinko in watchdog selection The watchdog implementation excludes low res / non continuous clocksources from being selected as a watchdog reference unintentionally. Allow using jiffies/PIT as a watchdog reference as long as no better clocksource is available. This is necessary to detect TSC breakage on systems, which have no pmtimer/hpet. The main goal of the initial patch (preventing to switch to highres/nohz when no reliable fallback clocksource is available) is still guaranteed by the checks in clocksource_watchdog(). Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 9501b6cf5541f0d576d566a463f1e7d3eaaab4eb Author: Thomas Gleixner Date: Sun Mar 25 14:31:17 2007 +0200 [PATCH] dynticks: fix hrtimer rounding error in next_timer_interrupt The rework of next_timer_interrupt() fixed the timer wheel bugs, but invented a rounding error versus the next hrtimer event. This is caused by the conversion of the hrtimer internal representation to relative jiffies. This causes bug #8100: http://bugzilla.kernel.org/show_bug.cgi?id=8100 next_timer_interrupt() returns "now" in such a case and causes the code in tick_nohz_stop_sched_tick() to trigger the timer softirq, which is bogus as no timer is due for expiry. This results in an endless context switching between idle and ksoftirqd until a timer is due for expiry. Modify the hrtimer evaluation so that, it returns now + 1, when the conversion results in a delta < 1 jiffie. It's confirmed to resolve bug #8100 Reported-by: Emil Karlson Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 0fa7d868ca456ddf4f41b700fd9dee186f8f4e12 Author: Patrick Ringl Date: Sat Mar 24 23:56:58 2007 +0100 [PATCH] fix typos in net/ieee80211/Kconfig This is just a QA / cosmetic fix .. [ "a modules" => "a module" ] Signed-off-by: Linus Torvalds commit f5ae29e284b328e0976789d5c199bbbe80e4b005 Author: Michael Krufky Date: Sat Mar 24 13:21:53 2007 -0400 [PATCH] cx88-dvb: fix nxt200x rf input switching After dvb tuner refactoring, the pllbuff has been altered such that the pll address is now stored in buf[0]. Instead of sending buf to set_pll_input, we should send buf+1. Signed-off-by: Michael Krufky Cc: Mauro Carvalho Chehab Cc: Ivan Andrewjeski Signed-off-by: Linus Torvalds commit 53698d2537bc8c2b8fedc788b8b927da9a004f9b Author: Guennadi Liakhovetski Date: Thu Mar 22 13:06:55 2007 +0100 [ARM] 4278/1: configure pxa27x I2C SCL as "input" It has been reported by Julian Deng that configuring the pxa27x i2c SCL line as output generates a short negative pulse on it during the call to pxa_gpio_mode(GPIO117_I2CSCL_MD); as it first switches it to output and then configures it for the alternate function. The SCL line is in fact bidirectional and can also be configured as 117 | GPIO_ALT_FN_1_IN, in which case the pulse is not generated. This is exactly what this patch does. Author: Julian Deng Signed-off-by: G. Liakhovetski Signed-off-by: Russell King commit d9a5c0a4e0b4c84850a1a5bbacba3f7858b67037 Author: Thomas Gleixner Date: Sat Mar 24 23:02:49 2007 +0100 [PATCH] i386: Prevent early access to TSC to avoid crash on TSCless systems commit f9690982b8c2f9a2c65acdc113e758ec356676a3 removed the check for cpu_khz from sched_clock(), which prevented early access to the TSC by non obvious magic. This is harmless as long as the CPU has a TSC. On TSCless systems this results in an illegal instruction trap. Replace tsc_disabled and tsc_unstable by tsc_enabled, which is only set when the tsc is available and not unstable. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 8fb303c7f1118b0a82aa08e33429adf9b5ad192c Author: Ralf Baechle Date: Sat Mar 24 14:26:13 2007 +0000 [MIPS] SB1250: Fix bugs/warnings by creative use of volatile. Signed-off-by: Ralf Baechle commit 41a8198f61d858bcad7ef705d5d3ec3e3a8dea4a Author: Ralf Baechle Date: Sat Mar 24 14:09:59 2007 +0000 [MIPS] SB1: Fix pile of gcc's bogus format string warnings. CC arch/mips/mm/cerr-sb1.o arch/mips/mm/cerr-sb1.c: In function 'sb1_cache_error': arch/mips/mm/cerr-sb1.c:235: warning: format '%010llx' expects type 'long long unsigned int', but argument 2 has type 'uint64_t' arch/mips/mm/cerr-sb1.c: In function 'extract_ic': arch/mips/mm/cerr-sb1.c:385: warning: format '%016llx' expects type 'long long unsigned int', but argument 3 has type 'uint64_t' arch/mips/mm/cerr-sb1.c:385: warning: format '%016llX' expects type 'long long unsigned int', but argument 6 has type 'uint64_t' arch/mips/mm/cerr-sb1.c: In function 'extract_dc': arch/mips/mm/cerr-sb1.c:523: warning: format '%010llx' expects type 'long long unsigned int', but argument 3 has type 'uint64_t' arch/mips/mm/cerr-sb1.c:523: warning: format '%016llX' expects type 'long long unsigned int', but argument 7 has type 'uint64_t' arch/mips/mm/cerr-sb1.c:570: warning: format '%016llX' expects type 'long long unsigned int', but argument 3 has type 'uint64_t' LD arch/mips/mm/built-in.o Signed-off-by: Ralf Baechle commit bf9f88a2192aaee6f1bbff50175aa68ff107355e Author: Ralf Baechle Date: Sat Mar 24 13:28:58 2007 +0000 [MIPS] Jazz: Fix warning. arch/mips/jazz/jazzdma.c:70: warning: assignment makes integer from pointer without a cast Signed-off-by: Ralf Baechle commit e007566d138167f325a4f382bdb93e5d6552f86c Author: Ralf Baechle Date: Sat Mar 24 13:20:15 2007 +0000 [MIPS] R3000: local_flush_data_cache_page take a pointer argument. Signed-off-by: Ralf Baechle commit ce486cd810a42572a91cada0be2538e433715449 Author: Ralf Baechle Date: Sat Mar 24 13:06:43 2007 +0000 [MIPS] ARC: Fix warning. The missing cast did result a warning when calling an 32-bit ARC firmware function that takes 5 arguments where the 5th argument is a pointer from a 64-bit kernel. Signed-off-by: Ralf Baechle commit 7575a49f209190ca640e0da792565a1bcb641f3e Author: Ralf Baechle Date: Fri Mar 23 21:36:37 2007 +0000 [MIPS] Implement flush_anon_page(). Signed-off-by: Ralf Baechle commit 80e89593e5a574a572f4e45e157733b5ea5ddfdb Author: Atsushi Nemoto Date: Wed Mar 21 00:56:28 2007 +0900 [MIPS] SPARSEMEM: The first pfn of zone should be min_low_pfn, not 0. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit 7605b3906192a171e651076325b1ed1d5ea57ec9 Author: Ralf Baechle Date: Tue Mar 20 13:56:50 2007 +0000 [MIPS] Fix pipeline hazard. In the the sequence: ei .. mfc0 $x, $status the mfc0 may not see the SR_IE bit set. This was a deliberate bug in the kernel code because we knew this was a safe thing to do on all R2 silicon so far but new silicon is changing this. Signed-off-by: Ralf Baechle commit 83598f1cb06101e972b1f5aaf3408eb729622fa8 Author: Deepak Saxena Date: Mon Mar 19 16:49:45 2007 -0700 [MIPS] Make MIPS udelay() preempt safe under DEBUG_PREEMPT Signed-off-by: Manish Lachwani Signed-off-by: Deepak Saxena Signed-off-by: Ralf Baechle commit c9d06962233bd0ce9bf46b007900eb88e716e948 Author: Franck Bui-Huu Date: Mon Mar 19 17:36:42 2007 +0100 [MIPS] Always use virt_to_phys() when translating kernel addresses This patch fixes two places where we used plain 'x - PAGE_OFFSET' to achieve virtual to physical address convertions. This type of convertion is no more allowed since commit 6f284a2ce7b8bc49cb8455b1763357897a899abb. Reported-by: Maxime Bizon Signed-off-by: Franck Bui-Huu [Build fixes for machines that don't use the generic dma-coherence.h] Signed-off-by: Ralf Baechle commit f33bc55c472295966e520c9347822fdd8b1082cd Author: Thomas Gleixner Date: Fri Mar 23 17:14:37 2007 -0700 [PATCH] x86_64: avoid sending LOCAL_TIMER_VECTOR IPI to itself Ray Lee reported, that on an UP kernel with "noapic" command line option set, the box locks hard during boot. Adding some debug printks revealed, that the last action on the box before stalling was "Send IPI" - a debug printk which was put into smp_send_timer_broadcast_ipi(). It seems that send_IPI_mask(mask, LOCAL_TIMER_VECTOR) fails when "noapic" is set on the command line on an UP kernel. Aside of that it does not make much sense to trigger an interrupt instead of calling the function directly on the CPU which gets the PIT/HPET interrupt in case of broadcasting. Reported-by: Ray Lee Signed-off-by: Thomas Gleixner Acked-by: Ray Lee Signed-off-by: Linus Torvalds commit 6ea65ff79ceb36a1195761be857da1fdf9878450 Author: Roland McGrath Date: Fri Mar 23 14:26:33 2007 -0700 [PATCH] i386: clear segment register padding in core dumps The segment register slots in struct pt_regs are padded to 32 bits. Some of these are stored with instructions like "pushl %es", which leaves the high 16 bits as they were. So the high bits of these fields in struct pt_regs contain kernel stack garbage. These bits are ignored by everything and never leak to user space, except in core dumps. The user struct pt_regs is always at the base of the thread's kernel stack and so it seems unlikely the information that leaks from here is ever worthwhile so as to be a security concern, but I'm not sure about that. It has been this way for ages; userland consumers of core dumps all mask off these high bits themselves. So it is not urgent. This change masks off the padding bits of the segment register slots in core dumps. ptrace already masks off these high bits, so this makes the values in core dumps consistent with what ptrace would report just before the process died. As I read the processor manuals, the cs and ss values will always be padded with zero bits rather than stack garbage. But unlike "pushl %es", this is not simple to test with a userland program. So I added the two instructions rather than wonder if they are really never necessary. I think that x86_64 does not have this problem (for either 32-bit or 64-bit processes). It only uses "mov" instructions from segment registers, which zero-extend. Signed-off-by: Roland McGrath Signed-off-by: Linus Torvalds commit 2e7c28382b8426c6b7ac6f147177a664065f95f4 Author: Linus Torvalds Date: Fri Mar 23 11:32:31 2007 -0700 x86-64: add "local_apic_timer_c2_ok" here too Needed for any architecture that claims ARCH_APICTIMER_STOPS_ON_C3, not just i386. I'm hoping Thomas will clean this up a bit later.. Signed-off-by: Linus Torvalds commit 105fd108a66ceff2b0fb710582b97d61ee4c9d40 Author: Andrew Morton Date: Fri Mar 23 00:10:02 2007 -0700 [PATCH] "ext[34]: EA block reference count racing fix" performance fix A little mistake in 8a2bfdcbfa441d8b0e5cb9c9a7f45f77f80da465 is making all transactions synchronous, which reduces ext3 performance to comical levels. Cc: Mingming Cao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cee9e8c5cb1554e9e85ad764d27b6c808555ed89 Author: Guido Guenther Date: Fri Mar 23 00:10:01 2007 -0700 [PATCH] rivafb: fix initial brightness This is the rivafb equivalent of 238576e12fef1d52751c6e08db2d0bdb0e248caf. It fixes rivafb having a default backlight brightness of 0 (no picture at all) on a PBook 6,1. Signed-off-by: Guido Guenther Cc: "Antonino A. Daplas" Acked-by: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6149dd5cfaea9889060f2c039eaf45e2b39f7fb3 Author: Danny Kukawka Date: Fri Mar 23 00:10:01 2007 -0700 [PATCH] add Fujitsu Siemens Tablet PC devices to 8250_pnp.c Adds device ids of two Fujitsu Siemens Tablet PCs to pnp_dev_table Signed-off-by: Danny Kukawka Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit aa289b47231c95abe53a75223906fdfb79ae368e Author: David Howells Date: Fri Mar 23 00:10:00 2007 -0700 [PATCH] FDPIC: fix the /proc/pid/stat representation of executable boundaries Fix the /proc/pid/stat representation of executable boundaries. It should show the bounds of the executable, but instead shows the bounds of the loader. Before the patch is applied, the bug can be seen by examining, say, inetd: # ps | grep inetd 610 root 0 S /usr/sbin/inetd -i # cat /proc/610/maps c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3180000-c31dede4 r-xs 00000000 00:0b 14582179 /lib/libuClibc-0.9.28.so c328c000-c328ea00 rw-p 00008000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3290000-c329b6c0 rw-p 00000000 00:00 0 c32a0000-c32c0000 rwxp 00000000 00:00 0 c32d4000-c32d8000 rw-p 00000000 00:00 0 c3394000-c3398000 rw-p 00000000 00:00 0 c3458000-c345f464 r-xs 00000000 00:0b 16384612 /usr/sbin/inetd c3470000-c34748f8 rw-p 00004000 00:0b 16384612 /usr/sbin/inetd c34cc000-c34d0000 rw-p 00000000 00:00 0 c34d4000-c34d8000 rw-p 00000000 00:00 0 c34d8000-c34dc000 rw-p 00000000 00:00 0 # cat /proc/610/stat 610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 8 0 0 19 0 1 0 94392000718 950272 0 4294967295 3233480704 3233523592 3274440352 3274439976 3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0 The code boundaries are 3233480704 to 3233523592, which are: (gdb) p/x 3233480704 $1 = 0xc0bb0000 (gdb) p/x 3233523592 $2 = 0xc0bba788 Which corresponds to this line in the maps file: c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so Which is wrong. After the patch is applied, the maps file is pretty much identical (there's some minor shuffling of the location of some of the anonymous VMAs), but the stat file is now: # cat /proc/610/stat 610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 7 0 0 18 0 1 0 94392000722 950272 0 4294967295 3276111872 3276141668 3274440352 3274439976 3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0 The code boundaries are then 3276111872 to 3276141668, which are: (gdb) p/x 3276111872 $1 = 0xc3458000 (gdb) p/x 3276141668 $2 = 0xc345f464 And these correspond to this line in the maps file instead: c3458000-c345f464 r-xs 00000000 00:0b 16384612 /usr/sbin/inetd Which is now correct. Signed-off-by: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0444b3035e5f4981f4d1d96f9f0c3cbada1e6d69 Author: James Morris Date: Fri Mar 23 00:09:58 2007 -0700 [PATCH] time: fix formatting in /proc/timer_list Fix the print formatting of three unsigned long fields in /proc/timer_list, which are currently being formatted as signed long. Signed-off-by: James Morris Acked-by: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e585bef815c0315f2730d7bb4e15b82602454efd Author: Thomas Gleixner Date: Fri Mar 23 16:08:01 2007 +0100 [PATCH] i386: add command line option "local_apic_timer_c2_ok" It turned out that it is almost impossible to trust ACPI, BIOS & Co. regarding the C states. This was the reason to switch the local apic timer off in C2 state already. OTOH there are sane and well behaving systems, which get punished by that decision. Allow the user to confirm that the local apic timer is trustworthy in C2 state. This keeps the default behaviour on the safe side. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 296d93cd0205433489b0689533426ce0a8cf2dec Author: Linus Torvalds Date: Fri Mar 23 08:03:47 2007 -0700 Revert "ACPI: Only use IPI on known broken machines (AMD, Dothan/BaniasPentium M)" This reverts commit 25496caec111481161e7f06bbfa12a533c43cc6f, which broke bootup on at least Ingo's ThinkPad T60. Need to figure out exactly what is wrong before we can re-do the logic. Requested-by: Ingo Molnar Acked-by: Thomas Gleixner Cc: Thomas Renninger Cc: Len Brown Signed-off-by: Linus Torvalds commit 7a9eeb2fa1b3a3a83670b9ba08dd396beedb88f8 Author: Stefan Richter Date: Tue Mar 20 22:43:22 2007 +0100 ieee1394: fix oops on "modprobe -r ohci1394" after network class_device conversion The networking subsystem has been converted from class_device to device but ieee1394 hasn't. This results in a 100% reproducible NULL pointer dereference if the ohci1394 driver module is unloaded while the eth1394 module is still loaded. http://lkml.org/lkml/2006/11/16/147 http://lkml.org/lkml/2007/3/14/4 This is a regression in 2.6.21-rc1. Signed-off-by: Stefan Richter Tested-by: Ismail Dönmez commit 991b5557f7f04602b3b161341dee85971e0b6be6 Author: Jeff Garzik Date: Fri Mar 23 02:03:29 2007 -0400 [netdrvr] ewrk3: correct card detection bug Arwin Vosselman pointed out: > The ewrk3-driver doesn't function with 2.6.16-kernels (used 2.6.16.41 for > my tests). Cards will never be detected due to this bug. > > drivers/net/ewrks3.c: > Line 417 reads: > > if (nicsr == (CSR_TXD | CSR_RXD)) > > that should be: > > if (nicsr != (CSR_TXD | CSR_RXD)) > > Comparison with the same line in v2.4 shows why: > > 2.4: > if (nicsr == (CSR_TXD | CSR_RXD)){ > > blah, blah > ========== > 2.6: > if (nicsr == (CSR_TXD | CSR_RXD)) > return -ENXIO; > > blah, blah > ========== > > blah,blah will not, but should, be executed in 2.6 with a card being present. > > The fix mentioned above solves this bug. Signed-off-by: Jeff Garzik commit 194c1fbe43af532a7921d483bc2a553b2f361256 Author: Divy Le Ray Date: Wed Mar 21 19:21:00 2007 -0700 cxgb3 - fix white spaces in drivers/net/Kconfig Use tabs instead of white spaces for CHELSIO_T3 entry. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 2ea34672f8cec20b22ccb6ba78e3fe61b44e734a Author: Brice Goglin Date: Wed Mar 21 19:47:32 2007 +0100 myri10ge: update driver version to 1.3.0-1.226 Driver version is now 1.3.0-1.226. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit b52a8b7f0aeff5b91921cd53728ac781cdb4cccf Author: Brice Goglin Date: Wed Mar 21 19:46:57 2007 +0100 myri10ge: fix management of >4kB allocated pages Fix management of allocated physical pages when the architecture page size is not 4kB since the firmware cannot cross 4K boundary. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit f761fae1ae1e6e35ae15fce99d225d08d6cff1e7 Author: Brice Goglin Date: Wed Mar 21 19:45:56 2007 +0100 myri10ge: update wcfifo and intr_coal_delay default values Update the default value of 2 module parameters: * wcfifo disabled * intr_coal_delay 75us Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit aafa70eb56edd1cd5332c978bf9b5e224373c980 Author: Brice Goglin Date: Wed Mar 21 19:45:18 2007 +0100 myri10ge: Serverworks HT2100 provides aligned PCIe completion [PATCH 1/4] myri10ge: Serverworks HT2100 provides aligned PCIe completion Use the regular firmware on Serverworks HT2100 PCIe ports since this chipset provides aligned PCIe completion. Signed-off-by: Brice Goglin Signed-off-by: Jeff Garzik commit d57ab6fdde30816581f7b0a4fe3c015b3f41f9ca Author: Dale Farnsworth Date: Tue Mar 20 16:38:04 2007 -0700 mv643xx_eth: add mv643xx_eth_shutdown function mv643xx_eth_shutdown is needed for kexec. Signed-off-by: Dale Farnsworth Signed-off-by: Jeff Garzik commit 69a43ac0cf40577157111bbe25500e2b98e801ea Author: Ralf Baechle Date: Tue Mar 20 12:40:09 2007 +0000 SAA9730: Fix large pile of warnings The SAA9730 driver doesn't quite grok what the difference between an ioport and memory mapped I/O is. It just happened to work on the one Linux system the SAA9730 happens to spend it's misserable existence on. drivers/net/saa9730.c: In function 'evm_saa9730_enable_lan_int': drivers/net/saa9730.c:68: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:70: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:72: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'evm_saa9730_disable_lan_int': drivers/net/saa9730.c:78: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:80: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'evm_saa9730_clear_lan_int': drivers/net/saa9730.c:85: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'evm_saa9730_block_lan_int': drivers/net/saa9730.c:91: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'evm_saa9730_unblock_lan_int': drivers/net/saa9730.c:97: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'show_saa9730_regs': drivers/net/saa9730.c:150: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_allocate_buffers': drivers/net/saa9730.c:292: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:295: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:302: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:305: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:312: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_cam_load': drivers/net/saa9730.c:329: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:332: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_mii_init': drivers/net/saa9730.c:369: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:395: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:403: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:410: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:432: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_control_init': drivers/net/saa9730.c:470: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:474: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:478: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:484: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:487: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:490: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:493: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_stop': drivers/net/saa9730.c:505: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:508: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:510: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_dma_init': drivers/net/saa9730.c:536: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_start': drivers/net/saa9730.c:556: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:560: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:564: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:567: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_tx': drivers/net/saa9730.c:590: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_rx': drivers/net/saa9730.c:664: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:729: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_write': drivers/net/saa9730.c:848: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c: In function 'lan_saa9730_set_multicast': drivers/net/saa9730.c:943: warning: passing argument 2 of 'outl' makes integer from pointer without a cast drivers/net/saa9730.c:949: warning: passing argument 2 of 'outl' makes integer from pointer without a cast Fixed by using writel instead of outl. 42 warnings less. Signed-off-by: Ralf Baechle Signed-off-by: Jeff Garzik commit 6f6881b846e3d97ee15f6ab1f6529cd1cc2f4c28 Author: Li Yang Date: Mon Mar 19 11:58:02 2007 +0800 Revert "ucc_geth: returns NETDEV_TX_BUSY when BD ring is full" This reverts commit 18babd38547a042a4bfd4154a014d1ad33373eb0. Michael Barkowski points out that it's wrong, and I agree. The patch causes a problem rather than fixes one after another patch "ucc_geth: Fix BD processing" was applied. Before that patch, current packet should be blocked. However after the patch current packet is ok and we only need to block next. Reported-by: Michael Barkowski Signed-off-by: Li Yang Signed-off-by: Jeff Garzik commit e4d08359ffb6580ee7a014d162162b2d18aa4ec0 Author: Divy Le Ray Date: Sun Mar 18 13:10:17 2007 -0700 cxgb3 - T3B2 pcie config space T3B2 does not lose its pcie config space on reset. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit fc90664e3438c990d280f179ccb0642711d5c553 Author: Divy Le Ray Date: Sun Mar 18 13:10:12 2007 -0700 cxgb3 - Fix potential MAC hang Under rare conditions, the MAC might hang while generating a pause frame. This patch fine tunes the MAC settings to avoid the issue, allows for periodic MAC state check, and triggers a recovery if hung. Also fix one MAC statistics counter for the rev board T3B2. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 2e2839627a957714808f98a802d137a7a2a1df46 Author: Divy Le Ray Date: Sun Mar 18 13:10:06 2007 -0700 cxgb3 - Auto-load FW if mismatch detected The driver attempts to upgrade the FW if the card has the wrong version. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 05b97b30b09ed245d376035cddf669532e5cca67 Author: Divy Le Ray Date: Sun Mar 18 13:10:01 2007 -0700 cxgb3 - fix ethtool cmd on multiple queues port Limit ethtool -g/-G to the given port's queues. Signed-off-by: Divy Le Ray Signed-off-by: Jeff Garzik commit 5c4851ccb6b12ff29e28b84e7515a18006b19fdf Author: Anton Blanchard Date: Fri Mar 16 17:00:21 2007 -0500 Fix return code in pci-skeleton.c We assign the return value of register_netdev to i, but return rc later on. Fix it. Signed-off-by: Anton Blanchard Signed-off-by: Jeff Garzik commit 9cbe330f1fbbc8de15a5914aa6e91d89eb9daac4 Author: Stephen Hemminger Date: Fri Mar 16 14:01:28 2007 -0700 skge: use per-port phy locking Rather than a workqueue and a per-board mutex to control PHY, use a tasklet and spinlock. Tasklet is lower overhead and works just as well for this. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 4ebabfcb1d6af5191ef5c8305717ccbc24979f6c Author: Stephen Hemminger Date: Fri Mar 16 14:01:27 2007 -0700 skge: mask irqs when device down Wheen a port on the skge driver is not used, it should mask off interrupts from theat port. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit e3a1b99fb60dab1b39d5022d1d8f47bebfe6d8c6 Author: Stephen Hemminger Date: Fri Mar 16 14:01:26 2007 -0700 skge: deadlock on tx timeout The skge driver will deadlock if gets a transmit timeout because the netif_tx_lock() is already held. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 4edc5db83f574dfcc8be35b7b96760ded543b360 Author: Ingo Molnar Date: Thu Mar 22 10:31:19 2007 +0100 [PATCH] setup_boot_APIC_clock() irq-enable fix latest -git triggers an irqtrace/lockdep warning of a leaked irqs-off condition: BUG: at kernel/fork.c:1033 copy_process() after some debugging it turns out that commit ca1b940c accidentally left interrupts disabled - which trickled down all the way to the first time we fork a kernel thread and triggered the warning. the fix is to re-enable interrupts in the 'else' branch of setup_boot_APIC_clock()'s pmtimers calibration path. Reported-by: Michal Piotrowski Signed-off-by: Ingo Molnar Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 9c35dd7f8bda1849dcb430be99325504221048df Author: Jarek Poplawski Date: Thu Mar 22 00:11:28 2007 -0800 [PATCH] lockdep: debug_show_all_locks & debug_show_held_locks vs. debug_locks lockdep's data shouldn't be used when debug_locks == 0 because it's not updated after this, so it's more misleading than helpful. PS: probably lockdep's current-> fields should be reset after it turns debug_locks off: so, after printing a bug report, but before return from exported functions, but there are really a lot of these possibilities (e.g. after DEBUG_LOCKS_WARN_ON), so, something could be missed. (Of course direct use of this fields isn't recommended either.) Reported-by: Folkert van Heusden Inspired-by: Oleg Nesterov Signed-off-by: Jarek Poplawski Acked-by: Peter Zijlstra Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b43376927ab0f7b64c4fb304568ecfaea10446e2 Author: Rafael J. Wysocki Date: Thu Mar 22 00:11:27 2007 -0800 [PATCH] Make XFS workqueues nonfreezable Since freezable workqueues are broken in 2.6.21-rc (cf. http://marc.theaimsgroup.com/?l=linux-kernel&m=116855740612755, http://marc.theaimsgroup.com/?l=linux-kernel&m=117261312523921&w=2) it's better to change the only user of them, which is XFS, to use "normal" nonfreezable workqueues. Signed-off-by: Rafael J. Wysocki Cc: Pavel Machek Cc: David Chinner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e3a55fd18deab758a2970e0dfcd60a677a920426 Author: Jarek Poplawski Date: Thu Mar 22 00:11:26 2007 -0800 [PATCH] lockdep: lockdep_depth vs. debug_locks lockdep found a bug during a run of workqueue function - this could be also caused by a bug from other code running simultaneously. lockdep really shouldn't be used when debug_locks == 0! Reported-by: Folkert van Heusden Inspired-by: Oleg Nesterov Signed-off-by: Jarek Poplawski Cc: Ingo Molnar Acked-by: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 058560fbd70190ea6b50b5df4d814bc30911d06b Author: Pavel Machek Date: Thu Mar 22 00:11:25 2007 -0800 [PATCH] fix extra BIOS invocation during resume It causes extra moon icons blinking on x60, and breaks at least two other systems. During resume, we do not know that "reboot"/"shutdown" method was used, so we assume "plaform" and call BIOS, anyway... This is 2.6.21 material, and should fix 2 or 3 regressions from 2.6.20. Signed-off-by: Pavel Machek Acked-by: "Rafael J. Wysocki" Cc: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 165b239270be610a1e3999cb0d2e4e2c1f2a8fd4 Author: David Howells Date: Thu Mar 22 00:11:24 2007 -0800 [PATCH] NOMMU: make SYSV SHM nattch work correctly Make the SYSV SHM nattch counter work correctly by forcing multiple VMAs to be produced to represent MAP_SHARED segments, even if they overlap exactly. Using this test program: http://people.redhat.com/~dhowells/doshm.c Run as: doshm sysv I can see nattch going from one before the patch: # /doshm sysv Command: sysv shmid: 65536 memory: 0xc3700000 c0b00000-c0b04000 rw-p 00000000 00:00 0 c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3180000-c31dede4 r-xs 00000000 00:0b 14582179 /lib/libuClibc-0.9.28.so c3520000-c352278c rw-p 00000000 00:0b 13763417 /doshm c3584000-c35865e8 r-xs 00000000 00:0b 13763417 /doshm c3588000-c358aa00 rw-p 00008000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3590000-c359b6c0 rw-p 00000000 00:00 0 c3620000-c3640000 rwxp 00000000 00:00 0 c3700000-c37fa000 rw-S 00000000 00:06 1411 /SYSV00000000 (deleted) c3700000-c37fa000 rw-S 00000000 00:06 1411 /SYSV00000000 (deleted) nattch 1 To two after the patch: # /doshm sysv Command: sysv shmid: 0 memory: 0xc3700000 c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3180000-c31dede4 r-xs 00000000 00:0b 14582179 /lib/libuClibc-0.9.28.so c3320000-c3340000 rwxp 00000000 00:00 0 c3530000-c35325e8 r-xs 00000000 00:0b 13763417 /doshm c3534000-c353678c rw-p 00000000 00:0b 13763417 /doshm c3538000-c353aa00 rw-p 00008000 00:0b 14582157 /lib/ld-uClibc-0.9.28.so c3590000-c359b6c0 rw-p 00000000 00:00 0 c35a4000-c35a8000 rw-p 00000000 00:00 0 c3700000-c37fa000 rw-S 00000000 00:06 1369 /SYSV00000000 (deleted) c3700000-c37fa000 rw-S 00000000 00:06 1369 /SYSV00000000 (deleted) nattch 2 That's +1 to nattch for each shmat() made. Signed-off-by: David Howells Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d56e03cd275486eb8141116a7af2df7457cb0115 Author: David Howells Date: Thu Mar 22 00:11:23 2007 -0800 [PATCH] NOMMU: supply get_unmapped_area() to fix NOMMU SYSV SHM Supply a get_unmapped_area() to fix NOMMU SYSV SHM support. Signed-off-by: David Howells Acked-by: Adam Litke Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8da38d7bac802ed2a09a79aaae9961c806a1847c Author: David Howells Date: Thu Mar 22 00:11:22 2007 -0800 [PATCH] FRV: fix unannotated variable declarations Fix unannotated variable declarations. Variables that have allocation section annotations (such as __meminitdata) on their definitions must also have them on their declarations as not doing so may affect the addressing mode used by the compiler and may result in a linker error. Signed-off-by: David Howells Acked-by: Yasunori Goto Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ad62ca2bd89f72e9b80dfaffc463e87bec5e75cb Author: Thomas Gleixner Date: Thu Mar 22 00:11:21 2007 -0800 [PATCH] i386: disable local apic timer via command line or dmi quirk The local APIC timer stops to work in deeper C-States. This is handled by the ACPI code and a broadcast mechanism in the clockevents / tick managment code. Some systems do not expose the deeper C-States to the kernel, but switch into deeper C-States behind the kernels back. This delays the local apic timer interrupts for ever and makes the systems unusable. Add a command line option to disable the local apic timer and a dmi quirk for known broken systems. Andi sayeth: While not wrong by itself i think it is still better to use some heuristic -- like "has battery in ACPI" With the DMI table if the problem is more wide spread we will just continue extending it. But anyways should be ok now for .21 although I'm not really happy with it. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: john stultz Grudgingly-acked-by: Andi Kleen Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 93c9a7ff50a5b39dbdf80129c5da89e6d6256bea Author: Rafael J. Wysocki Date: Thu Mar 22 00:11:20 2007 -0800 [PATCH] swsusp: Fix SNAPSHOT_S2RAM ioctl The SNAPSHOT_S2RAM ioctl does not disable the nonboot CPUs before entering the suspend, although it should do this. Signed-off-by: Rafael J. Wysocki Acked-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit acf11faeb1ba1179f695c83c47716e4f6ffdebd8 Author: Johannes Weiner Date: Thu Mar 22 00:11:18 2007 -0800 [PATCH] Documentation/sysrq.txt: added short description for 'Q' (timerlist) I added the 'Q' to list. A short description in the `Ok, so what can I use them for'-section, on when or why to use it would be nice! Signed-off-by: Johannes Weiner Cc: Ingo Molnar Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 47ebea8351061f763089f6c3e2d2403715b510e1 Author: Adrian Bunk Date: Thu Mar 22 00:11:16 2007 -0800 [PATCH] drivers/video/s3fb.c: fix a use-before-check NULL checks should be before the first dereference. Spotted by the Coverity checker. Signed-off-by: Adrian Bunk Acked-by: Ondrej Zajicek Cc: "Antonino A. Daplas" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6b3964cde70cfe6db79d35b42137431ef7d2f7e4 Author: Thomas Gleixner Date: Thu Mar 22 22:46:18 2007 +0100 [PATCH] i386: clockevents fix breakage on Geode/Cyrix PIT implementations The PIT has no dedicated mode for shut down. The only way to disable PIT is to put it into one shot mode. AMD implementations of PIT on Geode (also observed on Cyrix) are confused by an "empty" transition from CLOCK_EVT_MODE_UNUSED to CLOCK_EVT_MODE_SHUTDOWN, which puts the PIT into one shot mode momentarily. I realized after staring helpless at the bug report http://bugzilla.kernel.org/show_bug.cgi?id=8027 for quite a while, that the only change, which might influence the bogomips calibration, is the above transition during the PIT initialization. Avoiding the unnecessary switch to oneshot and later to periodic mode fixes the weird bogomips value and also the resulting slowness. The fix is confirmed on OLPC and another Geode based box. Note: this is unrelated to the Dual Core problem discussed here: http://lkml.org/lkml/2007/3/17/48 Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 066fcb06d3e27c258bc229bb688ced2b16daa6c2 Author: Steve French Date: Fri Mar 23 00:45:08 2007 +0000 [CIFS] Allow reset of file to ATTR_NORMAL when archive bit not set When a file had a dos attribute of 0x1 (readonly - but dos attribute of archive was not set) - doing chmod 0777 or equivalent would try to set a dos attribute of 0 (which some servers ignore) rather than ATTR_NORMAL (0x20) which most servers accept. Does not affect servers which support the CIFS Unix Extensions. Acked-by: Prasad Potluri Acked-by: Shirish Pargaonkar Signed-off-by: Steve French commit 77d8e1efea0e313edc710160c232a6fd2dc9f907 Author: Michael S. Tsirkin Date: Wed Mar 21 15:45:05 2007 +0200 IB/ipoib: Fix thinko in packet length checks The packet length checks in ipoib are broken: we add 4 bytes (IPoIB encapsulation header) when sending a packet, not 20 bytes (hardware address length) to each packet. Therefore, if connected mode is enabled so that the interface MTU is larger than the multicast MTU, IPoIB may end up trying to send too-long multicast packets. For example, multicast is broken if a message of size 2048 bytes is sent on an interface with UD MTU 2048, because 2048 is bigger than the real limit of 2044 but the code tests against the wrong limit of 2060. This patch fixes , submitted by Scott Weitzenkamp . Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit d04d01b113be5b88418eb30087753c3de0a39fd8 Author: Michael S. Tsirkin Date: Thu Mar 22 14:40:16 2007 -0700 IPoIB: Fix use-after-free in path_rec_completion() The connected mode code added the possibility that an neigh struct gets freed in the list_for_each_entry() loop in path_rec_completion(), which causes a use-after-free. Fix this by changing to the _safe variant of the list walking macro. This was spotted by the Coverity checker (CID 1567). Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit 73b9e9870f5780cb554b68bbcfa47782b27a3e04 Author: Joachim Fenkes Date: Thu Mar 22 16:52:13 2007 +0100 IB/ehca: Make scaling code work without CPU hotplug eHCA scaling code must not depend on register_cpu_notifier() if CONFIG_HOTPLUG_CPU is not set, so put all related code into #ifdefs. Signed-off-by: Joachim Fenkes Signed-off-by: Roland Dreier commit d60134718820892853e8be7141ef7f6cdb455ea6 Author: Steve Wise Date: Thu Mar 22 10:38:20 2007 -0500 RDMA/cxgb3: Handle build_phys_page_list() failure in iwch_reregister_phys_mem() Signed-off-by: Steve Wise Signed-off-by: Roland Dreier commit fae8773b737d03f94ba83f0b78a891f385f35f98 Author: Bryan O'Sullivan Date: Wed Mar 21 15:18:14 2007 -0700 IB/ipath: Check return value of lookup_one_len This fixes kernel.org bug 8003. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit e07832b66285124038a96b25a2056e91a55d8b1e Author: Sean Hefty Date: Mon Mar 19 14:31:36 2007 -0800 IPoIB: Fix race in detaching from mcast group before attaching There's a race between ipoib_mcast_leave() and ipoib_mcast_join_finish() where we can try to detach from a multicast group before we've attached to it. Fix this by reordering the code in ipoib_mcast_leave to free the multicast group first, which waits for the multicast callback thread (which calls ipoib_mcast_join_finish()) to complete before detaching from the group. Signed-off-by: Sean Hefty Signed-off-by: Roland Dreier commit 60a596dab7c82bdfa5ee7abcee8e0ce385d4ef21 Author: Michael S. Tsirkin Date: Thu Mar 22 14:32:09 2007 -0700 IPoIB/cm: Fix reaping of stale connections The sense of the time_after_eq() test in ipoib_cm_stale_task() is reversed so that only non-stale connections are reaped. Fix this by changing to time_before_eq(). Noticed by Pradeep Satyanarayana . Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit 848c29fd648e78fa87d0e399223826ce5dfc1b7a Author: Patrick McHardy Date: Thu Mar 22 12:30:29 2007 -0700 [NETFILTER]: nat: avoid rerouting packets if only XFRM policy key changed Currently NAT not only reroutes packets in the OUTPUT chain when the routing key changed, but also if only the non-routing part of the IPsec policy key changed. This breaks ping -I since it doesn't use SO_BINDTODEVICE but IP_PKTINFO cmsg to specify the output device, and this information is lost. Only do full rerouting if the routing key changed, and just do a new policy lookup with the old route if only the ports changed. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit ca8fbb859c42c9a402c5c19fd0588d89ae4988ba Author: Patrick McHardy Date: Thu Mar 22 12:29:57 2007 -0700 [NETFILTER]: nf_conntrack_netlink: add missing dependency on NF_NAT NF_CT_NETLINK=y, NF_NAT=m results in: LD .tmp_vmlinux1 net/built-in.o: dans la fonction « nfnetlink_parse_nat_proto »: nf_conntrack_netlink.c:(.text+0x28db9): référence indéfinie vers « nf_nat_proto_find_get » nf_conntrack_netlink.c:(.text+0x28dd6): référence indéfinie vers « nf_nat_proto_put » net/built-in.o: dans la fonction « ctnetlink_new_conntrack »: nf_conntrack_netlink.c:(.text+0x29959): référence indéfinie vers « nf_nat_setup_info » nf_conntrack_netlink.c:(.text+0x29b35): référence indéfinie vers « nf_nat_setup_info » nf_conntrack_netlink.c:(.text+0x29cf7): référence indéfinie vers « nf_nat_setup_info » nf_conntrack_netlink.c:(.text+0x29de2): référence indéfinie vers « nf_nat_setup_info » make: *** [.tmp_vmlinux1] Erreur 1 Reported by Kevin Baradon Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit b6f99a211957910a07437f46ce54dcfb1755cf84 Author: Dave Jones Date: Thu Mar 22 12:27:49 2007 -0700 [NET]: fix up misplaced inlines. Turning up the warnings on gcc makes it emit warnings about the placement of 'inline' in function declarations. Here's everything that was under net/ Signed-off-by: Dave Jones Signed-off-by: David S. Miller commit 289f42492c0958871b6045050474c752ec99704f Author: Vlad Yasevich Date: Thu Mar 22 12:26:25 2007 -0700 [SCTP]: Correctly reset ssthresh when restarting association Reset ssthresh to the correct value (peer's a_rwnd) when restarting association. Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit b19cbe2a1695c09c74f83646c4b82b51123b3690 Author: Patrick McHardy Date: Thu Mar 22 12:25:20 2007 -0700 [BRIDGE]: Fix fdb RCU race br_fdb_get use atomic_inc to increase the refcount of an element found on a RCU protected list, which can lead to the following race: CPU0 CPU1 br_fdb_get: rcu_read_lock __br_fdb_get: find element fdb_delete: hlist_del_rcu br_fdb_put br_fdb_put: atomic_dec_and_test call_rcu(fdb_rcu_free) br_fdb_get: atomic_inc rcu_read_unlock fdb_rcu_free: kmem_cache_free Use atomic_inc_not_zero instead. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit ec25615b9ddd5c584b4066652840581fdb6c5e7a Author: Patrick McHardy Date: Thu Mar 22 12:24:38 2007 -0700 [NET]: Fix fib_rules dump race fib_rules_dump needs to use list_for_each_entry_rcu to protect against concurrent changes to the rules list. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 0ca9493b4c0f4fb7796add422ba5ecc672c9fa16 Author: Cyrill V. Gorcunov Date: Thu Mar 22 19:49:01 2007 +0100 i2c/ds1374: Check workqueue creation status Check if workqueue creation failed. Further usage of NULL pointed workqueue is not good I guess ;) Signed-off-by: Cyrill V. Gorcunov Signed-off-by: Andrew Morton Signed-off-by: Jean Delvare commit a5aaea37858fb56d624227408d1dde4cb78c9a6c Author: Jean Delvare Date: Thu Mar 22 19:49:01 2007 +0100 i2c-i801: Restore the device state before leaving Restore the original host configuration on driver unload and on suspend. In particular this returns the SMBus master in I2C mode if it was originally in I2C mode, which should help with suspend/resume if the BIOS expects to find the SMBus master in I2C mode. This fixes bug #6449 (for real this time.) http://bugzilla.kernel.org/show_bug.cgi?id=6449 Signed-off-by: Jean Delvare Tested-by: Tommi Kyntola commit 58791fd81dabdd0552c63625f231d16c9060ec84 Author: Jean Delvare Date: Thu Mar 22 19:49:00 2007 +0100 i2c-amd8111: Missed cleanup I missed one cleanup in my previous patch. Signed-off-by: Jean Delvare commit 4f5fa2fb1259f506d20e8af447117ec3ec426a53 Author: Anton Blanchard Date: Tue Mar 20 14:29:54 2007 -0500 [POWERPC] Bypass hcall stats until cpu features have run I noticed that we execute hcalls before cpu feature code has run (eg for setting up the bolted kernel region). This means that we may be executing code that is not appropriate for the processor we have. Create an unconditional branch that we nop out all the time to fix this. Signed-off-by: Anton Blanchard Signed-off-by: Paul Mackerras commit b4aea36b7956eeebfc56314ce0944db1441255ce Author: Mohan Kumar M Date: Wed Mar 21 11:21:32 2007 +0530 [POWERPC] Avoid hypervisor statistics calculation in real mode kexec invokes plpar_hcall hypervisor call in real mode. plpar_hcall refers to per cpu variables for accounting hypervisor statistics. These variables may not be in the RMO region, so accesses to them in real mode may result in a data storage exception. This fixes this problem by using a new plpar_hcall_raw function which does not update the hypervisor call statistics. Thanks to Anton for suggesting this idea. Signed-off-by: Mohan Kumar M Signed-off-by: Paul Mackerras commit b1dfe1f1457a85b42544ef8b9c83c7cf9d9c3a16 Author: Krzysztof Helt Date: Mon Mar 19 15:10:20 2007 +0100 [ARM] 4272/1: Missing symbol h1940_pm_return fix Added missing ifdefs, to make kernel linkable without the PM support. Signed-off-by: Krzysztof Helt Signed-off-by: Ben Dooks Signed-off-by: Russell King commit 7bc301e97b96597df967f11b9fa9cf391109893a Author: Sebastian Siewior Date: Wed Mar 21 08:58:43 2007 +1100 [CRYPTO] tcrypt: Fix error checking for comp allocation This patch fixes loading the tcrypt module while deflate isn't available at all (isn't build). Signed-off-by: Sebastian Siewior Signed-off-by: Herbert Xu commit 58e40308f329275ccf556312a9cd788522f7c224 Author: Johannes Schlumberger Date: Wed Mar 21 08:55:58 2007 +1100 [CRYPTO] doc: Fix typo in hash example there is a tiny bug in Documentation/crypto/api-intro.txt. The file has the following example code: struct scatterlist sg[2]; [...] if (crypto_hash_digest(&desc, &sg, 2, result)) which does not match the declaration of crypto_hash_digest() in include/linux/crypto.h. (static inline int crypto_hash_digest(struct hash_desc *desc, struct scatterlist *sg, unsigned int nbytes, u8 *out) The code in the example passes the address of a pointer (an array actually) as the second argument, while the function expects the pointer itself. I have attached a patch to fix this. Signed-off-by: Herbert Xu commit f70ee5ec8fc59ba2d905e6daf0d395edf6fb461d Author: J. Bruce Fields Date: Wed Mar 21 08:50:12 2007 +1100 [CRYPTO] api: scatterwalk_copychunks() fails to advance through scatterlist In the loop in scatterwalk_copychunks(), if walk->offset is zero, then scatterwalk_pagedone rounds that up to the nearest page boundary: walk->offset += PAGE_SIZE - 1; walk->offset &= PAGE_MASK; which is a no-op in this case, so we don't advance to the next element of the scatterlist array: if (walk->offset >= walk->sg->offset + walk->sg->length) scatterwalk_start(walk, sg_next(walk->sg)); and we end up copying the same data twice. It appears that other callers of scatterwalk_{page}done first advance walk->offset, so I believe that's the correct thing to do here. This caused a bug in NFS when run with krb5p security, which would cause some writes to fail with permissions errors--for example, writes of less than 8 bytes (the des blocksize) at the start of a file. A git-bisect shows the bug was originally introduced by 5c64097aa0f6dc4f27718ef47ca9a12538d62860, first in 2.6.19-rc1. Signed-off-by: "J. Bruce Fields" Signed-off-by: Herbert Xu commit 58a69c367c02a165004a5ce5dd55ce03b59ba43d Author: Bernhard Walle Date: Wed Mar 14 19:07:47 2007 +0100 [IA64] Fix wrong /proc/iomem on SGI Altix In sn_io_slot_fixup(), the parent is re-set from the bus to io(port|mem)_resource because the address is changed in a way that it's not child of the bus any more. However, only the root is set but not the parent/child/sibling relationship in the resource tree which causes 'cat /proc/iomem' to stop after this memory area. Depding on the poition in the tree the iomem may be nearly completely empty. Signed-off-by: Bernhard Walle Acked-by: John Keller Signed-off-by: Tony Luck commit 0bdfc1900705dadef6286d69de7da0feef841734 Author: John Keller Date: Tue Mar 20 13:50:10 2007 -0500 [IA64] Altix: ioremap vga_console_iobase When booting an SN system without specifing a console (i.e., no "console=" on boot line), the system will hang during boot at the point where /sbin/init is run. The problem is that vga_console_iobase is not converted to a virtual address before storing in io_space[0].mmio_base. The conversion was happening in sn_scan_pcdp(), but not in setup_vga_console(). Signed-off-by: John Keller Signed-off-by: Tony Luck commit 60b548dfe4ad178dbf0fa8c2a50e36aaa42d603a Author: Jay Lan Date: Tue Mar 20 13:47:47 2007 -0700 [IA64] Fix typo/thinko in crash.c Clearly should be checking for "val == DIE_INIT_SLAVE_ENTER". Signed-off-by: Jay Lan Acked-by: Simon Horman Signed-off-by: Tony Luck commit c5e83e3f42938c0a84047e125edb98d6513f985b Author: Jack Steiner Date: Mon Mar 12 08:07:49 2007 -0500 [IA64] Fix get_model_name() for mixed cpu type systems If a system consists of mixed processor types, kmalloc() can be called before the per-cpu data page is initialized. If the slab contains sufficient memory, then kmalloc() works ok. However, if the slabs are empty, slab calls the memory allocator. This requires per-cpu data (NODE_DATA()) & the cpu dies. Also noted by Russ Anderson who had a very similar patch. Signed-off-by: Jack Steiner Signed-off-by: Tony Luck commit a3f5c338b9f30f328276739d9589beae19254936 Author: Zou Nan hai Date: Tue Mar 20 13:41:57 2007 -0700 [IA64] min_low_pfn and max_low_pfn calculation fix We have seen bad_pte_print when testing crashdump on an SN machine in recent 2.6.20 kernel. There are tons of bad pte print (pfn < max_low_pfn) reports when the crash kernel boots up, all those reported bad pages are inside initmem range; That is because if the crash kernel code and data happens to be at the beginning of the 1st node. build_node_maps in discontig.c will bypass reserved regions with filter_rsvd_memory. Since min_low_pfn is calculated in build_node_map, so in this case, min_low_pfn will be greater than kernel code and data. Because pages inside initmem are freed and reused later, we saw pfn_valid check fail on those pages. I think this theoretically happen on a normal kernel. When I check min_low_pfn and max_low_pfn calculation in contig.c and discontig.c. I found more issues than this. 1. min_low_pfn and max_low_pfn calculation is inconsistent between contig.c and discontig.c, min_low_pfn is calculated as the first page number of boot memmap in contig.c (Why? Though this may work at the most of the time, I don't think it is the right logic). It is calculated as the lowest physical memory page number bypass reserved regions in discontig.c. max_low_pfn is calculated include reserved regions in contig.c. It is calculated exclude reserved regions in discontig.c. 2. If kernel code and data region is happen to be at the begin or the end of physical memory, when min_low_pfn and max_low_pfn calculation is bypassed kernel code and data, pages in initmem will report bad. 3. initrd is also in reserved regions, if it is at the begin or at the end of physical memory, kernel will refuse to reuse the memory. Because the virt_addr_valid check in free_initrd_mem. So it is better to fix and clean up those issues. Calculate min_low_pfn and max_low_pfn in a consistent way. Signed-off-by: Zou Nan hai Acked-by: Jay Lan Signed-off-by: Tony Luck commit 9d5cf5adcbb703a4c794232840c25a65a372c357 Author: Uwe Kleine-König Date: Fri Feb 23 20:52:19 2007 +0100 [ARM] 4235/1: ns9xxx: declare the clock functions as "const" This patch removes some "const"s that I introduced thinking they mean the same thing as the "const"s introduced here. So it fixes three warnings. Signed-off-by: Uwe Kleine-König Signed-off-by: Russell King commit 961995582e3752e983dc3906a57546a188007440 Author: Joy Latten Date: Mon Mar 19 18:47:26 2007 -0700 [XFRM]: ipsecv6 needs a space when printing audit record. This patch adds a space between printing of the src and dst ipv6 addresses. Otherwise, audit or other test tools may fail to process the audit record properly because they cannot find the dst address. Signed-off-by: Joy Latten Signed-off-by: David S. Miller commit e4ce837de96d58509f5f815ab37a46889788e701 Author: Adrian Bunk Date: Mon Mar 19 17:04:56 2007 -0700 [X25] x25_forward_call(): fix NULL dereferences This patch fixes two NULL dereferences spotted by the Coverity checker. Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller commit 749bf9215ed1a8b6edb4bb03693c2b62c6b9c2a4 Author: Vlad Yasevich Date: Mon Mar 19 17:02:30 2007 -0700 [SCTP]: Reset some transport and association variables on restart If the association has been restarted, we need to reset the transport congestion variables as well as accumulated error counts and CACC variables. If we do not, the association will use the wrong values and may terminate prematurely. This was found with a scenario where the peer restarted the association when lksctp was in the last HB timeout for its association. The restart happened, but the error counts have not been reset and when the timeout occurred, a newly restarted association was terminated due to excessive retransmits. Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit fb78525ae1b75bfac1da600ceb008aef4d293649 Author: Vlad Yasevich Date: Mon Mar 19 17:02:03 2007 -0700 [SCTP]: Increment error counters on user requested HBs. 2960bis states (Section 8.3): D) Request an on-demand HEARTBEAT on a specific destination transport address of a given association. The endpoint should increment the respective error counter of the destination transport address each time a HEARTBEAT is sent to that address and not acknowledged within one RTO. Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 0b58a811461ccf3cf848aba4cc192538fd3b0516 Author: Vlad Yasevich Date: Mon Mar 19 17:01:17 2007 -0700 [SCTP]: Clean up stale data during association restart During association restart we may have stale data sitting on the ULP queue waiting for ordering or reassembly. This data may cause severe problems if not cleaned up. In particular stale data pending ordering may cause problems with receive window exhaustion if our peer has decided to restart the association. Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit c577c2b99387b5ff8607d42d6eaff9ec024d4773 Author: Samuel Ortiz Date: Fri Mar 16 20:31:03 2007 -0700 [IrDA]: Calling ppp_unregister_channel() from process context We need to call ppp_unregister_channel() when IrNET disconnects, and this must be done from a process context. Bug reported and patch tested by Guennadi Liakhovetski. Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit 7bb1bbe615de25d955b974cb47d40fa198154bb9 Author: G. Liakhovetski Date: Fri Mar 16 20:30:03 2007 -0700 [IrDA]: irttp_dup spin_lock initialisation Without this initialization one gets kernel BUG at kernel/rtmutex_common.h:80! This patch should also be included in the -stable kernel. Signed-off-by: G. Liakhovetski Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit 2e360d81ea1fe1a7701e05cdefd3a91c11c3b13f Author: Nigel Williams Date: Fri Mar 16 20:28:36 2007 -0700 [IrDA]: Delay needed when uploading firmware chunks With 42101001.sb firmwares, we need a 10 ms delay between firmware chunks upload on irda-usb. Patch from Nigel Williams Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit 0cd4554df0c261f7ba74786e471ccaa0e3725fb9 Author: Len Brown Date: Mon Mar 19 23:51:36 2007 -0400 ACPI: IA64: fix %ll build warnings acpi_integer is 64-bits on all platforms, and so was defined as a u64. i386 and x86_64 define u64 as unsigned long long. ia64 defines u64 as long. While these are all 64-bits, the kernel build warns about formating a "long" with %ll: drivers/ata/libata-acpi.c:176: warning: long long unsigned int format, acpi_integer arg (arg 5) So skip using "u64" and define acpi_integer as "unsigned long long" to make gcc happy with %ll. Signed-off-by: Len Brown commit 8140a90ec180192b202af086e7a582e5937c5580 Author: Len Brown Date: Fri Mar 16 22:00:43 2007 -0400 ACPI: IA64: fix allnoconfig build The evils of Kconfig's select bite us once again... ia64/Kconfig selects ACPI, which depends on PM. But select ignores dependencies, allnoconfig chooses CONFIG_PM=n, and thus the menu of sub-options under ACPI vanish, which breaks the build. Manually select PM along with ACPI for now. Some day, we should delete them both, or fix select. Cc: Tony Luck Signed-off-by: Len Brown commit 69806d5631b79ed0c442ae5b15c46bcfd8662476 Author: Greg Kroah-Hartman Date: Mon Mar 19 13:39:51 2007 -0700 USB: new Novatel device ids for option driver This moves all of the Novatel device ids to the option driver, where they belong. Thanks to Novatel for providing a list of all supported devices. Signed-off-by: Greg Kroah-Hartman commit 24d559cac4d741d60ec85e927974408020a2f060 Author: David S. Miller Date: Mon Mar 19 13:27:33 2007 -0700 [SPARC64]: store-init needs trailing membar. The manual says that it is required and we actually have crash reports where loads see stale data due to not having membars here. In one case the networking does: memset(skb, 0, offsetof(struct sk_buff, truesize)); and then some code later checks skb->nohdr for zero, but it's still the value that was there before the memset(). Note that arch/sparc64/lib/xor.S already got this right. Signed-off-by: David S. Miller commit 7df4246117cb0adc6c3ed54bdb2d2faf4656d9cd Author: Ralf Baechle Date: Mon Mar 19 15:29:39 2007 +0000 [MIPS] Export except_vec_vi_{mori,lui,ori} as text symbols. Otherwise objdump will screw up disassembly. Signed-off-by: Ralf Baechle commit 43e3c885d0e120a749ec7fe204aaec8f46c1d5b6 Author: Thiemo Seufer Date: Mon Mar 19 00:05:06 2007 +0000 [MIPS] mips-boards: More liberal check for mips-board console Allows overriding the MALTA/ATLAS/etc. default console setting with non-serial console devices. Signed-Off-By: Thiemo Seufer Signed-off-by: Ralf Baechle commit 119537c092638bf8a0672415024639353c773bb1 Author: Thiemo Seufer Date: Mon Mar 19 00:13:37 2007 +0000 [MIPS] Misc fixes for plat_irq_dispatch functions o adds missing ST0_IM masks, which caused the logging of valid interrupts as spurious o stops pnx8550 to log every interrupt as spurious o adds cause register masks for ip22/ip32, which caused handling of masked interrupts o removes some superfluous parentheses in the SNI interrupt code Signed-Off-By: Thiemo Seufer Signed-off-by: Ralf Baechle commit 72ede9b18967e7a8a62a88f164f003193f6d891f Author: Atsushi Nemoto Date: Sun Mar 18 01:01:39 2007 +0900 [MIPS] Qemu: Fix Symmetric Uniprocessor support. Might be useful for SMP debugging. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle [Rewritten Kconfig bits to deal better fit in the usual pattern of doing things - Ralf] Signed-off-by: Ralf Baechle commit 8c3644350f4105a9b55fbfc6bbba567b79cdf72a Author: Ralf Baechle Date: Sat Mar 17 16:21:28 2007 +0000 [MIPS] VI: TRACE_IRQS_OFF clobbers $v0, so save & restore around call. Signed-off-by: Ralf Baechle commit 774f78cf3b81c553c087ca0e8740e9cd779df578 Author: Ken L Johnson Date: Fri Mar 16 10:17:31 2007 -0600 USB: berry_charge: correct dbg string for second magic command I was testing the berry_charge module with my Blackberry 8700c and had great success, thanks. Looking at the code for my own learning I noticed the following cut and paste error... just a nit. Signed-off-by: Ken L Johnson Signed-off-by: Greg Kroah-Hartman commit 5ec71db59ac07eeac89a54b35a90c181bbd3c445 Author: Alan Stern Date: Fri Mar 16 15:53:07 2007 -0400 usblp: quirk flag and device entry for Seiko Epson M129C printer This patch (as872) adds a device table entry and a new quirk flag to the usblp driver for the Seiko Epson Receipt printer. This printer returns Vendor-Specific values for bInterfaceClass and bInterfaceSubClass, but the bInterfaceProtocol value is valid and it works with usblp. The new quirks flag tells the driver to ignore the Class and SubClass values in the interface descriptor. Signed-off-by: Alan Stern Cc: Vojtech Pavlik Signed-off-by: Greg Kroah-Hartman commit e5740b5d75af4ad9423911fe77d687f47e880a4d Author: Mark Glines Date: Wed Mar 14 11:55:28 2007 -0700 airprime: USB ID for Novatel EV620 mini PCI-E card Add an ID to recognise the Novatel EV620 wireless adapter. http://www.novatelwireless.com/products/expedite/ev620.html It looks like a mini PCI-Express adapter. The mPCIE connector includes USB pins... the card shows up to the system as a USB device, and powers itself from the PCI bus. The card I have isn't activated yet, so I can't get a PPP session up yet, but I have tested basic serial communication successfully in both 2.6.18 and 2.6.20 kernels, once the product ID was added. (the driver changed quite a bit between the two revs.) In both drivers, it responds to AT commands and such. Signed-off-by: Mark Glines Cc: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit e8e30c765c5cfa5219918d3e5017fc563cf7ea03 Author: Oliver Neukum Date: Wed Mar 14 11:11:08 2007 +0100 USB: necessary update for mos7720 driver these devices have a shared interrupt endpoint. For serialcore to pass an interrupt endpoint to a subdriver, the subdriver must define and _export_ a fitting callback. The mos7720 driver failed to do so. This led invariably to an oops upon open. This patch fixes it. The driver is useless without it. Please try to get this into 2.6.21 and the stable kernels that have this driver. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit a7f3dd5d4b74030964c80fb1b7f2131986fe2d67 Author: Pete Zaitcev Date: Sat Mar 10 15:17:16 2007 -0800 USB: RAZR v3i unusual_devs This adds an unusual_devs entry for the Motorola RAZR 3vi. From: Pete Zaitcev Signed-off-by: Phil Dibowitz Signed-off-by: Greg Kroah-Hartman commit 6dc477f3e4dd456122fdb231a1c57393659b93b5 Author: Jon Dowland Date: Sun Mar 11 20:03:03 2007 +0000 USB: two more device ids for dm9601 usbnet driver This patch for the linux-usb-devel tree adds two more product ids to the dm9601 driver. These ids were found on rebadged dm9601 devices in the wild. Signed-off-by: Jon Dowland Acked-by: Peter Korsgaard Signed-off-by: Greg Kroah-Hartman commit 521b85ae66ad40a670b27b0596312d347a89b669 Author: Jim Radford Date: Tue Mar 13 08:30:50 2007 -0700 USB: fix usb-serial regression This patch reverts d9a7ecacac5f8274d2afce09aadcf37bdb42b93a since it breaks drivers that need to access the ->port[] array in shutdown (most of them). Signed-Off: Jim Radford Acked-by: Mark Lord Signed-off-by: Greg Kroah-Hartman commit 282c6b9c7a344ce6436bb61a006b9c2a373b9626 Author: Alessandro Zummo Date: Sun Mar 18 15:23:33 2007 +0100 pata_ixp4xx_cf: fix interrupt As per compact flash specifications, the default irq mode upon cf insertion is pulse mode. this patch fixes the driver to cope with that. Signed-off-by: Alessandro Zummo Signed-off-by: Jeff Garzik commit 2ab302b3579b76b8c575f0858a8e4b82f6dfca52 Author: Tejun Heo Date: Sun Mar 18 04:55:23 2007 +0900 pata_ixp4xx_cf: fix oops on detach pata_ixp4xx_cf dodged dont-clear-drvdata-in-LLD bombing run as it used platform_set_drvdata() instead of dev_set_drvdata(). This causes OOPS on devres host release. Kill it. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit cc261267dfbced100eb10832aaabb03bf993745d Author: Randy Dunlap Date: Fri Mar 16 19:55:47 2007 -0700 libata: kernel-doc fix Warning(linux-2621-rc3g7/drivers/ata/libata-core.c:842): No description found for parameter 'unknown' Signed-off-by: Randy Dunlap Signed-off-by: Jeff Garzik commit e1251d01452d2f8e91c898b3828444b279cef047 Author: Tejun Heo Date: Fri Mar 16 01:59:42 2007 +0900 sata_inic162x: kill double region requests Regions are requested twice during initialization causing the second one to fail. This is regression introduced during iomap conversion. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit aeb9362a4844d7a4e43c7d4e4ef1461850346b0c Author: Akira Iguchi Date: Thu Mar 15 14:32:58 2007 +0900 drivers/ata/Kconfig: PATA_SCC depends on wrong platform PATA_SCC depends on PPC_CELLEB. (not PPC_IBM_CELL_BLADE) Signed-off-by: Kou Ishizaki Signed-off-by: Akira Iguchi Signed-off-by: Jeff Garzik commit 722d67b6208bd56faa6d731246117a3e4660ce88 Author: Jamie Clark Date: Tue Mar 13 12:48:00 2007 +0800 sata_sil24: Add Adaptec 1220SA PCI ID Add Adaptec 1220SA (SIL3132) to devices claimed by sata_sil24 Patch generated against 2.6.20.2 Signed-off-by: Jamie Clark Signed-off-by: Jeff Garzik commit 4aa9ab67fb9c0dfdb1692f4ec413120832a22ddc Author: Tejun Heo Date: Mon Mar 12 17:24:08 2007 +0900 libata: don't whine if ->prereset() returns -ENOENT ->prereset() returns -ENOENT to tell libata that the port is empty and reset sequencing should be stopped. This is not an error condition. Update ata_eh_reset() such that it sets device classes to ATA_DEV_NONE and return success in on -ENOENT. This makes spurious error message go away. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 43a867a2d2a119c744bab6dc8d3e1da6809d7141 Author: Ralph Wuerthner Date: Mon Mar 19 13:19:19 2007 +0100 [S390] zcrypt: fix possible race when unloading zcrypt driver modules Move try_module_get() call into spin protected block to prevent zcrypt driver module unload while submitting a request to driver. Signed-off-by: Ralph Wuerthner Signed-off-by: Martin Schwidefsky commit cf352ce0b9104dc6a1c11df52db9f910f1f6cd2e Author: Ralph Wuerthner Date: Mon Mar 19 13:19:14 2007 +0100 [S390] zcrypt: fix possible dead lock in AP bus module AP bus module uses bus_for_each_dev() in software interrupt context to poll for completed requests which might cause dead locks. Solution: use private AP device list for polling in software interrupt context. Signed-off-by: Ralph Wuerthner Signed-off-by: Martin Schwidefsky commit fb1c171992041e1d4bfb8c010548fa97f2106827 Author: Heiko Carstens Date: Mon Mar 19 13:19:07 2007 +0100 [S390] Wire up sys_utimes. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit fbb04f38cf85ae8691cf3049ec62636ad968479b Author: Michael Holzheu Date: Mon Mar 19 13:19:03 2007 +0100 [S390] reboot from and dump to SCSI under z/VM fails. We used wrong length values for ipl and dump hardware structures. Since z/VM checks the ipl parameters more accurately than LPAR, the operations fail there. Signed-off-by: Michael Holzheu Signed-off-by: Martin Schwidefsky commit 10c16a37e32b74abe088c303f600746e73f5b7e2 Author: Heiko Carstens Date: Mon Mar 19 13:18:56 2007 +0100 [S390] Wire up compat_sys_epoll_pwait. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit 20cb9e79b963b8f5142e4dd946baf44a75e7935f Author: Jean Delvare Date: Mon Mar 19 13:18:53 2007 +0100 [S390] strlcpy is smart enough strlcpy already accounts for the trailing zero in its length computation, so there is no need to substract one to the buffer size. Signed-off-by: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Martin Schwidefsky commit 257c6e1ce8f875dd02220e90cf38e615e47788fe Author: Heiko Carstens Date: Mon Mar 19 13:18:50 2007 +0100 [S390] memory detection: fix off by one bug. diag 260 returns the address of the last addressable byte and not the size of memory. Since we want the size we have to add 1 to the return value. Disable diag 260 for non z/Arch mode since it doesn't work there anyway. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky commit dcc49d460c4052d2fa7ba44e81d3b814b799f802 Author: Ursula Braun Date: Mon Mar 19 13:18:12 2007 +0100 [S390] cio: qdio slsb setup Make sure set_slsb problems are handled correctly in qdio_do_qdio_fill_input() and qdio_do_qdio_fill_output. Signed-off-by: Ursula Braun Signed-off-by: Martin Schwidefsky commit 5851fadce8824d5d4b8fd02c22ae098401f6489e Author: Ralf Baechle Date: Sun Mar 18 12:58:08 2007 +0000 [PATCH] Fix build error due to not including Since d9a9cdfb078d755e648d53ec25b7370f84ee5729 is using ENOSYS without including if CONFIG_SYSFS is disabled. Fixed by including . Signed-off-by: Ralf Baechle Signed-off-by: Linus Torvalds commit d9c1e9a8fff512bb6c43461181d4360f1c8cfd6d Author: Eric W. Biederman Date: Sun Mar 18 12:45:44 2007 -0600 [PATCH] tty: Fix two reported pid leaks These leaks were reported by: Catalin Marinas and I have been able to very by inspection they are possible. When converting tty_io.c to store pids as struct pid pointers instead of pid_t values it appears I overlooked two places where we stop using the pid value. The very obvious one is in do_tty_hangup, and the one the less obvious one in __proc_set_tty. When looking into the code __proc_set_tty only has pids that need to be put because of failures of other parts of the code to properly perform hangup processing. Fixing the leak here in __proc_set_tty is easy and obviously correct so I am doing that first. Fixing the places that should be performing hangup processing is much less obviously correct. So those I'm aiming those patches at -mm. for now, so the can age a while before they are merged. Signed-off-by: Eric W. Biederman Signed-off-by: Linus Torvalds commit aeb3f6d10ebfd5607f4bd3920b3b730a992ab82c Author: David Brownell Date: Sun Mar 18 01:26:13 2007 -0800 [PATCH] gpio_direction_output-needs-an-initial-value fix Build fix: sa1100/generic.c should already have included , but it didn't ... causing a build problem with a recent patch. Signed-off-by: David Brownell Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ca1b940ce6495541efe76499b3de39aa5e4941ed Author: Thomas Gleixner Date: Sun Mar 18 01:26:13 2007 -0800 [PATCH] i386: trust the PM-Timer calibration of the local APIC timer When PM-Timer is available for local APIC timer calibration we can skip the verification of the calibrated time value. The resulting error is quite small on a bunch of evaluated platforms and is less harming than the observed false positives. We need to keep the verification on systems, which have no PM-Timer to avoid bogus local APIC timer calibrations in the range of factor 2-10, which can be observed when swicthing off the PM-timer support in the kernel configuration. The wrong calibration values are probably caused by SMM code trying to emulate a PS/2 keyboard from a (maybe connected or not) USB keyboard. This prohibits the accurate delivery of PIT interrupts, which are used to calibrate the local APIC timer. Unfortunately we have no way to disable this BIOS misfeature in the early boot process. Add also the dropped cpu_relax() back to the wait loops. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Acked-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 303cd1535f6257b9fd8214534ca87b1a1567a2c5 Author: Mathieu Desnoyers Date: Sun Mar 18 01:26:11 2007 -0800 [PATCH] Fix atomicity of TIF update in flush_thread() for x86_64 Fix atomicity of TIF update in flush_thread() for x86_64 Race : parent process executing : sys_ptrace() (lock_kernel()) (ptrace_get_task_struct(pid)) arch_ptrace() ptrace_detach() ptrace_disable(child); clear_singlestep(child); clear_tsk_thread_flag(child, TIF_SINGLESTEP); (which clears the TIF_SINGLESTEP flag atomically from a different process) (put_task_struct(child)) (unlock_kernel()) And at the same time, in the child process : sys_execve() do_execve() search_binary_handler() load_elf_binary() flush_old_exec() flush_thread() doing a non-atomic thread flag update Signed-off-by: Rebecca Schultz Signed-off-by: Mathieu Desnoyers Acked-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bad77057ed59892bd5c7807dcf0c2500e5ff1fe7 Author: Andrew Morton Date: Sun Mar 18 01:26:10 2007 -0800 [PATCH] machzwd warning fix drivers/char/watchdog/machzwd.c: In function 'zf_ioctl': drivers/char/watchdog/machzwd.c:327: warning: passing argument 1 of 'zf_ping' makes integer from pointer without a cast Also some coding-style repairs. Signed-off-by: Andrew Morton Cc: Al Viro Acked-by: Wim Van Sebroeck Signed-off-by: Linus Torvalds commit 6a3d039078b337856bd3cfa436be3b1b223440a5 Author: John Keller Date: Sun Mar 18 01:26:09 2007 -0800 [PATCH] ia64: platform_kernel_launch_event is noop on generic kernel Add a missing #define for the platform_kernel_launch_event. Without this fix, a call to platform_kernel_launch_event() becomes a noop on generic kernels. SN systems require this fix to successfully kdump/kexec from certain hardware errors. [bwalle@suse.de: fix it] Signed-off-by: John Keller Cc: Bernhard Walle Acked-by: Simon Horman Acked-by: Jay Lan Acked-by: "Luck, Tony" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 647157255915b76ddfbea87ca396ace364d158c5 Author: Bernhard Walle Date: Sun Mar 18 01:26:08 2007 -0800 [PATCH] Fix wrong /proc/iomem on SGI Altix In sn_io_slot_fixup(), the parent is re-set from the bus to io(port|mem)_resource because the address is changed in a way that it's not child of the bus any more. However, only the root is set but not the parent/child/sibling relationship in the resource tree which causes 'cat /proc/iomem' to stop after this memory area. Depding on the poition in the tree the iomem may be nearly completely empty. Signed-off-by: Bernhard Walle Cc: John Keller Cc: Jay Lan Acked-by: "Luck, Tony" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4f78bb289f4ca57b93385b4df4d0defe5804588b Author: Adrian Bunk Date: Sun Mar 18 01:26:07 2007 -0800 [PATCH] X86_P4_CLOCKMOD must select CPU_FREQ_TABLE CONFIG_CPU_FREQ=y CONFIG_CPU_FREQ_TABLE=m CONFIG_X86_P4_CLOCKMOD=y arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_verify':p4-clockmod.c:(.text.cpufreq_p4_verify+0x8): undefined reference to `cpufreq_frequency_table_verify' arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_cpu_exit':p4-clockmod.c:(.text.cpufreq_p4_cpu_exit+0x8): undefined reference to `cpufreq_frequency_table_put_attr' arch/x86_64/kernel/built-in.o: In function `cpufreq_p4_cpu_init':p4-clockmod.c:(.text.cpufreq_p4_cpu_init+0x13b): undefined reference to `cpufreq_frequency_table_get_attr' Signed-off-by: Adrian Bunk Acked-by: Dave Jones Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 27aba76615eeb36af84118e8ea6d35ffa51fd1e3 Author: Avi Kivity Date: Fri Mar 9 13:04:31 2007 +0200 KVM: MMU: Fix host memory corruption on i386 with >= 4GB ram PAGE_MASK is an unsigned long, so using it to mask physical addresses on i386 (which are 64-bit wide) leads to truncation. This can result in page->private of unrelated memory pages being modified, with disasterous results. Fix by not using PAGE_MASK for physical addresses; instead calculate the correct value directly from PAGE_SIZE. Also fix a similar BUG_ON(). Acked-by: Ingo Molnar Signed-off-by: Avi Kivity commit ac1b714e78c8f0b252f8d8872e6ce6f898a123b3 Author: Avi Kivity Date: Thu Mar 8 17:13:32 2007 +0200 KVM: MMU: Fix guest writes to nonpae pde KVM shadow page tables are always in pae mode, regardless of the guest setting. This means that a guest pde (mapping 4MB of memory) is mapped to two shadow pdes (mapping 2MB each). When the guest writes to a pte or pde, we intercept the write and emulate it. We also remove any shadowed mappings corresponding to the write. Since the mmu did not account for the doubling in the number of pdes, it removed the wrong entry, resulting in a mismatch between shadow page tables and guest page tables, followed shortly by guest memory corruption. This patch fixes the problem by detecting the special case of writing to a non-pae pde and adjusting the address and number of shadow pdes zapped accordingly. Acked-by: Ingo Molnar Signed-off-by: Avi Kivity commit f5b42c3324494ea3f9bf795e2a7e4d3cbb06c607 Author: Avi Kivity Date: Tue Mar 6 12:05:53 2007 +0200 KVM: Fix guest sysenter on vmx The vmx code currently treats the guest's sysenter support msrs as 32-bit values, which breaks 32-bit compat mode userspace on 64-bit guests. Fix by using the native word width of the machine. Signed-off-by: Avi Kivity commit ca45aaae1ef98890ac4e3ee48d65aa22401fd1dc Author: Avi Kivity Date: Thu Mar 1 19:21:03 2007 +0200 KVM: Unset kvm_arch_ops if arch module loading failed Otherwise, the core module thinks the arch module is loaded, and won't let you reload it after you've fixed the bug. Signed-off-by: Avi Kivity commit 094f127588679591a871eb20b136f6b2f2796c98 Author: Dan Williams Date: Fri Mar 16 19:31:06 2007 +0100 [ARM] 4271/1: iop32x: fix ep80219 detection (support iq80219 platforms) An iq80219 is a board with an iq31244 layout and an 80219 processor. It breaks the current assumption that all 80219 processors run on ep80219 platforms. This patch adds the "force_ep80219" option to the kernel to override boot loaders that have passed in the iq31244 id, and adds the MACHINE_START definition for ep80219. [ patch assumes that EP80219 has been added to mach-types ] Signed-off-by: Dan Williams Signed-off-by: Russell King commit 5455a51e6f333d43e0b6b52d1712557475d8eb9d Author: Graeme Gregory Date: Fri Mar 16 17:11:43 2007 +0100 [ARM] 4270/2: mach-s3c2443/irq.c off by one error in dma irqs This patch corrects an error when demuxing the DMA irq's DMA1 was used as a base and this should have been DMA0. Without this fix we do not process DMA0 irq's and the system effectively locks up in a loop trying the process the irq it never can. Signed-off-by: Graeme Gregory Acked-by: Ben Dooks Signed-off-by: Russell King commit db2f9f6d916e0e3d8666fa9c23f1b0bc0c954b2a Author: David S. Miller Date: Sat Mar 17 15:23:22 2007 -0700 [SPARC64]: Use Kconfig.preempt Signed-off-by: David S. Miller commit 120b9cfddff2e398fece07c5e127f3fdbb660441 Author: Bartlomiej Zolnierkiewicz Date: Sat Mar 17 21:57:41 2007 +0100 ide: remove CONFIG_IDEDMA_{ICS,PCI}_AUTO config options All modern distributions have been setting these options to "y" for ages. (additionally "n" cases have been obsoleted for few years). Therefore use DMA by default and remove CONFIG_IDEDMA_{ICS,PCI}_AUTO (also remove no longer needed CONFIG_IDEDMA_AUTO). This fixes DMA support for rare configurations where CONFIG_IDEDMA_{ICS,PCI}_AUTO was set to "n" but "hdparm -d 1" was used to enable DMA support and which were forced to PIO mode by "ide: don't allow DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n" patch. There is no functionality loss because "ide=nodma" kernel option is still available. Cc: Patrick Horn Cc: Sergei Shtylyov Cc: Russell King Signed-off-by: Bartlomiej Zolnierkiewicz commit 6f5050a96c9e0521f42a3a1d676c7ad9815f62ad Author: Bartlomiej Zolnierkiewicz Date: Sat Mar 17 21:57:39 2007 +0100 ide: don't allow DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n For CONFIG_IDEDMA_{ICS,PCI}_AUTO=n and/or "ide=nodma" option the host/device are not programmed for DMA and it is also explicitly disabled by ide_set_dma() (->ide_dma_check returns "-1"). However the code responsible for manually enabling DMA ("hdparm -d 1") has a bug which results in DMA being erroneously enabled - ide_set_dma() incorrectly passes "0" return value to set_using_dma(). This may work if BIOS/firmware configured the host/device for DMA and chipset allows independent configuration of DMA/PIO modes but won't work after suspend and is generally unsafe on many chipsets (possibly including data corruption if the same registers are used for DMA/PIO timings). This patch fixes kernel bugzilla bug #8169 (piix host driver fixes for setting PIO mode exposed the problem described above). The side-effect of the fix is that some rare configuration may be forced to PIO mode when DMA mode was previously used - this is addressed by the next patch which removes CONFIG_IDEDMA_{PCI,ICS}_AUTO config option completely. Thanks goes out to Patrick Horn for reporting the issue, narrowing it down to the specific commit and testing the fix. Also thanks to Sergei Shtylyov for help in debugging the problem. Cc: Patrick Horn Cc: Sergei Shtylyov Cc: Russell King Signed-off-by: Bartlomiej Zolnierkiewicz commit a1067db8ebae6817a66fd4e40e34699f402c2544 Author: Kou Ishizaki Date: Sat Mar 17 21:57:25 2007 +0100 scc_pata: dependency fix This patch fixes: * the dependency of scc_pata on BLK_DEV_IDEDMA_PCI * incorrect link to ide-core * move scc_pata from ide/ppc to ide/pci Signed-off-by: Kou Ishizaki Signed-off-by: Akira Iguchi Cc: Al Viro , Signed-off-by: Bartlomiej Zolnierkiewicz commit ebbc2031362cfac7f325f051c619dc39ef4892ed Author: Tejun Heo Date: Sat Mar 17 21:57:25 2007 +0100 jmicron: make ide jmicron driver play nice with libata ones When libata is configured, the device is configured such that SATA and PATA ports live in separate functions with different programming interfaces. pata_jmicron and ide jmicron drivers can drive only the PATA part. This patch makes jmicron match PCI class code such that it doesn't attach itself to the SATA part preventing the proper ahci driver from attaching. This change is suggested by Bartlomiej. Signed-off-by: Tejun Heo Cc: Jeff Garzik Cc: justin@jmicron.com Signed-off-by: Bartlomiej Zolnierkiewicz commit 9c67cd146084040648b72933f138eeb72104be9d Author: Daniel Mack Date: Sat Mar 17 21:57:24 2007 +0100 ide: remove static prototypes from include/asm-mips/mach-au1x00/au1xxx_ide.h This patch removes the static prototypes from the au1xxx_ide.h, some of them were not even implemented. Also, they caused build breakage since they differed from the functions actually implemented in drivers/ide/mips/au1xxx-ide.c. Signed-off-by: Daniel Mack Signed-off-by: Bartlomiej Zolnierkiewicz commit 1918fd63de6d222c049cdeae4aa113a6f0593187 Author: Ralf Baechle Date: Sat Mar 17 21:57:24 2007 +0100 ide: au1xxx: fix use of mixed declarations and code drivers/ide/mips/au1xxx-ide.c:684: warning: ISO C90 forbids mixed declarations and code Signed-off-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Bartlomiej Zolnierkiewicz commit e277a1aaa97abdc1b0a0b8a8c062e29220b00440 Author: Sergei Shtylyov Date: Sat Mar 17 21:57:24 2007 +0100 cmd64x: fix recovery time calculation (take 3) The driver wrongly takes the address setup time into account when calculating the PIO recovery time -- this leads to slight overclocking of the PIO modes 0 and 1 (so, the prayers failed to help, as usual :-). Rework the code to be calculating recovery clock count as a difference between the total cycle count and the active count (we don't need to calculate the recovery time itself since it's not specified for the PIO modes 0 to 2, and for modes 3 and 4 this formula gives enough recovery time anyway in the chip's supported PCI frequency range). This patch has been inspired by reading the datasheets and looking at what the libata driver does; it has been compile-tested only (as usual :-) but anyway, the new code gives the same or longer recovery times than the old one... Signed-off-by: Sergei Shtylyov Signed-off-by: Bartlomiej Zolnierkiewicz commit 25496caec111481161e7f06bbfa12a533c43cc6f Author: Thomas Renninger Date: Tue Feb 27 12:13:00 2007 -0500 ACPI: Only use IPI on known broken machines (AMD, Dothan/BaniasPentium M) Use IPI for blacklisted CPUs, add parameter IPI vs LAPIC Currently, Linux disables lapic timer for all machines with C2 and higher C-state support. According to Intel only specific Intel models (Banias/Dothan) are broken in respect of not waking up from C2 with lapic. However, I am not sure about the naming of the parameter and how it could/should get integrated into the dyntick part (CONFIG_GENERIC_CLOCKEVENTS). There, a more fine grained check (TSC still running?, ..) is needed? Does this make sense (always use CLOCK_EVT_NOTIFY_BROADCAST_ON, but use OFF if forced by use_ipi=0: clockevents_notify(use_ipi ? CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF, &pr->id); Signed-off-by: Thomas Renninger Signed-off-by: Len Brown commit cd05a1f818073a623455a58e756c5b419fc98db9 Author: Thomas Gleixner Date: Sat Mar 17 00:25:52 2007 +0100 [PATCH] clockevents: Fix suspend/resume to disk hangs I finally found a dual core box, which survives suspend/resume without crashing in the middle of nowhere. Sigh, I never figured out from the code and the bug reports what's going on. The observed hangs are caused by a stale state transition of the clock event devices, which keeps the RCU synchronization away from completion, when the non boot CPU is brought back up. The suspend/resume in oneshot mode needs the similar care as the periodic mode during suspend to RAM. My assumption that the state transitions during the different shutdown/bringups of s2disk would go through the periodic boot phase and then switch over to highres resp. nohz mode were simply wrong. Add the appropriate suspend / resume handling for the non periodic modes. Signed-off-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 5379058b718ac6354ba99cc74d10c28d632dc28a Author: Thomas Gleixner Date: Fri Mar 16 14:15:57 2007 -0800 [PATCH] fix MTIME_SEC_MAX on 32-bit The maximum seconds value we can handle on 32bit is LONG_MAX. Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 014efb1df74fe5a30bb10102404428fd4229726e Author: Jeremy Fitzhardinge Date: Fri Mar 16 13:38:37 2007 -0800 [PATCH] i386: fix typo in sync_constant_test_bit()'s name Fix typo in sync_constant_test_bit()'s name, so sync_bitops.h is consistent with bitops.h Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Chris Wright Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6c912a3d3356e5e51917941ce8505531c6fab003 Author: Arnaud Patard (Rtp Date: Fri Mar 16 13:38:36 2007 -0800 [PATCH] spi_s3c24xx.c: warning fix The set_cs field of struct s3c24xx_spi is declared as returning a int but the value returned but set_cs is never fixed. Moreover, the default function for set_cs and the set_cs defintion in the platform data are returning void. I'm proposing to change the prototype to void (*set_cs)(...). By doing this, I'm also fixing 2 build warnings: drivers/spi/spi_s3c24xx.c: In function 's3c24xx_spi_probe': drivers/spi/spi_s3c24xx.c:330: warning: assignment from incompatible pointer type drivers/spi/spi_s3c24xx.c:335: warning: assignment from incompatible pointer type Signed-off-by: Arnaud Patard Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1cabd63262707ad5d6bb730f25b7a2852734595 Author: James Bottomley Date: Fri Mar 16 13:38:35 2007 -0800 [PATCH] fix process crash caused by randomisation and 64k pages This bug was seen on ppc64, but it could have occurred on any architecture with a page size of 64k or above. The problem is that in fs/binfmt_elf.c:randomize_stack_top() randomizes the stack to within 0x7ff pages. On 4k page machines, this is 8MB; on 64k page boxes, this is 128MB. The problem is that the new binary layout (selected in arch_pick_mmap_layout) places the mapping segment 128MB or the stack rlimit away from the top of the process memory, whichever is larger. If you chose an rlimit of less than 128MB (most defaults are in the 8Mb range) then you can end up having your entire stack randomized away. The fix is to make randomize_stack_top() only steal at most 8MB, which this patch does. However, I have to point out that even with this, your stack rlimit might not be exactly what you get if it's > 128MB, because you're still losing the random offset of up to 8MB. The true fix should be to leave an explicit gap for the randomization plus a buffer when determining mmap_base, but that would involve fixing all the architectures. Cc: Arjan van de Ven Cc: Ingo Molnar Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e29e175b0f40cffc86068156733def14a7a533ab Author: Zilvinas Valinskas Date: Fri Mar 16 13:38:34 2007 -0800 [PATCH] initialise pi_lock if CONFIG_RT_MUTEXES=N Fixes a bogus lockdep warning which causes lockdep to disable itself. Acked-by: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 35ae834fa02ba89cfbd4a80892c0e458fd6d5c0b Author: Ankita Garg Date: Fri Mar 16 13:38:33 2007 -0800 [PATCH] oom fix: prevent oom from killing a process with children/sibling unkillable Looking at oom_kill.c, found that the intention to not kill the selected process if any of its children/siblings has OOM_DISABLE set, is not being met. Signed-off-by: Ankita Garg Acked-by: Nick Piggin Acked-by: William Irwin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e5d480ff17f9220cd6198b5c91e8c75329f5594f Author: Johannes Berg Date: Fri Mar 16 13:38:32 2007 -0800 [PATCH] change misleading EFI partition support description Remove the misleading "Presently only useful on the IA-64 platform" text from the EFI partition Kconfig. EFI partitions are also used by Apple on their Intel-based machines and thus you need EFI partition support if you (for example) want to attach such a machine in target disk mode. Signed-off-by: Johannes Berg Acked-by: Matt Domsch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 21778867b1c8e0feb567addb6dc0a7e2ca6ecdec Author: Ingo Molnar Date: Fri Mar 16 13:38:31 2007 -0800 [PATCH] futex: PI state locking fix Testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI state needs to be locked before we access it. Signed-off-by: Ingo Molnar Acked-by: Thomas Gleixner Cc: Chuck Ebbert Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d3a7b6df4951170079252402fd0c2dc70cb0ca2a Author: Marcel Selhorst Date: Fri Mar 16 13:38:31 2007 -0800 [PATCH] tpm_infineon: maintainer Signed-off-by: Marcel Selhorst Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c2c88f109eebb940ddca17472d2e149560bcf7eb Author: Bernhard Walle Date: Fri Mar 16 13:38:30 2007 -0800 [PATCH] Initialise SAK member for each virtual console to prevent oops Initialise the SAK member of the vc_cons variable on all virtual terminals, not only the first one. This prevents an oops when trying Sysrq-C on e.g. the second virtual terminal: kernel BUG at kernel/workqueue.c:212! invalid opcode: 0000 [1] SMP CPU 0 Modules linked in: i915 drm deflate zlib_deflate twofish twofish_common serpent blowfish des ce Pid: 0, comm: swapper Not tainted 2.6.21-rc3-default #15 RIP: 0010:[] [] queue_work+0x32/0x51 RSP: 0018:ffffffff805fada8 EFLAGS: 00010013 RAX: ffffffff80683f38 RBX: ffffffff804ae700 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff80683f30 RDI: ffff81000134a840 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000002 R10: ffffffff805990e0 R11: ffff810037f4c0f0 R12: 000000000000006b R13: ffff81007aa23000 R14: 0000000000000001 R15: 0000000000000096 FS: 0000000000000000(0000) GS:ffffffff804d8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 00002b72026e9000 CR3: 0000000079175000 CR4: 00000000000006e0 Process swapper (pid: 0, threadinfo ffffffff8059e000, task ffffffff80490840) Stack: 0000000000000096 ffffffff803635db ffffffff805fadf8 0000000000000001 ffff8100013c2e40 0000000000000025 ffff81007c931c00 ffff81007aa23000 0000000000000001 ffffffff8035e3ee 0000000000000092 ffff810037cc8000 Call Trace: [] __handle_sysrq+0x98/0x129 [] kbd_event+0x32e/0x56a [] input_event+0x422/0x44a [] atkbd_interrupt+0x449/0x503 [] serio_interrupt+0x37/0x6f [] i8042_interrupt+0x1f4/0x20a [] smp_send_timer_broadcast_ipi+0x2d/0x4e [] handle_IRQ_event+0x25/0x53 [] handle_edge_irq+0xe4/0x128 [] call_softirq+0x1c/0x28 [] do_IRQ+0x6c/0xd3 [] mwait_idle+0x0/0x45 [] ret_from_intr+0x0/0xa [] datagram_poll+0x0/0xc8 [] mwait_idle+0x42/0x45 [] cpu_idle+0x8b/0xae [] start_kernel+0x2b9/0x2c5 [] _sinittext+0x15e/0x162 Code: 0f 0b eb fe 48 8b 07 48 63 d2 48 f7 d0 48 8b 3c d0 e8 13 ff RIP [] queue_work+0x32/0x51 RSP Kernel panic - not syncing: Aiee, killing interrupt handler! Signed-off-by: Bernhard Walle Acked-by: Eric Biederman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7a5e6bc29aca331267dfc9f49129b9432ac84d70 Author: Stefano Brivio Date: Fri Mar 16 13:38:29 2007 -0800 [PATCH] hwmon: Build fix for SENSORS_W83793 We need vid_which_vrm and vid_from_reg in the w83793 module. Signed-off-by: Stefano Brivio Signed-off-by: Jean Delvare Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 634707388baa440d9c9d082cfc4c950500c8952b Author: Trond Myklebust Date: Fri Mar 16 13:38:28 2007 -0800 [PATCH] nfs: nfs_getattr() can't call nfs_sync_mapping_range() for non-regular files Looks like we need a check in nfs_getattr() for a regular file. It makes no sense to call nfs_sync_mapping_range() on anything else. I think that should fix your problem: it will stop the NFS client from interfering with dirty pages on that inode's mapping. Signed-off-by: Trond Myklebust Acked-by: Olof Johansson Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89a09141df6ac1c3821fbe44ca8384eb37692965 Author: Peter Zijlstra Date: Fri Mar 16 13:38:26 2007 -0800 [PATCH] nfs: fix congestion control The current NFS client congestion logic is severly broken, it marks the backing device congested during each nfs_writepages() call but doesn't mirror this in nfs_writepage() which makes for deadlocks. Also it implements its own waitqueue. Replace this by a more regular congestion implementation that puts a cap on the number of active writeback pages and uses the bdi congestion waitqueue. Also always use an interruptible wait since it makes sense to be able to SIGKILL the process even for mounts without 'intr'. Signed-off-by: Peter Zijlstra Acked-by: Trond Myklebust Cc: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b74a2f0913694556a027795d2954d30523fac4c5 Author: suzuki Date: Fri Mar 16 13:38:25 2007 -0800 [PATCH] fix rescan_partitions to return errors properly The only error code which comes from the partition checkers is -1, when they finds an EIO. As per the discussion, ENOMEM values were ignored, as they might scare the users. So, with the current code, we end up returning -1 and not EIO for the ioctl() calls. Which doesn't give any clue to the user of what went wrong. Signed-off-by: Suzuki K P Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b257bc051f06607beb3004d9a1c297085e728bec Author: Andrew Johnson Date: Fri Mar 16 13:38:24 2007 -0800 [PATCH] swsusp: fix suspend when console is in VT_AUTO+KD_GRAPHICS mode When the console is in VT_AUTO+KD_GRAPHICS mode, switching to the SUSPEND_CONSOLE fails, resulting in vt_waitactive() waiting indefinitely or until the task is interrupted. This patch tests if a console switch can occur in set_console() and returns early if a console switch is not possible. [akpm@linux-foundation.org: cleanup] Signed-off-by: Andrew Johnson Acked-by: Pavel Machek Cc: "Antonino A. Daplas" Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 1174cf730179d8f029b9e93cb9a4d5bfb08d1202 Author: Vasily Averin Date: Fri Mar 16 13:38:24 2007 -0800 [PATCH] smbfs: double free memory corruption smbfs allocates rq_trans2buffer to handle server's multi transaction2 response messages. As struct smb_request may be reused, rq_trans2buffer is freed before each new request. However if last servers's response is not multi but single trans2 message then new rq_trans2buffer is not allocated but last smb_rput still tries to free it again. To prevent this issue rq_trans2buffer pointer should be set to NULL after kfree. Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 833f80627d10d370ea91b96de254850361c3a2fc Author: Geert Uytterhoeven Date: Fri Mar 16 13:38:23 2007 -0800 [PATCH] bool fbdevs must depend on FB = y Frame buffer device drivers that cannot be built as modules must depend on `FB = y'. Correct the 3 remaining offenders. Signed-off-by: Geert Uytterhoeven Cc: Al Viro Cc: "Antonino A. Daplas" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b228b8e5bf96b740a70871c1a248bb65c267f5f2 Author: Michael Halcrow Date: Fri Mar 16 13:38:22 2007 -0800 [PATCH] eCryptfs: fix possible NULL ptr deref in ecryptfs_d_release() ecryptfs_d_release() first dereferences a pointer (via ecryptfs_dentry_to_lower()) and then afterwards checks to see if the pointer it just dereferenced is NULL (via ecryptfs_dentry_to_private()). This patch moves all of the work done on the dereferenced pointer inside a block governed by the condition that the pointer is non-NULL. Signed-off-by: Michael Halcrow Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ad28d94abb1313bdf27e196676292c493f92f824 Author: Thomas Gleixner Date: Fri Mar 16 13:38:21 2007 -0800 [PATCH] hrtimer: fix up unlocked access to wall_to_monotonic commit f4304ab21513b834c8fe3403927c60c2b81a72d7 (HZ free NTP) moved the access to wall_to_monotonic in hrtimer_get_softirq_time() out of the xtime_lock protection. Move it back into the seq_lock section. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c6ca97d26a7efe9488174336bc67fdaea01aad49 Author: Atsushi Nemoto Date: Fri Mar 16 13:38:20 2007 -0800 [PATCH] SPI: at25: do not use pointer before assignment Prevents a potential oops with CONFIG_SPI_DEBUG given flakey hardware or incorrect configuration. Signed-off-by: Atsushi Nemoto Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 13788ccc41ceea5893f9c747c59bc0b28f2416c2 Author: Thomas Gleixner Date: Fri Mar 16 13:38:20 2007 -0800 [PATCH] hrtimer: prevent overrun DoS in hrtimer_forward() hrtimer_forward() does not check for the possible overflow of timer->expires. This can happen on 64 bit machines with large interval values and results currently in an endless loop in the softirq because the expiry value becomes negative and therefor the timer is expired all the time. Check for this condition and set the expiry value to the max. expiry time in the future. The fix should be applied to stable kernel series as well. Signed-off-by: Thomas Gleixner Acked-by: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d8ad7e0b84bde480d295ef1e0381c0c6050f57b3 Author: Antonino A. Daplas Date: Fri Mar 16 13:38:18 2007 -0800 [PATCH] savagefb: Fix compile error if debugging is enabled SavagePrintRegs() requires struct savagefb_par. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5b600464f0514efd49d24182daf0e9d62cf8bb8f Author: Antonino A. Daplas Date: Fri Mar 16 13:38:18 2007 -0800 [PATCH] savagefb: Fix black screen on load in Savage IX This is a hack that seems to kick start the 2D engine of the Savage IX in some Toshiba laptops. Without this, the laptop starts with a black screen and occasionally crashes X. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e52e15d3c153b88c4536cf18214fac18481c888a Author: Ondrej Zajicek Date: Fri Mar 16 13:38:16 2007 -0800 [PATCH] sstfb: fix pixclock setting on Voodoo 1/2 cards Pixclock setting in sstfb didn't work with my Voodoo 2 card with ICS 5342 DAC (this DAC requires two consecutive writes to one of its registers to program pixclock - maybe first write merged with second). Signed-off-by: Ondrej Zajicek Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28735a7253a6c24364765e80a5428b4a151fccc2 Author: David Brownell Date: Fri Mar 16 13:38:14 2007 -0800 [PATCH] gpio_direction_output() needs an initial value It's been pointed out that output GPIOs should have an initial value, to avoid signal glitching ... among other things, it can be some time before a driver is ready. This patch corrects that oversight, fixing - documentation - platforms supporting the GPIO interface - users of that call (just one for now, others are pending) There's only one user of this call for now since most platforms are still using non-generic GPIO setup code, which in most cases already couples the initial value with its "set output mode" request. Note that most platforms are clear about the hardware letting the output value be set before the pin direction is changed, but the s3c241x docs are vague on that topic ... so those chips might not avoid the glitches. Signed-off-by: David Brownell Acked-by: Andrew Victor Acked-by: Milan Svoboda Acked-by: Haavard Skinnemoen Cc: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a836f5856ae46ccb2464ea76031ea05ae967b832 Author: Chris Lesiak Date: Fri Mar 16 13:38:13 2007 -0800 [PATCH] spi: destroy workqueue after spi_unregister_master Fix a bug in the cleanup of an spi_bitbang bus. The workqueue associated with the bus was destroyed before the call to spi_unregister_master. That meant that spi devices on that bus would be unable to do IO in their remove method. The shutdown flag should have been able to prevent a segfault, but was never getting set. By waiting to destroy the workqueue until after the master is unregistered, devices are able to do IO in their remove methods. An added benefit is that neither the shutdown flag nor a wait for the queue of messages to empty is needed. Signed-off-by: Chris Lesiak Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 65b8291c4000e5f38fc94fb2ca0cb7e8683c8a1b Author: Zach Brown Date: Fri Mar 16 13:38:11 2007 -0800 [PATCH] dio: invalidate clean pages before dio write This patch fixes a user-triggerable oops that was reported by Leonid Ananiev as archived at http://lkml.org/lkml/2007/2/8/337. dio writes invalidate clean pages that intersect the written region so that subsequent buffered reads go to disk to read the new data. If this fails the interface tries to tell the caller that the cache is inconsistent by returning EIO. Before this patch we had the problem where this invalidation failure would clobber -EIOCBQUEUED as it made its way from fs/direct-io.c to fs/aio.c. Both fs/aio.c and bio completion call aio_complete() and we reference freed memory, usually oopsing. This patch addresses this problem by invalidating before the write so that we can cleanly return -EIO before ->direct_IO() has had a chance to return -EIOCBQUEUED. There is a compromise here. During the dio write we can fault in mmap()ed pages which intersect the written range with get_user_pages() if the user provided them for the source buffer. This is a crazy thing to do, but we can make it mostly work in most cases by trying the invalidation again. The compromise is that we won't return an error if this second invalidation fails if it's an AIO write and we have -EIOCBQUEUED. This was tested by having two processes race performing large O_DIRECT and buffered ordered writes. Within minutes ext3 would see a race between ext3_releasepage() and jbd holding a reference on ordered data buffers and would cause invalidation to fail, panicing the box. The test can be found in the 'aio_dio_bugs' test group in test.kernel.org/autotest. After this patch the test passes. Signed-off-by: Zach Brown Signed-off-by: Benjamin LaHaise Cc: Leonid Ananiev Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 00e9fa2d6421fbbefb4c02821a1e779a3ce47781 Author: Nick Piggin Date: Fri Mar 16 13:38:10 2007 -0800 [PATCH] mm: fix madvise infinine loop madvise(MADV_REMOVE) can go into an infinite loop or cause an oops if the call covers a region from the start of a vma, and extending past that vma. Signed-off-by: Nick Piggin Cc: Badari Pulavarty Acked-by: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0465fc0a1c42e18438d391f3a7e661493a9ad68e Author: Evgeniy Dushistov Date: Fri Mar 16 13:38:09 2007 -0800 [PATCH] ufs2: tindirect truncate fix During modification of code to support UFS2 writing, the case with "three indirect" blocks in truncate path was missed, this patch fixes this situation. Signed-off-by: Evgeniy Dushistov Acked-by: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4b25a37e2093146c1f9aa436b832b7d4ef880ca4 Author: Evgeniy Dushistov Date: Fri Mar 16 13:38:09 2007 -0800 [PATCH] ufs: zeroize the rest of block in truncate This patch fix behaviour in such test scenario: lseek(fd, BIG_OFFSET) write(fd, buf, sizeof(buf)) truncate(BIG_OFFSET) truncate(BIG_OFFSET + sizeof(buf)) read(fd, buf...) Because of if file big enough(BIG_OFFSET) we start allocate space by block, ordinary block size > page size, so we should zeroize the rest of block in truncate(except last framgnet, about which VFS should care), to not get garbage, when we extend file. Also patch corrects conversion from pointer to block to physical block number, this helps in case of not common used UFS types. And add to debug output inode number. Signed-off-by: Evgeniy Dushistov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5431bf97ce69065ed07de1ff12543d0800817b83 Author: Evgeniy Dushistov Date: Fri Mar 16 13:38:08 2007 -0800 [PATCH] ufs: prepare write + change blocks on the fly This fixes "change blocks numbers on the fly" in case when "prepare write page" is in the call chain, in this case some buffers may be not uptodate and not mapped, we should care to map them and load from disk. This patch was tested with: - ufs regressions simple tests - fsx-linux - ltp(20060306) - untar and build kernel Signed-off-by: Evgeniy Dushistov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2189850f42beff23af32d847bd043cd1d1811a80 Author: Evgeniy Dushistov Date: Fri Mar 16 13:38:07 2007 -0800 [PATCH] ufs2: more correct work with time This patch corrects work with time in UFS2 case. 1) According to UFS2 disk layout modification/access and so on "time" should be hold in two variables one 64bit for seconds and another 32bit for nanoseconds, at now for some unknown reason we suppose that "inode time" holds in three variables 32bit for seconds, 32bit for milliseconds and 32bit for nanoseconds. 2) We set amount of nanoseconds in "VFS inode" to 0 during read, instead of getting values from "on disk inode"(this should close http://bugzilla.kernel.org/show_bug.cgi?id=7991). Signed-off-by: Evgeniy Dushistov Cc: Bjoern Jacke Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 94985134b7b46848267ed6b734320db01c974e72 Author: Rafael J. Wysocki Date: Fri Mar 16 13:38:06 2007 -0800 [PATCH] swsusp: disable nonboot CPUs before entering platform suspend Prevent the WARN_ON() in arch/x86_64/kernel/acpi/sleep.c:init_low_mapping() from triggering by disabling nonboot CPUs before we finally enter the platform suspend. Signed-off-by: Rafael J. Wysocki Acked-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 886c5952950ffed0e8ca3eb9efdc2728bfc144d3 Author: Rafael J. Wysocki Date: Fri Mar 16 13:38:06 2007 -0800 [PATCH] swsusp: Fix resume error path in platform mode If swsusp is using the platform mode during the resume and the image cannot be read, the platform mode should be switched off before software_resume() returns. Make it happen. Signed-off-by: Rafael J. Wysocki Acked-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 765e3d8a71bbc1f3400667d5cfcfd7b03382d587 Author: David Brownell Date: Fri Mar 16 13:38:05 2007 -0800 [PATCH] rm pointless dmaengine exports This removes several pointless exports from drivers/dma/dmaengine.c; the dma_async_memcpy_*() functions are inlined by so those exports are inappropriate. It also moves the existing EXPORT_SYMBOL declarations next to their functions, so it's now trivial to confirm one-to-one correspondence between exports and nonstatic symbols. Signed-off-by: David Brownell Signed-off-by: Dan Williams Acked-by: Chris Leech Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bed31ed9e1cd71d98ff0bc9212100adee523a10a Author: Andy Isaacson Date: Fri Mar 16 13:38:04 2007 -0800 [PATCH] fix read past end of array in md/linear.c When iterating through an array, one must be careful to test one's index variable rather than another similarly-named variable. The loop will read off the end of conf->disks[] in the following (pathological) case: % dd bs=1 seek=840716287 if=/dev/zero of=d1 count=1 % for i in 2 3 4; do dd if=/dev/zero of=d$i bs=1k count=$(($i+150)); done % ./vmlinux ubd0=root ubd1=d1 ubd2=d2 ubd3=d3 ubd4=d4 # mdadm -C /dev/md0 --level=linear --raid-devices=4 /dev/ubd[1234] adding some printks, I saw this: [42949374.960000] hash_spacing = 821120 [42949374.960000] cnt = 4 [42949374.960000] min_spacing = 801 [42949374.960000] j=0 size=820928 sz=820928 [42949374.960000] i=0 sz=820928 hash_spacing=820928 [42949374.960000] j=1 size=64 sz=64 [42949374.960000] j=2 size=64 sz=128 [42949374.960000] j=3 size=64 sz=192 [42949374.960000] j=4 size=1515870810 sz=1515871002 Cc: Gautham R Shenoy Acked-by: Neil Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 48670a1e018a9c0b83dc78e3b71ffb26391ee4b6 Author: David Brownell Date: Fri Mar 16 13:38:02 2007 -0800 [PATCH] reduce pnp syslog spam Make some normal code paths in PNP stop issuing syslog spam. Since PNP issues calls regardless of device capablities, it's no surprise when some of those devices don't support those calls! Signed-off-by: David Brownell Cc: Adam Belay Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f510aa3bdb095c5253f6bee9e0f5a3a9ac69ded4 Author: Ralf Baechle Date: Fri Mar 16 21:58:37 2007 +0000 [MIPS] Kconfig: Move missplaced NR_CPUS default from SMTC to VSMP. Signed-off-by: Ralf Baechle commit 49edd098e298b1f94748b7eb9c76374eeca7fb93 Author: Ralf Baechle Date: Fri Mar 16 16:10:36 2007 +0000 [MIPS] Lockdep: Fix recursion bug. trace_hardirqs_off -> atomic_inc -> local_irq_restore -> trace_hardirqs_off Signed-off-by: Ralf Baechle commit 46230aa6ea1671690e3e5efa2a961fc0745fe9b5 Author: Ralf Baechle Date: Fri Mar 16 12:16:27 2007 +0000 [MIPS] RTLX: Handle copy_*_user return values. Signed-off-by: Ralf Baechle commit bc4809e939b91c9642f1ddaea732e2d432ee6af6 Author: Ralf Baechle Date: Thu Mar 15 17:13:47 2007 +0000 [MIPS] RTLX: Protect rtlx_{read,write} with mutex. Signed-off-by: Ralf Baechle commit 61dcc6f4d9ed5db71f4f0be9026bdd09f1a7dc06 Author: Ralf Baechle Date: Thu Mar 15 17:10:16 2007 +0000 [MIPS] RTLX: Harden against compiler reordering and optimization. RTLX communication is based on lock-free shared memory buffers. It happened to be working by luck so far but relies on the optimizer doing certain optimizations but no reordering. Fixed by inserting proper barriers in rtlx_read and rtlx_write, and careful pointer dereferencing. Signed-off-by: Ralf Baechle commit 9e34682026572f07328208f7d2b2c611d2001844 Author: Ralf Baechle Date: Thu Mar 15 17:08:28 2007 +0000 [MIPS] RTLX: Don't use volatile; it's fragile. Signed-off-by: Ralf Baechle commit 080e948c079f7aa7c4dce7f14b046519886ccabc Author: Ralf Baechle Date: Tue Mar 13 08:59:54 2007 +0000 [MIPS] Lasat: Downgrade 64-bit kernel from experimental to broken. Signed-off-by: Ralf Baechle commit 65f8ebe0630ffadce19a3ed11c7eb41bc6cfabce Author: Ralf Baechle Date: Sat Mar 10 18:22:25 2007 +0000 [MIPS] Compat: Fix build if CONFIG_SYSVIPC is disabled. Signed-off-by: Ralf Baechle commit 2c35f813f3e98f70534b5c2d82e5e2079034fc50 Author: Ralf Baechle Date: Sat Mar 10 04:56:33 2007 +0000 [CHAR] lcd: Fix two warnings. In file included from drivers/char/lcd.c:23: include/linux/mc146818rtc.h:104:1: warning: "RTC_IO_EXTENT" redefined drivers/char/lcd.c:15:1: warning: this is the location of the previous definition drivers/char/lcd.c:35: warning: 'lcd_lock' defined but not used c316eb1eee2c803c33b1f826fe744c922d2e354f deleted the last code using lcd_lock, so delete definition of lcd_lock. The definition of RTC_IO_EXTENT is unused and probably always was only debree copied from drivers/char/rtc.c. Signed-off-by: Ralf Baechle commit 53dc80287da43b75df2fe2658651d3c5160dad8e Author: Atsushi Nemoto Date: Sat Mar 10 01:07:45 2007 +0900 [MIPS] FPU ownership management & preemption fixes Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit c6a2f4679331206ef5d353fc9a6cda2fa4aef8c6 Author: Atsushi Nemoto Date: Sat Mar 10 01:03:48 2007 +0900 [MIPS] Check FCSR for pending interrupts, alternative version Commit 6d6671066a311703bca1b91645bb1e04cc983387 is incomplete and misses non-r4k CPUs. This patch reverts the commit and fixes in other way. o Do FCSR checking in caller of restore_fp_context. o Send SIGFPE if the signal handler set any FPU exception bits. Signed-off-by: Atsushi Nemoto Signed-off-by: Ralf Baechle commit f1dbf8e718ef0ddb196a28bcc71925ac7da881af Author: Ralf Baechle Date: Sat Mar 10 03:26:56 2007 +0000 [MIPS] IP27, IP35: Fix warnings. include/asm-mips/mach-ip27/dma-coherence.h:22: warning: 'plat_map_dma_mem' defined but not used include/asm-mips/mach-ip27/dma-coherence.h:41: warning: 'plat_unmap_dma_mem' defined but not used include/asm-mips/mach-ip32/dma-coherence.h:30: warning: 'plat_map_dma_mem' defined but not used include/asm-mips/mach-ip32/dma-coherence.h:63: warning: 'plat_unmap_dma_mem' defined but not used These functions are meant to be inlined anyway. Signed-off-by: Ralf Baechle commit d1acb4210aaa9bdc413d276dbc96d0a23ada97ba Author: David S. Miller Date: Fri Mar 16 17:20:28 2007 -0700 [SPARC64]: Get DEBUG_PAGEALLOC working again. We have to make sure to use base-pagesize TLB entries even during the early transition period where we need TLB miss handling but don't have the kernel page tables setup yet for the linear region. Also, it is necessary therefore to not use the 4MB TSB for these translations, and instead use the normal kernel TSB. This allows us to also get rid of the 4MB tsb for debug builds which shrinks the kernel a little bit. Signed-off-by: David S. Miller commit d35690beda1429544d46c8eb34b2e3a8c37ab299 Author: Masayuki Nakagawa Date: Fri Mar 16 16:14:03 2007 -0700 [IPV6]: ipv6_fl_socklist is inadvertently shared. The ipv6_fl_socklist from listening socket is inadvertently shared with new socket created for connection. This leads to a variety of interesting, but fatal, bugs. For example, removing one of the sockets may lead to the other socket's encountering a page fault when the now freed list is referenced. The fix is to not share the flow label list with the new socket. Signed-off-by: Masayuki Nakagawa Signed-off-by: David S. Miller commit 53cdcc04c1e85d4e423b2822b66149b6f2e52c2c Author: John Heffner Date: Fri Mar 16 15:04:03 2007 -0700 [TCP]: Fix tcp_mem[] initialization. Change tcp_mem initialization function. The fraction of total memory is now a continuous function of memory size, and independent of page size. Signed-off-by: John Heffner Signed-off-by: David S. Miller commit 3e6b3b2e34ac2c72fa05b5e4b20bd88d64c298dc Author: Alexey Dobriyan Date: Fri Mar 16 15:00:46 2007 -0700 [NET]: Copy mac_len in skb_clone() as well ANK says: "It is rarely used, that's wy it was not noticed. But in the places, where it is used, it should be disaster." Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit d5cc4a73a5b5c8374b810d5371e9e7ed05c1e02c Author: Robert Olsson Date: Fri Mar 16 15:00:07 2007 -0700 [IPV4]: Do not disable preemption in trie_leaf_remove(). Hello, Just discussed this Patrick... We have two users of trie_leaf_remove, fn_trie_flush and fn_trie_delete both are holding RTNL. So there shouldn't be need for this preempt stuff. This is assumed to a leftover from an older RCU-take. > Mhh .. I think I just remembered something - me incorrectly suggesting > to add it there while we were talking about this at OLS :) IIRC the > idea was to make sure tnode_free (which at that time didn't use > call_rcu) wouldn't free memory while still in use in a rcu read-side > critical section. It should have been synchronize_rcu of course, > but with tnode_free using call_rcu it seems to be completely > unnecessary. So I guess we can simply remove it. Signed-off-by: Robert Olsson Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 92b35e910fe14e6e3a5d498157375fb55ea5fd03 Author: Andi Kleen Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] x86: Export _proxy_pda for gcc 4.2 The symbol is not actually used, but the compiler unforunately generates a (unused) reference to it. This can happen even in modules. So export it. Signed-off-by: Andi Kleen commit 28f36f8fbf5f3718f7095055c1911a67d200dda1 Author: Guillaume Chazarain Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] i386: Don't use the TSC in sched_clock if unstable http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f9690982b8c2f9a2c65acdc113e758ec356676a3 caused a regression by letting sched_clock use the TSC even when cpufreq disabled it. This caused scheduling weirdnesses. Signed-off-by: Guillaume Chazarain Signed-off-by: Andi Kleen commit 43999d9e4e3133bfe0a55589037796386b012a68 Author: Sam Ravnborg Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] x86-64: fix section mismatch warnings Fix the following section mismatch warnings on x86_64: (build using defconfig) WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:mtrr_bp_init from .text between 'identify_cpu' (at offset 0x65eb) and 'IRQ0x20_interrupt' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data: from .text between 'finish_e820_parsing' (at offset 0x7dc2) and 'early_panic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:e820_print_map from .text between 'finish_e820_parsing' (at offset 0x7de1) and 'early_panic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:num_processors from .text between 'acpi_unmap_lsapic' (at offset 0xc88f) and 'acpi_register_ioapic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:disabled_cpus from .text between 'MP_processor_info' (at offset 0x11f35) and 'mp_register_lapic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:num_processors from .text between 'MP_processor_info' (at offset 0x11f6e) and 'mp_register_lapic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:num_processors from .text between 'MP_processor_info' (at offset 0x11f93) and 'mp_register_lapic' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:fix_aperture from .text between 'gart_parse_options' (at offset 0x15517) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:fix_aperture from .text between 'gart_parse_options' (at offset 0x1552c) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_allowed from .text between 'gart_parse_options' (at offset 0x1553d) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_allowed from .text between 'gart_parse_options' (at offset 0x15552) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_allowed from .text between 'gart_parse_options' (at offset 0x15561) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_allowed from .text between 'gart_parse_options' (at offset 0x15577) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:fallback_aper_force from .text between 'gart_parse_options' (at offset 0x1558a) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:fallback_aper_order from .text between 'gart_parse_options' (at offset 0x155bf) and 'iommu_full' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:timer_over_8254 from .text between 'ati_bugs' (at offset 0x16344) and 'via_bugs' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:timer_over_8254 from .text between 'ati_bugs' (at offset 0x16356) and 'via_bugs' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_allowed from .text between 'via_bugs' (at offset 0x16380) and 'nvidia_bugs' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:iommu_aperture_disabled from .text between 'via_bugs' (at offset 0x16397) and 'nvidia_bugs' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:acpi_use_timer_override from .text between 'nvidia_bugs' (at offset 0x163a7) and 'arch_unregister_cpu' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:nvidia_hpet_check from .text between 'nvidia_bugs' (at offset 0x163b1) and 'arch_unregister_cpu' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data: from .text between 'nvidia_bugs' (at offset 0x163be) and 'arch_unregister_cpu' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data: from .text between 'nvidia_bugs' (at offset 0x163d1) and 'arch_unregister_cpu' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.data:acpi_skip_timer_override from .text between 'nvidia_bugs' (at offset 0x163e1) and 'arch_unregister_cpu' WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:quirk_intel_irqbalance from .text between 'intel_bugs' (at offset 0x1633c) and 'ati_bugs' But adds: WARNING: arch/x86_64/kernel/built-in.o - Section mismatch: reference to .init.text:get_mtrr_state from .text between 'mtrr_bp_init' (at offset 0xb887) and 'ipi_handler' The warnings does not show up during a normal build due to kbuild failing to check for section mismatch in vmlinux. To see these warnings run: scripts/mod/modpost arch/x86_64/kernel/built-in.o kbuild will be fixed but the 'noise-level' had to be decresed first. There remains a few section mismatch warnigns for x86_64 for areas where I did not feel confident. Signed-off-by: Sam Ravnborg Signed-off-by: Andi Kleen commit 302cf930cbcc6ca24d7e00cffde3d93534ea5405 Author: Andi Kleen Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] i386: Enforce GPLness of VMI ROM VMI ROMs are pretty intimate to the kernel, so enforce their GPLness. No \0 tricks checking for now This rules out BSD/MIT modules for now, sorry -- the trouble is those could come without source. Acked-by: Zachary Amsden Acked-by: Ingo Molnar Signed-off-by: Andi Kleen commit a9bc3bfd1226c3f09cf321374f934b3892929872 Author: Alexandr Andreev Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] x86-64: wire up compat sched_rr_get_interval(2) sys32_sched_rr_get_interval() uses compat_timespec but wasn't used itself. Signed-off-by: Alexandr Andreev Signed-off-by: Alexey Dobriyan Signed-off-by: Andi Kleen commit 33a40bfd4f41af71231192b8024efba79123f198 Author: Andi Kleen Date: Fri Mar 16 21:07:36 2007 +0100 [PATCH] i386: Update defconfig Signed-off-by: Andi Kleen commit e9781093b59e97a6b216415263e3bee710ef3eb0 Author: Andi Kleen Date: Fri Mar 16 21:07:35 2007 +0100 [PATCH] x86-64: Update defconfig Signed-off-by: Andi Kleen commit 4d881901b8c2167884d213eb546ffffc9e5e35ac Author: Michal Schmidt Date: Fri Mar 16 12:42:59 2007 +0100 [PATCH] airo: Fix an error path memory leak The airo driver leaks memory if request_irq() fails. Signed-off-by: Michal Schmidt Signed-off-by: John W. Linville commit 21665a69e6c0c3e383eaef417f0ddbd16bdb69e3 Author: Larry Finger Date: Wed Mar 14 10:32:07 2007 -0500 [PATCH] bcm43xx: MANUALWLAN fixes During testing of bcm43xx interference mitigation, two problems were discovered: (1) When the MANUALWLAN mode was set, routines _stack_save and _stack_restore generated assertions that were traced to saving ILT registers with addresses > 0xFFF. This problem was fixed by adding one bit to the field used for the offset, and subtracting one bit from the space used for the id. (2) In MANUALWLAN mode, the IRQ XMIT errors are generated. The cause of these errors has not yet been located. Any suggestions on debugging this problem would be greatly appreciated. Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit 5f1545bc45a33361d6bb2fb44af7c35bcd733b9d Author: Joachim Deguara Date: Fri Mar 16 15:01:36 2007 +0100 [ALSA] hda-intel - Fix HDA buffer alignment From the HDA spec it appears that the buffers written to the BDL and sent to a codec must be 128 byte aligned (section 4.5.1). The alignment was not happening especially when playing 6 channels. This patch set the alignment of buffers and periods to 128 bytes. Signed-off-by: Joachim Deguara Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit f144e7c7272bf527c380bffaa5e789dc28a09d8d Author: Mathieu Desnoyers Date: Sat Mar 10 03:23:03 2007 -0500 [POWERPC] Fix atomicity of TIF update in flush_thread() Fix atomicity of TIF update in flush_thread() for powerpc Fixes it correctly with *_ti_thread_flag. Race : parent process executing : sys_ptrace() (lock_kernel()) (ptrace_get_task_struct(pid)) arch_ptrace() ptrace_detach() ptrace_disable(child); clear_singlestep(child); clear_tsk_thread_flag(child, TIF_SINGLESTEP); (which clears the TIF_SINGLESTEP flag atomically from a different process) (put_task_struct(child)) (unlock_kernel()) And at the same time, in the child process : sys_execve() do_execve() search_binary_handler() load_elf_binary() flush_old_exec() flush_thread() doing a non-atomic thread flag update Applies on 2.6.20. Signed-off-by: Mathieu Desnoyers Signed-off-by: Paul Mackerras commit 38e2aff670b681b6cc267aca307633cbcb48864b Author: Steve French Date: Fri Mar 16 05:12:53 2007 +0000 [CIFS] Do not negotiate new POSIX_PATH_OPERATIONS_CAP yet Samba server now expects that clients which send the new POSIX_PATH_OPERATIONS_CAP send all opens with this new SMB - and expects that clients that could send the new posix open/create but don't as indicating that they really want Windows semantics on that handle (which allows Samba to support clients which want to support both types of behaviors on different handles on the same mount) We will put this capability back in the SetFSInfo negotiation with servers like Samba when the new POSIXCreate (create/open/mkdir) code is finished. Signed-off-by: Steve French commit 96e89afe6da630dc54cfbca33c2c6a7ab9b6c11b Author: Henrique de Moraes Holschuh Date: Thu Mar 15 16:15:06 2007 -0300 ACPI: ibm-acpi: allow module to load when acpi notifiers can't be set (v2) This patch allows for ibm-acpi to coexist (with diminished functionality) with other drivers like ACPI_BAY. ibm-acpi will simply disable the functions it is not able to register ACPI notifiers for. Signed-off-by: Henrique de Moraes Holschuh Cc: Chris Wedgwood Cc: Kristen Carlson Accardi Signed-off-by: Len Brown commit db98e0b434a6265c451ffe94ec0a29b8d0aaf587 Author: Linus Torvalds Date: Thu Mar 15 17:20:01 2007 -0700 Linux 2.6.21-rc4 Signed-off-by: Linus Torvalds commit e7b0d26a86943370c04d6833c6edba2a72a6e240 Author: Alan Stern Date: Thu Mar 15 15:51:28 2007 -0400 [PATCH] sysfs: reinstate exclusion between method calls and attribute unregistration This patch (as869) reinstates the mutual exclusion between sysfs attribute method calls and attribute unregistration. The previously-reported deadlocks have been fixed, and this exclusion is by far the simplest way to avoid races during driver unbinding. The check for orphaned read-buffers has been moved down slightly, so that the remainder of a partially-read buffer will still be available to userspace even after the attribute has been unregistered. Signed-off-by: Alan Stern Cc: Hugh Dickins Cc: Cornelia Huck Cc: Oliver Neukum Signed-off-by: Linus Torvalds commit d9a9cdfb078d755e648d53ec25b7370f84ee5729 Author: Alan Stern Date: Thu Mar 15 15:50:34 2007 -0400 [PATCH] sysfs and driver core: add callback helper, used by SCSI and S390 This patch (as868) adds a helper routine for device drivers that need to set up a callback to perform some action in a different process's context. This is intended for use by attribute methods that want to unregister themselves or their parent device. Attribute method calls are mutually exclusive with unregistration, so such actions cannot be taken directly. Two attribute methods are converted to use the new helper routine: one for SCSI device deletion and one for System/390 ccwgroup devices. Signed-off-by: Alan Stern Cc: Hugh Dickins Cc: Cornelia Huck Cc: Oliver Neukum Signed-off-by: Linus Torvalds commit 0803c30c23d39e1db88d06ef59c30fa5ef6c3ada Author: Stelian Pop Date: Thu Mar 15 16:54:27 2007 +0100 [ARM] 4264/1: ldrex/strex syntax errors with recent compilers Trying to build some code using atomic_clear_mask() on a ARM v6 processor with a recent compiler (tried with gcc version 4.1.1 (CodeSourcery ARM Sourcery G++ 2006q3-26), but all gcc > 4.1 might be affected) results in the following: /tmp/ccWKLJV8.s: Assembler messages: /tmp/ccWKLJV8.s:581: Error: instruction does not accept this addressing mode -- `ldrex r0,r3' /tmp/ccWKLJV8.s:583: Error: instruction does not accept this addressing mode -- `strex r1,r0,r3' Older gcc (like gcc version 4.0.0 (DENX ELDK 4.1 4.0.0)) have no problem with this. The patch below fixes the compile error. I also verified that gcc-4.0.0 generates identical code using both forms. Signed-off-by: Stelian Pop Acked-by: Catalin Marinas Signed-off-by: Russell King commit d2a900365b8963d7ca46f05d8e7176d1be3cc71d Author: broonie@sirena.org.uk Date: Wed Mar 14 19:49:15 2007 +0000 natsemi: Avoid IntrStatus lossage if RX state machine resets. This patch fixes the poll routine for the natsemi driver so that if the driver detects an RX state machine lockup then no interrupts will be lost while the driver recovers from that. Signed-Off-By: Mark Brown Signed-off-by: Jeff Garzik commit 069f8256362b7a17da532f0631cee73b4cfee65b Author: broonie@sirena.org.uk Date: Wed Mar 14 19:49:14 2007 +0000 natsemi: Fix NAPI for interrupt sharing The interrupt status register for the natsemi chips is clear on read and was read unconditionally from both the interrupt and from the NAPI poll routine, meaning that if the interrupt service routine was called (for example, due to a shared interrupt) while a NAPI poll was scheduled interrupts could be missed. This patch fixes that by ensuring that the interrupt status register is only read by the interrupt handler when interrupts are enabled from the chip. It also reverts a workaround for this problem from the netpoll hook and improves the trace for interrupt events. Thanks to Sergei Shtylyov for spotting the issue, Mark Huth for a simpler method and Simon Blake for testing resources. Signed-Off-By: Mark Brown Signed-off-by: Jeff Garzik commit 14fdd90ef2ec1878d6851ec4dd8d5abb2cef098c Author: broonie@sirena.org.uk Date: Wed Mar 14 19:49:13 2007 +0000 natsemi: Consistently use interrupt enable/disable functions The natsemi drivers include functions for enabling and disabling interrupts from the chip but these are not used in all code paths. This patch changes the code paths that touch the interrupt enable register to use the functions. In all cases this adds an extra PCI read to post the operation but since none of these are in fast paths this shouldn't be too much of a problem. Signed-Off-By: Mark Brown Signed-off-by: Jeff Garzik commit b58ecad8d6ca83e97cd2928a439efb49267539dc Author: Linsys Contractor Mithlesh Thukral Date: Tue Mar 13 04:15:06 2007 -0800 NetXen: Fix softlockup seen during hardware access NetXen: This will fix a softlock seen on some machines. The reason was too much time was spent waiting for hardware access to go through. Signed-off by: Mithlesh Thukral Signed-off-by: Jeff Garzik commit 8b902aea40544bc9e4de913b491dc3a3411fd5d0 Author: Linsys Contractor Mithlesh Thukral Date: Tue Mar 13 04:13:13 2007 -0800 NetXen: Bug fix for Jumbo frames on XG card NetXen: Set the MTU for the right port depending upon the port number for XG cards. Signed-off by: Mithlesh Thukral Signed-off-by: Jeff Garzik commit 2eb3e621c4e07e9e7200dbb66f0433b4caafb8e7 Author: Stephen Hemminger Date: Mon Mar 12 15:16:26 2007 -0700 skge: set mac address bonding fix When bonding does fail over it calls set_mac_address. When this happens as the result of another port going down, the phy_mutex that is common to both ports is held, so it deadlocks. Setting the address doesn't need to do anything that needs the phy_mutex, it already has the RTNL to protect against other admin actions. This change just disables the receiver to avoid any hardware confusion while address is changing. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit a8a5d06775f54ab2d23ad6455db399c15a664feb Author: Takashi Iwai Date: Thu Mar 15 15:10:28 2007 +0100 [ALSA] hda-codec - Add model for HP Compaq d5750 Added model=hp-3013 for HP Compaq d5750 with ALC260 codec chip. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 6f0778d8726ab647ff80c98c1545fdf839f7bcac Author: Nicolas Boichat Date: Thu Mar 15 12:38:15 2007 +0100 [ALSA] hda-codec - Add support for MacBook Pro 1st generation Fix audio on Macbook Pro 1st generation. Signed-off-by: Nicolas Boichat Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 09fe58356d148ff66901ddf639e725ca1a48a0af Author: Len Brown Date: Sun Mar 11 03:32:00 2007 -0400 ACPI: parse 2nd MADT by default http://bugzilla.kernel.org/show_bug.cgi?id=7465 Signed-off-by: Len Brown commit a8f4af6dc6600980885c594f52eecd60edd62013 Author: Len Brown Date: Thu Mar 15 04:10:36 2007 -0400 ACPICA: revert "acpi_serialize" changes This reverts 977a6226feae3e2c10a4d8227625ff0f04b49239 and reverts 1ba753acb372c2955a4843302e92e49ce82e2fea and updates acpi_ev_queue_notify_request() to restore the previous implementation of the "acpi_serialize" workaround. http://bugzilla.kernel.org/show_bug.cgi?id=8171 Signed-off-by: Len Brown commit 8ce5e3e45e01ffab38a9f03900181132b9068543 Author: Linus Torvalds Date: Wed Mar 14 17:50:48 2007 -0700 Disable NMI watchdog by default properly This reverts commit 6ebf622b2577c50b1f496bd6a5e8739e55ae7b1c and replaces it with one that actually works. Signed-off-by: Linus Torvalds commit 69300436ca382a4753044142ae3a2c8099e70215 Author: Al Viro Date: Wed Mar 14 09:20:40 2007 +0000 [PATCH] m68k dma-mapping: gfp_t annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 27d871833e37ce4ef9a4d8a153598da1b429a490 Author: Al Viro Date: Wed Mar 14 09:20:30 2007 +0000 [PATCH] paride endianness annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit ecb7524c5d85c04d1b396f80bf4c765db5f3f442 Author: Al Viro Date: Wed Mar 14 09:20:20 2007 +0000 [PATCH] kill bogus casts in amd64 uaccess.h Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 7ccec1b94e456b01cbef7cfb1bc97e2b76f24ab5 Author: Al Viro Date: Wed Mar 14 09:20:10 2007 +0000 [PATCH] atl1 trivial endianness misannotations NB: driver is choke-full of code that will break on big-endian; as long as the hardware is onboard-only we can live with that, but sooner or later that'll need fixing. Signed-off-by: Al Viro Acked-by: Jeff Garzik Signed-off-by: Linus Torvalds commit 1be9ab056e94e23a307b8bfaacc38403b3b5a352 Author: Al Viro Date: Wed Mar 14 09:20:00 2007 +0000 [PATCH] ANSIfy powerpc floppy.h Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit b87496aa493a540b9c084b16b73f915705ebdbcc Author: Al Viro Date: Wed Mar 14 09:19:50 2007 +0000 [PATCH] hid-core endianness annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 82c05a13c9e0d782941f975eabf6c5a7928cc4d9 Author: Al Viro Date: Wed Mar 14 09:19:40 2007 +0000 [PATCH] cifs endianness annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit dfdcbcc426616811f069b741394ba8771dc58527 Author: Al Viro Date: Wed Mar 14 09:19:30 2007 +0000 [PATCH] C99 initializers, proper use of const in drivers/ps3 Signed-off-by: Al Viro Acked-by: Geert Uytterhoeven Signed-off-by: Linus Torvalds commit 23f28001f7858f0cbbcc8cc39d7a0a1346ed68e2 Author: Al Viro Date: Wed Mar 14 09:19:20 2007 +0000 [PATCH] qeth gfp_t annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 4c1f2b316878edcbd3a71f7165190f1c1b008e1e Author: Al Viro Date: Wed Mar 14 09:19:10 2007 +0000 [PATCH] cciss endian annotations Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit edceec3d6737ae2c901d9abc55f791cf3b42c470 Author: Al Viro Date: Wed Mar 14 09:19:00 2007 +0000 [PATCH] trivial ATA iomem annotations Signed-off-by: Al Viro Acked-by: Jeff Garzik Signed-off-by: Linus Torvalds commit f0f0d0c691e13a67709ab3b43137ff83210c2c10 Author: Al Viro Date: Wed Mar 14 09:18:50 2007 +0000 [PATCH] sparc: nr_free_pages() is unsigned long Signed-off-by: Al Viro Acked-by: William Irwin Signed-off-by: Linus Torvalds commit abad95f7367b68ed010a3b9c4ad6ba3c9911c7fa Author: Al Viro Date: Wed Mar 14 09:18:40 2007 +0000 [PATCH] pasemi trivial iomem annotations Signed-off-by: Al Viro Acked-by: Olof Johansson Signed-off-by: Linus Torvalds commit 750b1b815c85557fba018417be52271e4ca6b02f Author: Al Viro Date: Wed Mar 14 09:18:30 2007 +0000 [PATCH] constant should be long Signed-off-by: Al Viro Acked-by: Olof Johansson Signed-off-by: Linus Torvalds commit a31e40f614788bbc07b3eb4fcf47a16299a4fe01 Author: Al Viro Date: Wed Mar 14 09:18:20 2007 +0000 [PATCH] dmfe trivial endianness annotations Signed-off-by: Al Viro Acked-by: Jeff Garzik Signed-off-by: Linus Torvalds commit 192cd59bd93a97fd7d46f13fa07dbe328ff33257 Author: Al Viro Date: Wed Mar 14 09:18:09 2007 +0000 [PATCH] fastcall still doesn't make sense in paravirt Andi had removed a bunch of those, but one more had creeped in... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 89952d133dfbca785ae37b7da13699e4a5e1fa93 Author: Al Viro Date: Wed Mar 14 09:17:59 2007 +0000 [PATCH] misc NULL noise Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 0ae24bdedd289f5b1740404273ac5d9e20383f12 Author: Al Viro Date: Wed Mar 14 09:16:54 2007 +0000 [PATCH] rtc-cmos needs RTC_ALWAYS_BCD known Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a7124d799a674a276a566d602479c0a370274c8f Author: Al Viro Date: Wed Mar 14 09:16:44 2007 +0000 [PATCH] sparc: have dma-mapping.h include generic/dma-mapping-broken in non-PCI case Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a7c999114ecd0c69bd3970272b64d8842b765b21 Author: Al Viro Date: Wed Mar 14 09:16:34 2007 +0000 [PATCH] BLK_DEV_IDE_CELLEB dependency fix It's bool and it depends on IDE => should depend on IDE=y Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit a033f35a2206e28af8109c62b403d940ba89d2b9 Author: Al Viro Date: Wed Mar 14 09:16:24 2007 +0000 [PATCH] include of asm/pgtable.h in nfsfh is bogus not needed and actually breaks build on frv, while we are at it Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 24b29dbcf382b12b58bc33fb4d0abb13d6ddc073 Author: Al Viro Date: Wed Mar 14 09:16:14 2007 +0000 [PATCH] m32r dma-mapping.h should simply include generic/dma-mapping-broken.h ... instead of trying to duplicate its bits Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 62577fa324991146ded3d16e7ef08e7a99d2ec7e Author: Al Viro Date: Wed Mar 14 09:16:04 2007 +0000 [PATCH] fix ipath_dma_free_coherent() prototype method gets u64, not dma_addr_t Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 6df0187efc91867383195a78e262414d8843f1c9 Author: Al Viro Date: Wed Mar 14 09:15:54 2007 +0000 [PATCH] stacktrace doesn't work on uml and no, it's not the case of "let's pull bits from underlying architecture" Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit ebf88a9e7bfd7251fa80888c29b60aa4c86e2941 Author: Al Viro Date: Wed Mar 14 09:05:01 2007 +0000 [PATCH] zatm __init abuse zatm_init() and zatm_start() should be __devinit (the former is not module init, despite the name - it's a helper for PCI ->probe()) Signed-off-by: Al Viro Acked-by: Jeff Garzik Signed-off-by: Linus Torvalds commit c537b994505099b7197e7d3125b942ecbcc51eb6 Author: Al Viro Date: Wed Mar 14 09:04:51 2007 +0000 [PATCH] (uml) sparse flags for userland glue are missing $(CF) Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit bb81e6050fdc0f2303b47d9300db232571e3e42a Author: Al Viro Date: Wed Mar 14 09:04:41 2007 +0000 [PATCH] appldata build fix PGALLOC_DMA is defined only if we have CONFIG_ZONE_DMA Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit d8b3966e4c976dbf5f2fbe693b381305f7911e3d Author: Al Viro Date: Wed Mar 14 09:04:31 2007 +0000 [PATCH] const file_operations fallout Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit abf0437b420b1476b9afd56af69d1a725f51359c Author: Al Viro Date: Wed Mar 14 09:04:21 2007 +0000 [PATCH] ibmtr probe is __devinit, not __init used by ->attach() in pcmcia analog Signed-off-by: Al Viro Acked-by: Jeff Garzik Signed-off-by: Linus Torvalds commit 04ff97086b1a3237bbd1fe6390fa80fe75207e23 Author: Al Viro Date: Mon Mar 12 16:17:58 2007 +0000 [PATCH] sanitize security_getprocattr() API have it return the buffer it had allocated Acked-by: Stephen Smalley Acked-by: James Morris Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit c4823bce033be74c0fcfbcae2f1be0854fdc2e18 Author: Al Viro Date: Mon Mar 12 16:17:42 2007 +0000 [PATCH] fix deadlock in audit_log_task_context() GFP_KERNEL allocations in non-blocking context; fixed by killing an idiotic use of security_getprocattr(). Acked-by: Stephen Smalley Acked-by: James Morris Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit b36c3f84988eebf38acaccc756e05f6b70e333ab Author: Sunil Mushran Date: Mon Mar 12 13:25:44 2007 -0700 ocfs2_dlm: Add missing locks in dlm_empty_lockres __dlm_lockres_unused() expects the caller to take the lockres spinlock. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit 3fca0894a4b5e52c278421b04435b88e32b423ad Author: Sunil Mushran Date: Mon Mar 12 13:24:34 2007 -0700 ocfs2_dlm: Missing get/put lockres in dlm_run_purge_lockres In some circumstances, this was causing us to reference freed memory. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit afdf04ea098139e86147f63aad9c383cad3b6f37 Author: Joel Becker Date: Mon Mar 5 15:49:49 2007 -0800 configfs: add missing mutex_unlock() d_alloc() failure in configfs_register_subsystem() would fail to unlock the mutex taken above. Reorganize the exit path to ensure the unlock happens. Reported-by: Akinobu Mita Signed-off-by: Joel Becker Signed-off-by: Mark Fasheh commit 03f981cf2ec95dd8bc43d2ecccaec4e83c8375e2 Author: Joel Becker Date: Thu Jan 4 14:54:41 2007 -0800 ocfs2: add some missing address space callbacks Under load, OCFS2 would crash in invalidate_inode_pages2_range() because invalidate_complete_page2() was unable to invalidate a page. It would appear that JBD is holding on to the page. ext3 has a specific ->releasepage() handler to cover this case. Steal ext3's ->releasepage(), ->invalidatepage(), and ->migratepage(), as they appear completely appropriate for OCFS2. Signed-off-by: Joel Becker Signed-off-by: Mark Fasheh commit e6c352dbc0f4dc7e3f82feafb9e6207c5814a189 Author: Joel Becker Date: Sat Feb 3 03:04:20 2007 -0800 ocfs2: Concurrent access of o2hb_region->hr_task was not locked This means that a build-up and a teardown could race which would result in a double-kthread_stop(). Protect the setting and clearing of hr_task with o2hb_live_lock, as it's not a common thing and not performance critical. Signed-off-by: Joel Becker Signed-off-by: Mark Fasheh commit c24f72cc7ca829bbad0532ddf315ace3ae1c359e Author: Joel Becker Date: Sat Feb 3 03:14:30 2007 -0800 ocfs2: Proper cleanup in case of error in ocfs2_register_hb_callbacks() If ocfs2_register_hb_callbacks() succeeds on its first callback but fails its second, it doesn't release the first on the way out. Fix that. While we're at it, o2hb_unregister_callback() never returns anything but 0, so let's make it void. Signed-off-by: Joel Becker Signed-off-by: Mark Fasheh commit 717aa9fd26ea89631c946bd42562fa07a91f3133 Author: Jaroslav Kysela Date: Wed Mar 14 08:25:52 2007 +0100 [ALSA] version 1.0.14rc3 Signed-off-by: Jaroslav Kysela commit 9720b718f6b92fec07b2408ab7ca60d5146f07e2 Author: Takashi Iwai Date: Tue Mar 13 21:46:23 2007 +0100 [ALSA] hda-codec - Add model for HP Compaq d5700 Added model=hp-3013 for HP Compaq d5700 desktop with ALC260 codec. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 883be7936747f35479ecf94aebf3daf418b7f449 Author: Takashi Iwai Date: Tue Mar 13 21:52:36 2007 +0100 [ALSA] intel8x0 - Fix Oops at kdump crash kernel Fixed Oops at crash kernel from intel8x0 driver that is triggered from interrupt handler. Proper irqsave version seems needed for kexec/kdump. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 0a07acafd6127117db0c20e04302dd8ac9402bc0 Author: Takashi Iwai Date: Tue Mar 13 10:40:23 2007 +0100 [ALSA] hda-codec - Fix speaker output on MacPro Initialize the first line-out widget as the output pin in stac92xx_init(). Some devices like MacPro seem to set this widget as INPUT as default, and confuses the driver. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 187689913d92b5b3b595486a0cb82706f9175dc6 Author: Tobin Davis Date: Mon Mar 12 22:20:51 2007 +0100 [ALSA] hda-codec - more systems for Analog Devices This patch adds support for more systems using Analog Devices codecs. Asus P5B-DLX - AD1988 Toshiba U205 - AD1981 Lenovo M55 - AD1986 Samsung R55 - AD1986 Signed-off-by: Tobin Davis Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit a9995a3557ebf09721fd111744ff8b6e498797a6 Author: Takashi Iwai Date: Mon Mar 12 21:30:46 2007 +0100 [ALSA] hda-intel - Fix codec probe with ATI contorllers ATI controllers may have up to 4 codecs while ICH up to 3. Thus the earlier fix to change AZX_MAX_CODECS to 3 cause a regression on some devices that have the audio codec at bit#3. Now max codecs is defined according to the driver type, either 3 or 4. Currently 4 is set only to ATI chips. Other might need the same change, too. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit a64c8cd6e22bbc6a101da5b827e720fff35a5ab9 Author: Tobin Davis Date: Mon Mar 12 11:36:00 2007 +0100 [ALSA] hda-codec - Add suppoprt for Asus M2N-SLI motherboard This patch adds a cfg_tbl to the ad1988 code with the Asus M2N-SLI as it's first member. Signed-off-by: Tobin Davis Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 19bfafb2ed1a59efb979b6725ab7626a94f7e078 Author: Tommi Kyntola Date: Fri Mar 9 16:15:06 2007 +0100 [ALSA] intel8x0 - Fix speaker output after S2RAM Fixed the mute speaker problem after S2RAM on some laptops: http://bugme.osdl.org/show_bug.cgi?id=6181 Signed-off-by: Tommi Kyntola Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit c26a8de23a4417f556250c4c099b048b26c430be Author: Randy Cushman Date: Fri Mar 9 11:32:22 2007 +0100 [ALSA] ac97 - fix AD shared shared jack control logic This patch fixes the control logic for shared Microphone in/Center+LFE out and Line in/Surround out jacks for Analog Devices AD1888, AD1980 and AD1985 AC '97 CODECs. Signed-off-by: Randy Cushman Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 1fc273b88e59092466b6503e46d9227976254e10 Author: Takashi Iwai Date: Thu Mar 8 12:53:02 2007 +0100 [ALSA] soc - Fix dependencies in Kconfig files Fixed dependencies in Kconfig files of soc drivers. Signed-off-by: Takashi Iwai Signed-off-by: Jaroslav Kysela commit 0b3d4ef6fe43b75d4b2a6fc4b814cf03aa248e13 Author: Paul Mundt Date: Wed Mar 14 13:22:37 2007 +0900 serial: Fix sh-sci break interrupt/sysrq handling. The sh-sci sci_br_interrupt() handler was failing to call in to uart_handle_break(), which was something that only the SH-3 path was doing, fix that up. Additionally, SUPPORT_SYSRQ seems to have moved down too far, move it back to the top so uart_handle_break() and friends aren't no-ops. Signed-off-by: Paul Mundt commit 3afb209a43a4216ad4f1411922d47a44252926c6 Author: Paul Mundt Date: Wed Mar 14 13:03:35 2007 +0900 sh: Fix bogus regs pointer in do_IRQ(). SH-3 and SH-4 were trampling the register, and SH-2 wasn't even setting it in the first place. This ended up with some rather broken behaviour in the sysrq show_regs(). Signed-off-by: Paul Mundt commit 0e6ee854e7be9f12146c35aa09da3fe366d60f8c Author: Ralf Baechle Date: Tue Mar 13 15:10:50 2007 +0000 [MIPS] kspd: ioctl needs a translation entry. Signed-off-by: Ralf Baechle commit aea0e582d3ed9fa966c60b41871381e7f734adf2 Author: Ralf Baechle Date: Tue Mar 13 13:37:17 2007 +0000 [MIPS] Viper2: Remove defective support. A defconfig file and the 10 lines of code (including comments ...) that are rotting since lmo commit 6516a42dc8b40c6c00010346dd51496125b16644 don't quite make proper support, so let's trash it. Signed-off-by: Ralf Baechle commit 795a22583ba11deb82d57dd70632c7ac390bb8c8 Author: Chris Dearman Date: Thu Mar 1 17:58:24 2007 +0000 [MIPS] Oprofile: Reset all performance registers for MIPS_MT_SMP configs Signed-off-by: Chris Dearman Signed-off-by: Ralf Baechle commit 66fb8bd209926140844830762164a44afdbf44ef Author: Russell King Date: Tue Mar 13 09:54:21 2007 +0000 [ARM] Fix breakage caused by 72486f1f8f0a2bc828b9d30cf4690cf2dd6807fc 72486f1f8f0a2bc828b9d30cf4690cf2dd6807fc inverted the sense for enabling hotplug CPU controls without reference to any other architecture other than i386, ia64 and PowerPC. This left everyone else without hotplug CPU control. Fix ARM for this brain damage. Signed-off-by: Russell King commit 5b18167d6b7c63e2787cd9a68f0620a9c363fc85 Author: Mattia Dongili Date: Mon Mar 12 21:43:57 2007 +0100 sony-laptop: MAINTAINERS fix entry, add L: and W: Signed-off-by: Mattia Dongili Signed-off-by: Len Brown commit bb8236f2b978e8ed84e8b664882905fb5a7dd6c8 Author: David S. Miller Date: Mon Mar 12 22:55:39 2007 -0700 [SPARC64]: Add missing HPAGE_MASK masks on address parameters. These pte loops all assume the passed in address is HPAGE aligned, make sure that is actually true. Signed-off-by: David S. Miller commit 50d266a3a1b6a284aed7e06b599668ec23b28d6f Author: David S. Miller Date: Mon Mar 12 19:58:18 2007 -0700 [SPARC]: Hook up missing syscalls. sys_mbind sys_get_mempolicy sys_set_mempolicy sys_kexec_load sys_move_pages sys_getcpu sys_epoll_pwait This work is largely a result of David Woodhouse's most excellent missing syscalls patch. Signed-off-by: David S. Miller commit 75e252d981c0e80c14ce90df246e9b1300474c4f Author: Joy Latten Date: Mon Mar 12 17:14:07 2007 -0700 [XFRM]: Fix missing protocol comparison of larval SAs. I noticed that in xfrm_state_add we look for the larval SA in a few places without checking for protocol match. So when using both AH and ESP, whichever one gets added first, deletes the larval SA. It seems AH always gets added first and ESP is always the larval SA's protocol since the xfrm->tmpl has it first. Thus causing the additional km_query() Adding the check eliminates accidental double SA creation. Signed-off-by: Joy Latten Signed-off-by: David S. Miller commit 54f565ea895b383b67a2d6e31d2e2fcac5e6c345 Author: William Lee Irwin III Date: Mon Mar 12 17:08:25 2007 -0700 [SPARC]: Fix TIF_USEDFPU flag atomicity From: William Lee Irwin III Signed-off-by: David S. Miller commit ce0ecd594d78710422599918a608e96dd1ee6024 Author: Robert P. J. Day Date: Mon Mar 12 17:06:27 2007 -0700 [WANROUTER]: Delete superfluous source file "net/wanrouter/af_wanpipe.c". Delete the apparently superfluous source file net/wanrouter/af_wanpipe.c. Signed-off-by: Robert P. J. Day Signed-off-by: David S. Miller commit 08882669e06099eb3e6ac407f552743aeaaec73f Author: Geert Uytterhoeven Date: Mon Mar 12 17:02:37 2007 -0700 [IPV4]: Fix warning in ip_mc_rejoin_group. Kill warning about unused variable `in_dev' when CONFIG_IP_MULTICAST is not set. Signed-off-by: Geert Uytterhoeven Signed-off-by: David S. Miller commit 2cb8a57b9851805883dfe92cf5d88a726134a384 Author: Zachary Amsden Date: Mon Mar 12 14:58:08 2007 -0800 [PATCH] Fix vmi time header bug Some gcc put this function in .init.text because the header didn't match. Signed-off-by: Linus Torvalds commit b6bc5d71499c6e2d403a0624841c280e6edebe43 Author: Zachary Amsden Date: Fri Mar 9 23:00:30 2007 -0800 [PATCH] Fix VMI and COMPAT_VDSO for 2.6.21 VMI is broken under COMPAT_VDSO, as Xen and other non hardware assisted hypervisors will be. I have been working on a fix for this which works for older glibcs that panic when the new relocatable VDSO is used. However, I believe at this time that the fix is going to be too radical to consider at this stage in the release of 2.6.21. We don't expect this config option to be turned on by vendors for new distributions, so at this point we are willing to drop support for it when VMI is compiled in, and work on a patch for 2.6.22 which more fully addresses the problem. Signed-off-by: Zachary Amsden Acked-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 9f35575dfc172f0a93fb464761883c8f49599b7a Author: Eric W. Biederman Date: Thu Mar 8 13:06:13 2007 -0700 [PATCH] pci: Repair pci_save/restore_state so we can restore one save many times. Because we do not reserve space for the pci-x and pci-e state in struct pci dev we need to dynamically allocate it. However because we need to support restore being called multiple times after a single save it is never safe to free the buffers we have allocated to hold the state. So this patch modifies the save routines to first check to see if we have already allocated a state buffer before allocating a new one. Then the restore routines are modified to not free the state after restoring it. Simple and it fixes some subtle error path handling bugs, that are hard to test for. Signed-off-by: Eric W. Biederman Signed-off-by: Greg Kroah-Hartman Acked-by: Auke Kok Signed-off-by: Linus Torvalds commit 392ee1e6dd901db6c4504617476f6442ed91f72d Author: Eric W. Biederman Date: Thu Mar 8 13:04:57 2007 -0700 [PATCH] msi: Safer state caching. There are two ways pci_save_state and pci_restore_state are used. As helper functions during suspend/resume, and as helper functions around a hardware reset event. When used as helper functions around a hardware reset event there is no reason to believe the calls will be paired, nor is there a good reason to believe that if we restore the msi state from before the reset that it will match the current msi state. Since arch code may change the msi message without going through the driver, drivers currently do not have enough information to even know when to call pci_save_state to ensure they will have msi state in sync with the other kernel irq reception data structures. It turns out the solution is straight forward, cache the state in the existing msi data structures (not the magic pci saved things) and have the msi code update the cached state each time we write to the hardware. This means we never need to read the hardware to figure out what the hardware state should be. By modifying the caching in this manner we get to remove our save_state routines and only need to provide restore_state routines. The only fields that were at all tricky to regenerate were the msi and msi-x control registers and the way we regenerate them currently is a bit dependent upon assumptions on how we use the allow msi registers to be configured and used making the code a little bit brittle. If we ever change what cases we allow or how we configure the msi bits we can address the fragility then. Signed-off-by: Eric W. Biederman Signed-off-by: Greg Kroah-Hartman Acked-by: Auke Kok Signed-off-by: Linus Torvalds commit 2536b94a2d2e37dd6c14171d6251f63bbda47293 Author: Ralf Baechle Date: Mon Mar 12 15:53:33 2007 -0700 [ROSE]: Socket locking is a great invention. Especially if you actually try to do it ;-) Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 6cee77dbf29e3c4c2cf2ce16621759accc76891e Author: Ralf Baechle Date: Mon Mar 12 15:52:52 2007 -0700 [ROSE]: Remove ourselves from waitqueue when receiving a signal Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 38c8947c1b46e5985df36435a6f21ef6a7e8a4b8 Author: Paul Moore Date: Mon Mar 12 14:38:02 2007 -0700 [NetLabel]: parse the CIPSO ranged tag on incoming packets Commit 484b366932be0b73a22c74a82748ca10a721643e added support for the CIPSO ranged categories tag. However, it appears that I made a mistake when rebasing then patch to the latest upstream sources for submission and dropped the part of the patch that actually parses the tag on incoming packets. This patch fixes this mistake by adding the required function call to the cipso_v4_skbuff_getattr() function. I've run this patch over the weekend and have not noticed any problems. Signed-off-by: Paul Moore Acked-by: James Morris Signed-off-by: David S. Miller commit 1d99967badac599c0d1db0b45c99e073e8e98cd4 Author: Alexey Starikovskiy Date: Mon Mar 12 14:49:26 2007 -0400 ACPI: resolve HP nx6125 S3 immediate wakeup regression Moving disable GPEs from enter_sleep up into sleep_prepare fixed the disabled SCI on S4 on Acer laptops. However, it caused an immediate S3 resume on the HP nx6125. Apparently, on the HP, a GPE was getting re-enabled after the prepare, but before the enter. Close that window by restoring the GPE disable on enter. This is redundant in most cases, but closes this window, where S3 and S4 paths differ. Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Acked-by: Ray Lee commit 1dee79087c8b0f3239a2979f61ed92c7a5361b08 Author: Milan Svoboda Date: Mon Mar 12 12:38:07 2007 +0100 [ARM] 4263/1: fix IXP4XX_NPE[ABC]_BASE_VIRT address This fixs address defines for IXP4XX_NPE[ABC]_BASE_VIRT. They are defined as (IXP4XX_PERIPHERAL_BASE_PHYS + 0x[678]000) now, but they should be defined as (IXP4XX_PERIPHERAL_BASE_VIRT + 0x[678]000). Note PHYS vs VIRT in IXP4XX_PERIPHERAL_BASE... Signed-off-by: Milan Svoboda Signed-off-by: Russell King commit 2cb3320b3fb788eb95afbfea8686f11bb14e30b0 Author: Pavel Pisa Date: Thu Mar 8 00:00:40 2007 +0100 [ARM] 4256/1: i.MX/MX1 SDHC fix/workaround of SD card recognition problems The SDHC controllers cannot process shorter transfers. They has to be handled as longer ones, but it such case CRC error is evaluated. There was a case in the code still, where this error is not ignored as it should to be process these transfers. Signed-off-by: Pavel Pisa Signed-off-by: Russell King commit b3c6b76ffb1a8c8d1f12e838a25c1a86f5316e2c Author: Pavel Pisa Date: Wed Mar 7 23:56:16 2007 +0100 [ARM] 4255/1: i.MX/MX1 Correct MPU PLL reference clock value. Only System PLL clock source is selectable by CSCR_SYSTEM_SEL bit. MPU PLL is driven by 512*CLK32 for each case. Signed-off-by: Pavel Pisa Signed-off-by: Russell King commit 83b84c4e8c7cf00e26610f03ee59e9be010f527c Author: Pavel Pisa Date: Wed Mar 7 23:52:40 2007 +0100 [ARM] 4254/1: i.MX/MX1 CPU Frequency scaling honor boot loader set BCLK_DIV. The minimal bus clock prescaler should be kept at value selected by the board / boot loader designer. Switching frequency above startup limit could lead to the external memory/devices misbehave. Signed-off-by: Pavel Pisa Signed-off-by: Russell King commit d108d4fe34730135647fe32a4f8091491d3542ea Author: Jiri Kosina Date: Sat Mar 10 22:45:45 2007 +0100 HID: zeroing of bytes in output fields is bogus This patch removes bogus zeroing of unused bits in output reports, introduced in Simon's patch in commit d4ae650a. According to the specification, any sane device should not care about values of unused bits. What is worse, the zeroing is done in a way which is broken and might clear certain bits in output reports which are actually _used_ - a device that has multiple fields with one value of the size 1 bit each might serve as an example of why this is bogus - the second call of hid_output_report() would clear the first bit of report, which has already been set up previously. This patch will break LEDs on SpaceNavigator, because this device is broken and takes into account the bits which it shouldn't touch. The quirk for this particular device will be provided in a separate patch. Signed-off-by: Jiri Kosina commit 47a80edb1d80ae644ea374a016c8e68d43d2671f Author: Jiri Kosina Date: Mon Mar 12 14:55:12 2007 +0100 HID: allocate hid_parser in a proper way hid_parser is non-trivially large structure, so it should be allocated using vmalloc() to avoid unsuccessful allocations when memory fragmentation is too high. This structue has a very short life, it's destroyed as soon as the report descriptor has been completely parsed. This should be considered a temporary solution, until the hid_parser is rewritten to consume less memory during report descriptor parsing. Acked-by: Mariusz Kozlowski Signed-off-by: Jiri Kosina commit ffe1b4e9f436fd7bb784f3bf7ee963c149fbca5f Author: Paul Mundt Date: Mon Mar 12 16:15:22 2007 +0900 sh: Fix SH-3 cache entry_mask and way_size calculation. The code for performing the calculation was only in the SH-4 probe path, move it out to the common path so the other parts get this right too. Signed-off-by: Paul Mundt commit fbd168461e65e73016c34b2eacd76d87218c8a9f Author: Mike Frysinger Date: Mon Mar 12 16:12:45 2007 +0900 sh: Convert struct ioctls to static defines. This fixes up some compile failures for cases where we don't include all of the headers. There's not much point in keeping the struct references around anyways, most of the others have been converted already. Signed-off-by: Mike Frysinger Signed-off-by: Paul Mundt commit 72a121ba6d1a264b1d42892ec5d3ccd2b2af6b74 Author: Paul Mundt Date: Mon Mar 12 15:55:19 2007 +0900 sh: Define missing __NR_readahead. For some reason sh was missing __NR_readahead, even though the syscall was wired up, and the slot was reserved. Caught with dwmw2's missing syscall checker. Signed-off-by: Paul Mundt commit bb68660943fc0dc2a5fa634243f3c6b7fb715626 Author: Hideo Saito Date: Mon Mar 12 14:50:49 2007 +0900 sh: Fix PCI BAR address-space wraparound. When a SH7751R system includes a card that has wide range space like a graphics card, the pci-pci bridge controller can't set the correct address range. For example, when *lower_limit is 0xfd000000 and bar_size is 0x4000000, in the following code at arch/sh/drivers/pci/pci-auto.c, 0x0 is set in bar_value. pciauto_setup_bars() { ... bar_value = ((*lower_limit - 1) & ~(bar_size - 1)) + bar_size; ... *lower_limit = bar_value + bar_size; } As a result, 0x4000000 is set in *lower_limit, but this value is wrong. The following patch avoids this problem by checking the range of the value and refusing to update the BAR if the calculated value ends up being bogus. Signed-off-by: Hideo Saito Signed-off-by: Paul Mundt commit 7b3c384db1ff0f336b59d5062617915e216eaec1 Author: Stephen Rothwell Date: Fri Mar 9 11:58:11 2007 +1100 [POWERPC] sys_move_pages should be callable from an SPU Signed-off-by: Stephen Rothwell Signed-off-by: Paul Mackerras commit 4b0092c215fc678e325193cf97ddcb4be6a550c3 Author: Stephen Rothwell Date: Fri Mar 9 11:57:10 2007 +1100 [POWERPC] Wire up sys_epoll_pwait Signed-off-by: Stephen Rothwell Signed-off-by: Paul Mackerras commit 4cd723b4a0cc3e061e0a3fd86a1ec9a227f17c0b Author: Stephen Rothwell Date: Fri Mar 9 11:54:57 2007 +1100 [POWERPC] Allocate syscall number for sys_getcpu I forgot to do this when wiring up the syscall. Signed-off-by: Stephen Rothwell Signed-off-by: Paul Mackerras commit bb9ba31ca3b88fd396e38950d1caedf2f83521c6 Author: Joerg Dorchain Date: Tue Mar 6 02:46:54 2007 -0800 [SCSI] gdth: fix oops in gdth_copy_cmd() Recent alterations to the gdth_fill_raw_cmd() path no longer set the sg_ranz field for zero transfer commands. However, this field is used lower down in the function to initialise ha->cmd_len to the size of the firmware packet. If this uninitialised field contains a bogus value, ha->cmd_len can become much larger than the actual firmware packet and end up oopsing in gdth_copy_cmd() as it tries to copy this huge packet to the device (usually because it runs into an unallocated page). The fix is to initialise the sg_ranz field to zero at the start of gdth_fill_raw_cmd(). Signed-off-by: Joerg Dorchain Acked-by: "Leubner, Achim" Signed-off-by: Andrew Morton Signed-off-by: James Bottomley commit ba76ef246090601b783c1e6190e22b8b149a105f Author: Judith Lebzelter Date: Fri Mar 9 13:07:44 2007 -0800 [SCSI] mptsas: Fix oops for insmod during kexec This fix's an oops during driver load time. mptsas_probe calls mpt_attach(over in mptbase.c). Inside that call, we read some manufacturing config pages to setup some defaults. While reading the config pages, the firmware doesn't complete the reply in time, and we have a timeout. The timeout results in hardreset handler being called. The hardreset handler calls all the fusion upper layer driver reset callback handlers. The mptsas_ioc_reset function is the callback handler in mptsas.c. So where I'm getting to, is mptsas_ioc_reset is getting called before scsi_host_alloc is called, and the pointer ioc->sh is NULL as well as the hostdata. Signed-off-by: Judith Lebzelter Acked-by: "Moore, Eric" Signed-off-by: James Bottomley commit 5daa49ef05c44ce94bed0bab0f9ba4a9e952863b Author: Linas Vepstas Date: Thu Mar 8 16:19:11 2007 -0600 [SCSI] lpfc: avoid double-free during PCI error failure If a PCI error is detected that cannot be recovered from, there will be a double call of lpfc_pci_remove_one(), with the second call resulting in a null-pointer dereference. The first call occurs in lpfc_io_error_detected(), and the second call during pci device remove. This patch eliminates the first call; its un-needed. Signed-off-by: Linas Vepstas Acked-by: James Smart Signed-off-by: James Bottomley commit ab97e6cf7be77d1a9ae48d1d0eafde0de21805fc Author: Wim Van Sebroeck Date: Sun Mar 11 12:59:47 2007 +0000 [WATCHDOG] i8xx TCO driver - mark for removal Mark the i8xx TCO driver for removal. Signed-off-by: Wim Van Sebroeck commit a1fdcc0d2714b6622e3fd5c00db1635213d6c41a Author: Len Brown Date: Sun Mar 11 03:26:14 2007 -0400 ACPI: Add support to parse 2nd MADT When a BIOS bug presents multiple APIC/MADTs, Linux currently uses the 1st and ignores the 2nd. But some machines work better if we use the 2nd. http://bugzilla.kernel.org/show_bug.cgi?id=7465 Add a warning and boot parameter "acpi_apic_instance=2" to allow parsing the 2nd. No change to default behaviour in this patch. Signed-off-by: Len Brown commit be521466feb3bb1cd89de82a2b1d080e9ebd3cb6 Author: Linus Torvalds Date: Sat Mar 10 14:22:07 2007 -0800 Revert "USB: pxa2xx_udc: fix hardcoded irq number" This reverts commit d2487cb4257dafb686f682285854fe7f02ca29d8. Russell King points out that it's obviously bogus, and I have to agree. Not only does "irq" not even exist in that scope, but we obviously need to free the irq that we actually requested, and that's IRQ_USB. Reported-by: Russell King Cc: Andrew Morton Cc: Greg KH Cc: David Brownell , Cc: Milan Svoboda Signed-off-by: Linus Torvalds commit c0a79b229ac0e3a96fc00d5be65a498ceb06ef63 Author: Mathieu Desnoyers Date: Sat Mar 10 00:19:49 2007 -0800 [SPARC64]: Fix atomicity of TIF update in flush_thread() Fix atomicity of TIF update in flush_thread() for sparc64 Fixes correctly the race by using *_ti_thread_flag. Race : parent process executing : sys_ptrace() (lock_kernel()) (ptrace_get_task_struct(pid)) arch_ptrace() ptrace_detach() ptrace_disable(child); clear_singlestep(child); clear_tsk_thread_flag(child, TIF_SINGLESTEP); (which clears the TIF_SINGLESTEP flag atomically from a different process) (put_task_struct(child)) (unlock_kernel()) And at the same time, in the child process : sys_execve() do_execve() search_binary_handler() load_elf_binary() flush_old_exec() flush_thread() doing a non-atomic thread flag update Signed-off-by: Mathieu Desnoyers Signed-off-by: David S. Miller commit 63abdcdc021063bf1cfcddfd3c1a14a761539807 Author: Robert Reif Date: Thu Mar 8 21:22:35 2007 -0800 [BW2]: Fix section mismatch warnings. Fix section mismatch warnings by moving data into __devinitdata section. Add __devinit to two initialization functions. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit 8fdab4763a04f503301b14810b39c536f2277120 Author: Robert Reif Date: Thu Mar 8 21:22:03 2007 -0800 [CG14]: Fix section mismatch warnings. Fix section mismatch warning by moving data into __devinitdata section. Add __devinit to an initialization function. Signed-off-by: Robert Reif Signed-off-by: David S. Miller commit ac33d1febb790bd3a2a51cda1239a1482a3c767f Author: David S. Miller Date: Thu Mar 8 16:23:24 2007 -0800 [SPARC]: We do not need OLD_GETRLIMIT. Signed-off-by: David S. Miller commit f5c1e2ea71603bc2962041fef9dd902cb8626a1d Author: Alan Tyson Date: Sat Mar 10 06:05:14 2007 +0000 [CIFS] reset mode when client notices that ATTR_READONLY is no longer set Signed-off-by: Alan Tyso Signed-off-by: Jeff Layton Signed-off-by: Steve French commit 9e197219605513c14d3eae41039ecf1b82d1920d Author: Alexey Starikovskiy Date: Wed Mar 7 18:29:35 2007 -0500 ACPI: ec: fix race in status register access Delay the read of the EC status register until after the event that caused it occurs -- otherwise it is possible to read and act on stale status that was associated with the previous event. Do this with a perpetually incrementing "event_count" to detect when a new event occurs and it is safe to read status. There is no workaround for polling mode -- it is inherently exposed to reading and acting on stale status, since it doesn't have an interrupt to tell it the event completed. http://bugzilla.kernel.org/show_bug.cgi?id=8110 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown commit ee17b289732e04fdcdd8ce2ce19b18d3e8b08e20 Author: Cyrill Gorcunov Date: Tue Mar 6 02:47:44 2007 -0800 USB Elan FTDI: check for workqueue creation Avoid NULL pointer usage if workqueue creation failed. Signed-off-by: Cyrill Gorcunov Cc: Pete Zaitcev Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman