commit 74fca6a42863ffacaf7ba6f1936a9f228950f657 Author: Linus Torvalds Date: Wed Sep 9 15:13:59 2009 -0700 Linux 2.6.31 commit 7135a71b19be1faf48b7148d77844d03bc0717d6 Author: Ed Cashin Date: Wed Sep 9 14:10:18 2009 +0200 aoe: allocate unused request_queue for sysfs Andy Whitcroft reported an oops in aoe triggered by use of an incorrectly initialised request_queue object: [ 2645.959090] kobject '' (ffff880059ca22c0): tried to add an uninitialized object, something is seriously wrong. [ 2645.959104] Pid: 6, comm: events/0 Not tainted 2.6.31-5-generic #24-Ubuntu [ 2645.959107] Call Trace: [ 2645.959139] [] kobject_add+0x5f/0x70 [ 2645.959151] [] blk_register_queue+0x8b/0xf0 [ 2645.959155] [] add_disk+0x8f/0x160 [ 2645.959161] [] aoeblk_gdalloc+0x164/0x1c0 [aoe] The request queue of an aoe device is not used but can be allocated in code that does not sleep. Bruno bisected this regression down to cd43e26f071524647e660706b784ebcbefbd2e44 block: Expose stacked device queues in sysfs "This seems to generate /sys/block/$device/queue and its contents for everyone who is using queues, not just for those queues that have a non-NULL queue->request_fn." Addresses http://bugs.launchpad.net/bugs/410198 Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13942 Note that embedding a queue inside another object has always been an illegal construct, since the queues are reference counted and must persist until the last reference is dropped. So aoe was always buggy in this respect (Jens). Signed-off-by: Ed Cashin Cc: Andy Whitcroft Cc: "Rafael J. Wysocki" Cc: Bruno Premont Cc: Martin K. Petersen Cc: Andrew Morton Signed-off-by: Jens Axboe commit e6890f6f3dc2d9024a08b1a149d9bd5208eea350 Author: Linus Torvalds Date: Tue Sep 8 17:09:24 2009 -0700 i915: disable interrupts before tearing down GEM state Reinette Chatre reports a frozen system (with blinking keyboard LEDs) when switching from graphics mode to the text console, or when suspending (which does the same thing). With netconsole, the oops turned out to be BUG: unable to handle kernel NULL pointer dereference at 0000000000000084 IP: [] i915_driver_irq_handler+0x26b/0xd20 [i915] and it's due to the i915_gem.c code doing drm_irq_uninstall() after having done i915_gem_idle(). And the i915_gem_idle() path will do i915_gem_idle() -> i915_gem_cleanup_ringbuffer() -> i915_gem_cleanup_hws() -> dev_priv->hw_status_page = NULL; but if an i915 interrupt comes in after this stage, it may want to access that hw_status_page, and gets the above NULL pointer dereference. And since the NULL pointer dereference happens from within an interrupt, and with the screen still in graphics mode, the common end result is simply a silently hung machine. Fix it by simply uninstalling the irq handler before idling rather than after. Fixes http://bugzilla.kernel.org/show_bug.cgi?id=13819 Reported-and-tested-by: Reinette Chatre Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 7c8460db30dfd085ef3837c8fb02ecf2e718b983 Author: Zhenyu Wang Date: Tue Sep 8 14:52:25 2009 +0800 drm/i915: fix mask bits setting eDP is exclusive connector too, and add missing crtc_mask setting for TV. This fixes http://bugzilla.kernel.org/show_bug.cgi?id=14139 Signed-off-by: Zhenyu Wang Reported-and-tested-by: Carlos R. Mafra Signed-off-by: Linus Torvalds commit 3ff323f89075624b6891e7c428edb8e8a35be13c Merge: 755ae76 a54775c Author: Linus Torvalds Date: Mon Sep 7 11:42:25 2009 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: add LTE/GTE discard + rv515 two sided stencil register. commit 755ae761c5519929a97567d61a379b87352c337c Merge: 4886b5b acd0c93 Author: Linus Torvalds Date: Mon Sep 7 11:41:15 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: IMA: update ima_counts_put commit 4886b5b485ec78fe4a16fedaccfab39bdf55410f Merge: cbeb286 d9d8e04 Author: Linus Torvalds Date: Mon Sep 7 11:40:24 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: gianfar: Fix build. commit cbeb2864b162f4298111196c8ce8ce492577cdee Merge: f69fb9c c9a2bfd Author: Linus Torvalds Date: Mon Sep 7 11:40:15 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6: pcmcia: add CNF-CDROM-ID for ide commit f69fb9c39868463f6b0b8306824341bd5610250b Merge: e07cccf 07fb611 Author: Linus Torvalds Date: Mon Sep 7 11:38:30 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: agp/intel: support for new chip variant of IGDNG mobile drm/i915: Unref old_obj on get_fence_reg() error path drm/i915: increase default latency constant (v2 w/comment) commit a54775c8758a754186bc6adbfc518b1e9f8f1e4e Author: Dave Airlie Date: Mon Sep 7 15:26:19 2009 +1000 drm/radeon/kms: add LTE/GTE discard + rv515 two sided stencil register. This adds some rv350+ register for LTE/GTE discard, and enables the rv515 two sided stencil register. It also disables the DEPTHXY_OFFSET register which can be used to workaround the CS checker. Moves rs690 to proper place in rs600 and uses correct table on rs600. Signed-off-by: Dave Airlie commit acd0c935178649f72c44ec49ca83bee35ce1f79e Author: Mimi Zohar Date: Fri Sep 4 13:08:46 2009 -0400 IMA: update ima_counts_put - As ima_counts_put() may be called after the inode has been freed, verify that the inode is not NULL, before dereferencing it. - Maintain the IMA file counters in may_open() properly, decrementing any counter increments on subsequent errors. Reported-by: Ciprian Docan Reported-by: J.R. Okajima Signed-off-by: Mimi Zohar Acked-by: Eric Paris commit d9d8e0418ffd3d189345c435861e254c17ae06e5 Author: David S. Miller Date: Sun Sep 6 01:41:02 2009 -0700 gianfar: Fix build. Reported by Michael Guntsche -------------------- Commit 38bddf04bcfe661fbdab94888c3b72c32f6873b3 gianfar: gfar_remove needs to call unregister_netdev() breaks the build of the gianfar driver because "dev" is undefined in this function. To quickly test rc9 I changed this to priv->ndev but I do not know if this is the correct one. -------------------- Signed-off-by: David S. Miller commit e07cccf4046978df10f2e13fe2b99b2f9b3a65db Author: Linus Torvalds Date: Sat Sep 5 16:38:12 2009 -0700 Linux 2.6.31-rc9 commit f815c335d21f9965f8dbe142fd168aaba1baf98e Merge: 74a0118 baed6b8 Author: Linus Torvalds Date: Sat Sep 5 14:59:00 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6: firewire: sbp2: fix freeing of unallocated memory firewire: ohci: fix Ricoh R5C832, video reception firewire: ohci: fix Agere FW643 and multiple cameras firewire: core: fix crash in iso resource management commit 74a01180db4bbfd61304ae0ba1f60af55ffc803d Author: Roderick Colenbrander Date: Thu Sep 3 09:57:23 2009 -0600 powerpc: Fix i8259 interrupt driver kernel crash on ML510 This patch fixes a null pointer exception caused by removal of 'ack()' for level interrupts in the Xilinx interrupt driver. A recent change to the xilinx interrupt controller removed the ack hook for level irqs. Signed-off-by: Roderick Colenbrander Signed-off-by: Grant Likely Acked-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit 5136a6c0fd5b26bbf39ad761cf7a4fc563ad83a3 Merge: e505a8d bc8cec0 Author: Linus Torvalds Date: Sat Sep 5 14:57:04 2009 -0700 Merge git://git.infradead.org/~dwmw2/mtd-2.6.31 * git://git.infradead.org/~dwmw2/mtd-2.6.31: JFFS2: add missing verify buffer allocation/deallocation mtd: nftl: fix offset alignments mtd: nftl: write support is broken mtd: m25p80: fix null pointer dereference bug commit e505a8d5f96a84f3043ce0c4eaee8f045996896c Merge: b71b7dc c295fc0 Author: Linus Torvalds Date: Sat Sep 5 14:56:13 2009 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: Allow changing max_sectors_kb above the default 512 commit b71b7dc09abaeb4417c37b96a898096286b65e3c Merge: 59430c2 9265345 Author: Linus Torvalds Date: Sat Sep 5 14:55:30 2009 -0700 Merge branch 'fix/oxygen' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/oxygen' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: sound: oxygen: handle cards with missing EEPROM sound: oxygen: fix MCLK rate for 192 kHz playback commit 59430c2f437767094298f30dd02ca038da0df755 Merge: e9ee3a5 16ebb5e Author: Linus Torvalds Date: Sat Sep 5 14:52:41 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tc: Fix unitialized kernel memory leak pkt_sched: Revert tasklet_hrtimer changes. net: sk_free() should be allowed right after sk_alloc() gianfar: gfar_remove needs to call unregister_netdev() ipw2200: firmware DMA loading rework commit e9ee3a54a164c249a0a576c403eba367a6d97be5 Merge: 3bb314f 0c7d400 Author: Linus Torvalds Date: Sat Sep 5 14:51:45 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: skcipher - Fix skcipher_dequeue_givcrypt NULL test commit 3bb314f01c189f0c48c0946424955c6d8ddce3d8 Merge: 535e0c1 ce6c399 Author: Linus Torvalds Date: Sat Sep 5 14:51:24 2009 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] Re-enable cpufreq suspend and resume code commit 535e0c1726bec699a8f0f5b86fe7d399546b2555 Merge: 0edfa2b 5afe18d Author: Linus Torvalds Date: Sat Sep 5 14:50:53 2009 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6: [IA64] fix csum_ipv6_magic() [IA64] Fix warning in dma-mapping.c commit 0edfa2b1b5a5e1475e76dd3c792447687d966de4 Merge: 5a09adf 3725867 Author: Linus Torvalds Date: Sat Sep 5 14:25:14 2009 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: actually enable the swapext compat handler commit 5a09adf13067609d8ab9fcae11dc99fd0084e35c Merge: 931f703 b1f1b8c Author: Linus Torvalds Date: Sat Sep 5 14:24:33 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: fix preempt count underflow in nilfs_btnode_prepare_change_key commit 931f70350e9c298887c78e852d179ef7efcce304 Merge: e305fc5 04a13c7 Author: Linus Torvalds Date: Sat Sep 5 14:22:00 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu: don't assume existence of cpu0 commit e305fc5ecd6420fadec5a8108852081fa2b89a17 Merge: 154f807 d76b159 Author: Linus Torvalds Date: Sat Sep 5 13:57:53 2009 -0700 Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6 * 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6: slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU commit 154f807e55977de75b1c12197c13ae14c28397b3 Merge: 9b6a3df ae0b744 Author: Linus Torvalds Date: Sat Sep 5 13:51:07 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm: dm snapshot: fix on disk chunk size validation dm exception store: split set_chunk_size dm snapshot: fix header corruption race on invalidation dm snapshot: refactor zero_disk_area to use chunk_io dm log: userspace add luid to distinguish between concurrent log instances dm raid1: do not allow log_failure variable to unset after being set dm log: remove incorrect field from userspace table output dm log: fix userspace status output dm stripe: expose correct io hints dm table: add more context to terse warning messages dm table: fix queue_limit checking device iterator dm snapshot: implement iterate devices dm multipath: fix oops when request based io fails when no paths commit 9b6a3df372f0318bb0ffe37ac5f4610fb9bdb44d Merge: d3acd16 6faf17f Author: Linus Torvalds Date: Sat Sep 5 13:50:46 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI SR-IOV: correct broken resource alignment calculations commit d3acd16cda3a1cbaff7c579c0e054f0ece613d14 Merge: 93697a3 bd4352c Author: Linus Torvalds Date: Sat Sep 5 13:49:06 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix bootup with mcount in some configs. sparc64: Kill spurious NMI watchdog triggers by increasing limit to 30 seconds. commit 93697a3cabd3605c434a9b915c0272ad800b3f97 Merge: 6399534 a3df6f7 Author: Linus Torvalds Date: Sat Sep 5 13:48:37 2009 -0700 Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf_counter/powerpc: Fix cache event codes for POWER7 perf_counter: Fix /0 bug in swcounters perf_counters: Increase paranoia level commit 63995344721be45b3fb3b76488b1b0a8c95def26 Merge: 9de6886 2bcaa6a Author: Linus Torvalds Date: Sat Sep 5 13:41:29 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atkbd - add Compaq Presario R4000-series repeat quirk Input: i8042 - add Acer Aspire 5536 to the nomux list commit 9de6886ec6e37f45807266a702bb7621498395ad Author: Nicolas Pitre Date: Sat Sep 5 00:25:37 2009 -0400 ext2: fix unbalanced kmap()/kunmap() In ext2_rename(), dir_page is acquired through ext2_dotdot(). It is then released through ext2_set_link() but only if old_dir != new_dir. Failing that, the pkmap reference count is never decremented and the page remains pinned forever. Repeat that a couple times with highmem pages and all pkmap slots get exhausted, and every further kmap() calls end up stalling on the pkmap_map_wait queue at which point the whole system comes to a halt. Signed-off-by: Nicolas Pitre Acked-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit ac7ac9f2b9bfd9b68a1571d27e4c8bebb4788914 Merge: ac89a91 8379e7c Author: Linus Torvalds Date: Sat Sep 5 13:38:37 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2: ocfs2_write_begin_nolock() should handle len=0 ocfs2: invalidate dentry if its dentry_lock isn't initialized. commit ac89a9174decf343de049a06fad75681f71890eb Author: Linus Torvalds Date: Sat Sep 5 13:27:10 2009 -0700 pty: don't limit the writes to 'pty_space()' inside 'pty_write()' The whole write-room thing is something that is up to the _caller_ to worry about, not the pty layer itself. The total buffer space will still be limited by the buffering routines themselves, so there is no advantage or need in having pty_write() artificially limit the size somehow. And what happened was that the caller (the n_tty line discipline, in this case) may have verified that there is room for 2 bytes to be written (for NL -> CRNL expansion), and it used to then do those writes as two single-byte writes. And if the first byte written (CR) then caused a new tty buffer to be allocated, pty_space() may have returned zero when trying to write the second byte (LF), and then incorrectly failed the write - leading to a lost newline character. This should finally fix http://bugzilla.kernel.org/show_bug.cgi?id=14015 Reported-by: Mikael Pettersson Acked-by: Alan Cox Signed-off-by: Linus Torvalds commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332 Author: Linus Torvalds Date: Sat Sep 5 12:46:07 2009 -0700 n_tty: do O_ONLCR translation as a single write When translating CR to CRNL in the n_tty line discipline, we did it as two tty_put_char() calls. Which works, but is stupid, and has caused problems before too with bad interactions with the write_room() logic. The generic USB serial driver had that problem, for example. Now the pty layer had similar issues after being moved to the generic tty buffering code (in commit d945cb9cce20ac7143c2de8d88b187f62db99bdc: "pty: Rework the pty layer to use the normal buffering logic"). So stop doing the silly separate two writes, and do it as a single write instead. That's what the n_tty layer already does for the space expansion of tabs (XTABS), and it means that we'll now always have just a single write for the CRNL to match the single 'tty_write_room()' test, which hopefully means that the next time somebody screws up buffering, it won't cause weeks of debugging. Signed-off-by: Linus Torvalds commit a2a8474c3fff88d8dd52d05cb450563fb26fd26c Author: Oleg Nesterov Date: Sat Sep 5 11:17:13 2009 -0700 exec: do not sleep in TASK_TRACED under ->cred_guard_mutex Tom Horsley reports that his debugger hangs when it tries to read /proc/pid_of_tracee/maps, this happens since "mm_for_maps: take ->cred_guard_mutex to fix the race with exec" 04b836cbf19e885f8366bccb2e4b0474346c02d commit in 2.6.31. But the root of the problem lies in the fact that do_execve() path calls tracehook_report_exec() which can stop if the tracer sets PT_TRACE_EXEC. The tracee must not sleep in TASK_TRACED holding this mutex. Even if we remove ->cred_guard_mutex from mm_for_maps() and proc_pid_attr_write(), another task doing PTRACE_ATTACH should not hang until it is killed or the tracee resumes. With this patch do_execve() does not use ->cred_guard_mutex directly and we do not hold it throughout, instead: - introduce prepare_bprm_creds() helper, it locks the mutex and calls prepare_exec_creds() to initialize bprm->cred. - install_exec_creds() drops the mutex after commit_creds(), and thus before tracehook_report_exec()->ptrace_stop(). or, if exec fails, free_bprm() drops this mutex when bprm->cred != NULL which indicates install_exec_creds() was not called. Reported-by: Tom Horsley Signed-off-by: Oleg Nesterov Acked-by: David Howells Cc: Roland McGrath Cc: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd5d241ea955006122d76af88af87de73fec25b4 Author: Mel Gorman Date: Sat Sep 5 11:17:11 2009 -0700 page-allocator: always change pageblock ownership when anti-fragmentation is disabled On low-memory systems, anti-fragmentation gets disabled as fragmentation cannot be avoided on a sufficiently large boundary to be worthwhile. Once disabled, there is a period of time when all the pageblocks are marked MOVABLE and the expectation is that they get marked UNMOVABLE at each call to __rmqueue_fallback(). However, when MAX_ORDER is large the pageblocks do not change ownership because the normal criteria are not met. This has the effect of prematurely breaking up too many large contiguous blocks. This is most serious on NOMMU systems which depend on high-order allocations to boot. This patch causes pageblocks to change ownership on every fallback when anti-fragmentation is disabled. This prevents the large blocks being prematurely broken up. This is a fix to commit 49255c619fbd482d704289b5eb2795f8e3b7ff2e [page allocator: move check for disabled anti-fragmentation out of fastpath] and the problem affects 2.6.31-rc8. Signed-off-by: Mel Gorman Tested-by: Paul Mundt Cc: David Howells Cc: Pekka Enberg Acked-by: Greg Ungerer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a190887b58c32d19c2eee007c5eb8faa970a69ba Author: David Howells Date: Sat Sep 5 11:17:07 2009 -0700 nommu: fix error handling in do_mmap_pgoff() Fix the error handling in do_mmap_pgoff(). If do_mmap_shared_file() or do_mmap_private() fail, we jump to the error_put_region label at which point we cann __put_nommu_region() on the region - but we haven't yet added the region to the tree, and so __put_nommu_region() may BUG because the region tree is empty or it may corrupt the region tree. To get around this, we can afford to add the region to the region tree before calling do_mmap_shared_file() or do_mmap_private() as we keep nommu_region_sem write-locked, so no-one can race with us by seeing a transient region. Signed-off-by: David Howells Acked-by: Pekka Enberg Acked-by: Paul Mundt Cc: Mel Gorman Acked-by: Greg Ungerer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4e49627b9bc29a14b393c480e8c979e3bc922ef7 Author: Oleg Nesterov Date: Sat Sep 5 11:17:06 2009 -0700 workqueues: introduce __cancel_delayed_work() cancel_delayed_work() has to use del_timer_sync() to guarantee the timer function is not running after return. But most users doesn't actually need this, and del_timer_sync() has problems: it is not useable from interrupt, and it depends on every lock which could be taken from irq. Introduce __cancel_delayed_work() which calls del_timer() instead. The immediate reason for this patch is http://bugzilla.kernel.org/show_bug.cgi?id=13757 but hopefully this helper makes sense anyway. As for 13757 bug, actually we need requeue_delayed_work(), but its semantics are not yet clear. Merge this patch early to resolves cross-tree interdependencies between input and infiniband. Signed-off-by: Oleg Nesterov Cc: Dmitry Torokhov Cc: Roland Dreier Cc: Stefan Richter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit baed6b82d9f160184c1c14cdb4accb08f3eb6b87 Author: Stefan Richter Date: Thu Sep 3 23:07:35 2009 +0200 firewire: sbp2: fix freeing of unallocated memory If a target writes invalid status (typically status of a command that already timed out), firewire-sbp2 attempts to put away an ORB that doesn't exist. https://bugzilla.redhat.com/show_bug.cgi?id=519772 Signed-off-by: Stefan Richter commit 4fe0badd5882c64dc2dcd8893f9b85db63339736 Author: Stefan Richter Date: Fri Aug 28 13:26:03 2009 +0200 firewire: ohci: fix Ricoh R5C832, video reception In dual-buffer DMA mode, no video frames are ever received from R5C832 by libdc1394. Fallback to packet-per-buffer DMA works reliably. http://thread.gmane.org/gmane.linux.kernel.firewire.devel/13393/focus=13476 Reported-by: Jonathan Cameron Signed-off-by: Stefan Richter commit fc383796a8cc5df0a0c8633a16dd2e9528a16a63 Author: Stefan Richter Date: Fri Aug 28 13:25:15 2009 +0200 firewire: ohci: fix Agere FW643 and multiple cameras An Agere FW643 OHCI 1.1 card works fine for video reception from one camera but fails early if receiving from two cameras. After a short while, no IR IRQ events occur and the context control register does not react anymore. This happens regardless whether both IR DMA contexts are dual-buffer or one is dual-buffer and the other packet-per-buffer. This can be worked around by disabling dual buffer DMA mode entirely. http://sourceforge.net/mailarchive/message.php?msg_name=4A7C0594.2020208%40gmail.com (Reported by Samuel Audet.) In another report (by Jonathan Cameron), an FW643 works OK with two cameras in dual buffer mode. Whether this is due to different chip revisions or different usage patterns (different video formats) is not yet clear. However, as far as the current capabilities of firewire-core's isochronous I/O interface are concerned, simply switching off dual-buffer on non-working and working FW643s alike is not a problem in practice. We only need to revisit this issue if we are going to enhance the interface, e.g. so that applications can explicitly choose modes. Reported-by: Samuel Audet Reported-by: Jonathan Cameron Signed-off-by: Stefan Richter commit 1821bc19d54009b6f5e6462dd79074d728080839 Author: Stefan Richter Date: Sat Sep 5 13:23:49 2009 +0200 firewire: core: fix crash in iso resource management This fixes a regression due to post 2.6.30 commit "firewire: core: do not DMA-map stack addresses" 6fdc03709433ccc2005f0f593ae9d9dd04f7b485. As David Moore noted, a previously correct sizeof() expression became wrong since the commit changed its argument from an array to a pointer. This resulted in an oops in ohci_cancel_packet in the shared workqueue thread's context when an isochronous resource was to be freed. Reported-by: Jonathan Cameron Signed-off-by: Stefan Richter commit 8379e7c46cc48f51197dd663fc6676f47f2a1e71 Author: Sunil Mushran Date: Fri Sep 4 11:12:01 2009 -0700 ocfs2: ocfs2_write_begin_nolock() should handle len=0 Bug introduced by mainline commit e7432675f8ca868a4af365759a8d4c3779a3d922 The bug causes ocfs2_write_begin_nolock() to oops when len=0. Signed-off-by: Sunil Mushran Cc: stable@kernel.org Signed-off-by: Joel Becker commit ae0b7448e91353ea5f821601a055aca6b58042cd Author: Mikulas Patocka Date: Fri Sep 4 20:40:43 2009 +0100 dm snapshot: fix on disk chunk size validation Fix some problems seen in the chunk size processing when activating a pre-existing snapshot. For a new snapshot, the chunk size can either be supplied by the creator or a default value can be used. For an existing snapshot, the chunk size in the snapshot header on disk should always be used. If someone attempts to load an existing snapshot and has the 'default chunk size' option set, the kernel uses its default value even when it is incorrect for the snapshot being loaded. This patch ensures the correct on-disk value is always used. Secondly, when the code does use the chunk size stored on the disk it is prudent to revalidate it, so the code can exit cleanly if it got corrupted as happened in https://bugzilla.redhat.com/show_bug.cgi?id=461506 . Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 2defcc3fb4661e7351cb2ac48d843efc4c64db13 Author: Mikulas Patocka Date: Fri Sep 4 20:40:41 2009 +0100 dm exception store: split set_chunk_size Break the function set_chunk_size to two functions in preparation for the fix in the following patch. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 61578dcd3fafe6babd72e8db32110cc0b630a432 Author: Mikulas Patocka Date: Fri Sep 4 20:40:39 2009 +0100 dm snapshot: fix header corruption race on invalidation If a persistent snapshot fills up, a race can corrupt the on-disk header which causes a crash on any future attempt to activate the snapshot (typically while booting). This patch fixes the race. When the snapshot overflows, __invalidate_snapshot is called, which calls snapshot store method drop_snapshot. It goes to persistent_drop_snapshot that calls write_header. write_header constructs the new header in the "area" location. Concurrently, an existing kcopyd job may finish, call copy_callback and commit_exception method, that goes to persistent_commit_exception. persistent_commit_exception doesn't do locking, relying on the fact that callbacks are single-threaded, but it can race with snapshot invalidation and overwrite the header that is just being written while the snapshot is being invalidated. The result of this race is a corrupted header being written that can lead to a crash on further reactivation (if chunk_size is zero in the corrupted header). The fix is to use separate memory areas for each. See the bug: https://bugzilla.redhat.com/show_bug.cgi?id=461506 Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 02d2fd31defce6ff77146ad0fef4f19006055d86 Author: Mikulas Patocka Date: Fri Sep 4 20:40:37 2009 +0100 dm snapshot: refactor zero_disk_area to use chunk_io Refactor chunk_io to prepare for the fix in the following patch. Pass an area pointer to chunk_io and simplify zero_disk_area to use chunk_io. No functional change. Cc: stable@kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Alasdair G Kergon commit 7ec23d50949d5062b5b749638dd9380ed75e58e5 Author: Jonathan Brassow Date: Fri Sep 4 20:40:34 2009 +0100 dm log: userspace add luid to distinguish between concurrent log instances Device-mapper userspace logs (like the clustered log) are identified by a universally unique identifier (UUID). This identifier is used to associate requests from the kernel to a specific log in userspace. The UUID must be unique everywhere, since multiple machines may use this identifier when communicating about a particular log, as is the case for cluster logs. Sometimes, device-mapper/LVM may re-use a UUID. This is the case during pvmoves, when moving from one segment of an LV to another, or when resizing a mirror, etc. In these cases, a new log is created with the same UUID and loaded in the "inactive" slot. When a device-mapper "resume" is issued, the "live" table is deactivated and the new "inactive" table becomes "live". (The "inactive" table can also be removed via a device-mapper 'clear' command.) The above two issues were colliding. More than one log was being created with the same UUID, and there was no way to distinguish between them. So, sometimes the wrong log would be swapped out during the exchange. The solution is to create a locally unique identifier, 'luid', to go along with the UUID. This new identifier is used to determine exactly which log is being referenced by the kernel when the log exchange is made. The identifier is not universally safe, but it does not need to be, since create/destroy/suspend/resume operations are bound to a specific machine; and these are the operations that make up the exchange. Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit d2b698644c97cb033261536a4f2010924a00eac9 Author: Jonathan Brassow Date: Fri Sep 4 20:40:32 2009 +0100 dm raid1: do not allow log_failure variable to unset after being set This patch fixes a bug which was triggering a case where the primary leg could not be changed on failure even when the mirror was in-sync. The case involves the failure of the primary device along with the transient failure of the log device. The problem is that bios can be put on the 'failures' list (due to log failure) before 'fail_mirror' is called due to the primary device failure. Normally, this is fine, but if the log device failure is transient, a subsequent iteration of the work thread, 'do_mirror', will reset 'log_failure'. The 'do_failures' function then resets the 'in_sync' variable when processing bios on the failures list. The 'in_sync' variable is what is used to determine if the primary device can be switched in the event of a failure. Since this has been reset, the primary device is incorrectly assumed to be not switchable. The case has been seen in the cluster mirror context, where one machine realizes the log device is dead before the other machines. As the responsibilities of the server migrate from one node to another (because the mirror is being reconfigured due to the failure), the new server may think for a moment that the log device is fine - thus resetting the 'log_failure' variable. In any case, it is inappropiate for us to reset the 'log_failure' variable. The above bug simply illustrates that it can actually hurt us. Cc: stable@kernel.org Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit b8313b6da7e2e7c7f47d93d8561969a3ff9ba0ea Author: Jonathan Brassow Date: Fri Sep 4 20:40:30 2009 +0100 dm log: remove incorrect field from userspace table output The output of 'dmsetup table' includes an internal field that should not be there. This patch removes it. To make the fix simpler, we first reorder a constructor argument The 'device size' argument is generated internally. Currently it is placed as the last space-separated word of the constructor string. However, we need to use a version of the string without this word, so we move it to the beginning instead so it is trivial to skip past it. We keep a copy of the arguments passed to userspace for creating a log, just in case we need to resend them. These are the same arguments that are desired in the STATUSTYPE_TABLE request, except for one. When creating the userspace log, the userspace daemon must know the size of the mirror, so that is added to the arguments given in the constructor table. We were printing this extra argument out as well, which is a mistake. Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit 4142a969175302bc843d1505133488bfdbfa4732 Author: Jonathan Brassow Date: Fri Sep 4 20:40:28 2009 +0100 dm log: fix userspace status output Fix 'dmsetup table' output. There is a missing ' ' at the end of the string causing two words to run together. Signed-off-by: Jonathan Brassow Signed-off-by: Alasdair G Kergon commit 40bea431274c247425e7f5970d796ff7b37a2b22 Author: Mike Snitzer Date: Fri Sep 4 20:40:25 2009 +0100 dm stripe: expose correct io hints Set sensible I/O hints for striped DM devices in the topology infrastructure added for 2.6.31 for userspace tools to obtain via sysfs. Add .io_hints to 'struct target_type' to allow the I/O hints portion (io_min and io_opt) of the 'struct queue_limits' to be set by each target and implement this for dm-stripe. Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit a963a956225eb0f8c4d3537f428153c30adf54b8 Author: Mike Snitzer Date: Fri Sep 4 20:40:24 2009 +0100 dm table: add more context to terse warning messages A couple of recent warning messages make it difficult for the reader to determine exactly what is wrong. This patch adds more information to those messages. The messages were added by these commits: 5dea271b6d87bd1d79a59c1d5baac2596a841c37 ("dm table: pass correct dev area size to device_area_is_valid") ea9df47cc92573b159ef3b4fda516c32cba9c4fd ("dm table: fix blk_stack_limits arg to use bytes not sectors") The patch also corrects references to logical_block_size in printk format strings from %hu to %u. Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit f6a1ed10864b7540fa758bbccf3433fe17070329 Author: Mikulas Patocka Date: Fri Sep 4 20:40:22 2009 +0100 dm table: fix queue_limit checking device iterator The logic to check for valid device areas is inverted relative to proper use with iterate_devices. The iterate_devices method calls its callback for every underlying device in the target. If any callback returns non-zero, iterate_devices exits immediately. But the callback device_area_is_valid() returns 0 on error and 1 on success. The overall effect without is that an error is issued only if every device is invalid. This patch renames device_area_is_valid to device_area_is_invalid and inverts the logic so that one invalid device is sufficient to raise an error. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Alasdair G Kergon commit 8811f46c1f9386fc7017150de9d52359e5b1826e Author: Mike Snitzer Date: Fri Sep 4 20:40:19 2009 +0100 dm snapshot: implement iterate devices Implement the .iterate_devices for the origin and snapshot targets. dm-snapshot's lack of .iterate_devices resulted in the inability to properly establish queue_limits for both targets. With 4K sector drives: an unfortunate side-effect of not establishing proper limits in either targets' DM device was that IO to the devices would fail even though both had been created without error. Commit af4874e03ed82f050d5872d8c39ce64bf16b5c38 ("dm target:s introduce iterate devices fn") in 2.6.31-rc1 should have implemented .iterate_devices for dm-snap.c's origin and snapshot targets. Signed-off-by: Mike Snitzer Signed-off-by: Andrew Morton Signed-off-by: Alasdair G Kergon commit a77e28c7e1dc1a6a035c7627d4a88ecf3ea09aea Author: Kiyoshi Ueda Date: Fri Sep 4 20:40:16 2009 +0100 dm multipath: fix oops when request based io fails when no paths The patch posted at http://marc.info/?l=dm-devel&m=124539787228784&w=2 which was merged into cec47e3d4a861e1d942b3a580d0bbef2700d2bb2 ("dm: prepare for request based option") introduced a regression in request-based dm. If map_request() calls dm_kill_unmapped_request() to complete a cloned bio without dispatching it, clone->bio is still set when dm_end_request() is called and the BUG_ON(clone->bio) is incorrect. The patch fixes this bug by freeing bio in dm_end_request() if the clone has bio. I've redone my tests to cover all I/O paths and confirmed there's no other regression. Here is the oops I hit in request-based dm when I do I/O to a multipath device which doesn't have any active path nor queue_if_no_path setting: ------------[ cut here ]------------ kernel BUG at /root/2.6.31-rc4.rqdm/drivers/md/dm.c:828! invalid opcode: 0000 [#1] SMP last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map CPU 1 Modules linked in: autofs4 sunrpc cpufreq_ondemand acpi_cpufreq dm_mirror dm_region_hash dm_log dm_service_time dm_multipath scsi_dh dm_mod video output sbs sbshc battery ac sg sr_mod e1000e button cdrom serio_raw rtc_cmos rtc_core rtc_lib piix lpfc scsi_transport_fc ata_piix libata megaraid_sas sd_mod scsi_mod crc_t10dif ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: microcode] Pid: 7, comm: ksoftirqd/1 Not tainted 2.6.31-rc4.rqdm #1 Express5800/120Lj [N8100-1417] RIP: 0010:[] [] dm_softirq_done+0xbd/0x100 [dm_mod] RSP: 0018:ffff8800280a1f08 EFLAGS: 00010282 RAX: ffffffffa02544e0 RBX: ffff8802aa1111d0 RCX: ffff8802aa1111e0 RDX: ffff8802ab913e70 RSI: 0000000000000000 RDI: ffff8802ab913e70 RBP: ffff8800280a1f28 R08: ffffc90005457040 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffb R13: ffff8802ab913e88 R14: ffff8802ab9c1438 R15: 0000000000000100 FS: 0000000000000000(0000) GS:ffff88002809e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 0000003d54a98640 CR3: 000000029f0a1000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process ksoftirqd/1 (pid: 7, threadinfo ffff8802ae50e000, task ffff8802ae4f8040) Stack: ffff8800280a1f38 0000000000000020 ffffffff814f30a0 0000000000000004 <0> ffff8800280a1f58 ffffffff8116b245 ffff8800280a1f38 ffff8800280a1f38 <0> ffff8800280a1f58 0000000000000001 ffff8800280a1fa8 ffffffff810477bc Call Trace: [] blk_done_softirq+0x75/0x90 [] __do_softirq+0xcc/0x210 [] ? ksoftirqd+0x0/0x110 [] call_softirq+0x1c/0x50 [] do_softirq+0x65/0xa0 [] ? ksoftirqd+0x0/0x110 [] ksoftirqd+0x70/0x110 [] kthread+0x99/0xb0 [] child_rip+0xa/0x20 [] ? restore_args+0x0/0x30 [] ? kthread+0x0/0xb0 [] ? child_rip+0x0/0x20 Code: 44 89 e6 48 89 df e8 23 fb f2 e0 be 01 00 00 00 4c 89 f7 e8 f6 fd ff ff 5b 41 5c 41 5d 41 5e c9 c3 4c 89 ef e8 85 fe ff ff eb ed <0f> 0b eb fe 41 8b 85 dc 00 00 00 48 83 bb 10 01 00 00 00 89 83 RIP [] dm_softirq_done+0xbd/0x100 [dm_mod] RSP ---[ end trace 16af0a1d8542da55 ]--- Signed-off-by: Kiyoshi Ueda Signed-off-by: Jun'ichi Nomura Signed-off-by: Alasdair G Kergon commit bd4352cadfacb9084c97c853b025fac010266c26 Author: David S. Miller Date: Fri Sep 4 03:38:54 2009 -0700 sparc64: Fix bootup with mcount in some configs. Functions invoked early when booting up a cpu can't use tracing because mcount requires a valid 'current_thread_info()' and TLB mappings to be setup. The code path of sun4v_register_mondo_queues --> register_one_mondo is one such case. sun4v_register_mondo_queues already has the necessary 'notrace' annotation, but register_one_mondo does not. Normally register_one_mondo is inlined so the bug doesn't trigger, but with some config/compiler combinations, it won't be so we must properly mark it notrace. While we're here, add 'notrace' annoations to prom_printf and prom_halt so that early error handling won't have the same problem. Reported-by: Alexander Beregalov Reported-by: Leif Sawyer Signed-off-by: David S. Miller commit 2bcaa6a4238094c5695d5b1943078388d82d3004 Author: Dave Andrews Date: Thu Sep 3 17:21:27 2009 -0700 Input: atkbd - add Compaq Presario R4000-series repeat quirk Compaq Presario R4000-series laptops are not sending a "volume up button release" and "volume down button release" signal in the PS/2 protocol for atkbd. The URL below has some of confirmed reports: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/385477 Signed-off-by: Dave Andrews Signed-off-by: Dmitry Torokhov commit d76b1590e06a63a3d8697168cd0aabf1c4b3cb3a Author: Eric Dumazet Date: Thu Sep 3 22:38:59 2009 +0300 slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU kmem_cache_destroy() should call rcu_barrier() *after* kmem_cache_close() and *before* sysfs_slab_remove() or risk rcu_free_slab() being called after kmem_cache is deleted (kfreed). rmmod nf_conntrack can crash the machine because it has to kmem_cache_destroy() a SLAB_DESTROY_BY_RCU enabled cache. Cc: Reported-by: Zdenek Kabelac Signed-off-by: Eric Dumazet Acked-by: Paul E. McKenney Signed-off-by: Pekka Enberg commit bc8cec0dff072f1a45ce7f6b2c5234bb3411ac51 Author: Massimo Cirillo Date: Thu Aug 27 10:44:09 2009 +0200 JFFS2: add missing verify buffer allocation/deallocation The function jffs2_nor_wbuf_flash_setup() doesn't allocate the verify buffer if CONFIG_JFFS2_FS_WBUF_VERIFY is defined, so causing a kernel panic when that macro is enabled and the verify function is called. Similarly the jffs2_nor_wbuf_flash_cleanup() must free the buffer if CONFIG_JFFS2_FS_WBUF_VERIFY is enabled. The following patch fixes the problem. The following patch applies to 2.6.30 kernel. Signed-off-by: Massimo Cirillo Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org commit 16f05c2b68520f94e365f9d347a7076f4ff00ad5 Author: Dimitri Gorokhovik Date: Thu Sep 3 14:04:22 2009 +0100 mtd: nftl: fix offset alignments Arithmetic conversion in the mask computation makes the upper word of the second argument passed down to mtd->read_oob(), be always 0 (assuming 'offs' being a 64-bit signed long long type, and 'mtd->writesize' being a 32-bit unsigned int type). This patch applies over the other one adding masking in nftl_write, "nftl: write support is broken". Signed-off-by: Dimitri Gorokhovik Cc: Tim Gardner Cc: Scott James Remnant Signed-off-by: David Woodhouse commit 4149ed1aa944ab864024982a2e568d17eccff504 Author: Dimitri Gorokhovik Date: Thu Sep 3 14:59:13 2009 +0100 mtd: nftl: write support is broken Write support is broken in NFTL. Fix it. Signed-off-by: Cc: Tim Gardner Cc: Scott James Remnant Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse commit edcb3b14863e1a6aa1923eeaa81125a00cf51a80 Author: Anton Vorontsov Date: Thu Aug 6 15:18:37 2009 -0700 mtd: m25p80: fix null pointer dereference bug This patch fixes the following oops, observed with MTD_PARTITIONS=n: m25p80 spi32766.0: m25p80 (1024 Kbytes) Unable to handle kernel paging request for data at address 0x00000008 Faulting instruction address: 0xc03a54b0 Oops: Kernel access of bad area, sig: 11 [#1] Modules linked in: NIP: c03a54b0 LR: c03a5494 CTR: c01e98b8 REGS: ef82bb60 TRAP: 0300 Not tainted (2.6.31-rc4-00167-g4733fd3) MSR: 00029000 CR: 24022022 XER: 20000000 DEAR: 00000008, ESR: 00000000 TASK = ef82c000[1] 'swapper' THREAD: ef82a000 GPR00: 00000000 ef82bc10 ef82c000 0000002e 00001eb8 ffffffff c01e9824 00000036 GPR08: c054ed40 c0542a08 00001eb8 00004000 22022022 1001a1a0 3ff8fd00 00000000 GPR16: 00000000 00000001 00000000 00000000 ef82bddc c0530000 efbef500 ef8356d0 GPR24: 00000000 ef8356d0 00000000 efbf7a00 c0530ec4 ffffffed efbf5300 c0541f98 NIP [c03a54b0] m25p_probe+0x22c/0x354 LR [c03a5494] m25p_probe+0x210/0x354 Call Trace: [ef82bc10] [c03a5494] m25p_probe+0x210/0x354 (unreliable) [ef82bca0] [c024e37c] spi_drv_probe+0x2c/0x3c [ef82bcb0] [c01f1afc] driver_probe_device+0xa4/0x178 [ef82bcd0] [c01f06e8] bus_for_each_drv+0x6c/0xa8 [ef82bd00] [c01f1a34] device_attach+0x84/0xa8 ... Signed-off-by: Anton Vorontsov Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse commit e6617c6ec28a17cf2f90262b835ec05b9b861400 Author: David S. Miller Date: Thu Sep 3 02:35:20 2009 -0700 sparc64: Kill spurious NMI watchdog triggers by increasing limit to 30 seconds. This is a compromise and a temporary workaround for bootup NMI watchdog triggers some people see with qla2xxx devices present. This happens when, for example: CPU 0 is in the driver init and looping submitting mailbox commands to load the firmware, then waiting for completion. CPU 1 is receiving the device interrupts. CPU 1 is where the NMI watchdog triggers. CPU 0 is submitting mailbox commands fast enough that by the time CPU 1 returns from the device interrupt handler, a new one is pending. This sequence runs for more than 5 seconds. The problematic case is CPU 1's timer interrupt running when the barrage of device interrupts begin. Then we have: timer interrupt return for softirq checking pending, thus enable interrupts qla2xxx interrupt return qla2xxx interrupt return ... 5+ seconds pass final qla2xxx interrupt for fw load return run timer softirq return At some point in the multi-second qla2xxx interrupt storm we trigger the NMI watchdog on CPU 1 from the NMI interrupt handler. The timer softirq, once we get back to running it, is smart enough to run the timer work enough times to make up for the missed timer interrupts. However, the NMI watchdogs (both x86 and sparc) use the timer interrupt count to notice the cpu is wedged. But in the above scenerio we'll receive only one such timer interrupt even if we last all the way back to running the timer softirq. The default watchdog trigger point is only 5 seconds, which is pretty low (the softwatchdog triggers at 60 seconds). So increase it to 30 seconds for now. Signed-off-by: David S. Miller commit a3df6f7d3090e611bcc774cd2cba45ae016d37e1 Author: Paul Mackerras Date: Thu Sep 3 11:52:02 2009 +1000 perf_counter/powerpc: Fix cache event codes for POWER7 I had the codes for L1 D-cache load accesses and misses swapped around, and the wrong codes for LL-cache accesses and misses. This corrects them. Reported-by: Corey Ashford Signed-off-by: Paul Mackerras Cc: Peter Zijlstra Cc: LKML-Reference: <19103.8514.709300.585484@cargo.ozlabs.ibm.com> Signed-off-by: Ingo Molnar commit 16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b Author: Eric Dumazet Date: Wed Sep 2 02:40:09 2009 +0000 tc: Fix unitialized kernel memory leak Three bytes of uninitialized kernel memory are currently leaked to user Signed-off-by: Eric Dumazet Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller commit 92653453c3015c083b9fe0ad48261c6b2267d482 Author: Clemens Ladisch Date: Wed Sep 2 18:25:39 2009 +0200 sound: oxygen: handle cards with missing EEPROM The card model detection code introduced in 2.6.30 that tries to work around partially broken EEPROM contents by reading the EEPROM directly does not handle cards where the EEPROM has been omitted. In this case, we have to use the default ID to allow the driver to load. Signed-off-by: Clemens Ladisch Reported-and-tested-by: Ozan Çağlayan Cc: Signed-off-by: Takashi Iwai commit 07fb6111e7af5fac6b6076e2658d0e32b67f713b Author: Zhenyu Wang Date: Thu Aug 13 18:57:29 2009 +0800 agp/intel: support for new chip variant of IGDNG mobile New variant of IGDNG mobile chip has new host bridge id. [anholt: Note that this new PCI ID doesn't impact the DRM, which doesn't care about the PCI ID of the bridge] Signed-off-by: Zhenyu Wang Signed-off-by: Eric Anholt commit 58c2fb647a3cf70a90d7b33a3f2a8396a20a0bc4 Author: Chris Wilson Date: Tue Sep 1 12:02:39 2009 +0100 drm/i915: Unref old_obj on get_fence_reg() error path Remember to release the local reference if we fail to wait on the rendering. (Also whilst in the vicinity add some whitespace so that the phasing of the operations is clearer.) Signed-off-by: Chris Wilson Signed-off-by: Eric Anholt commit bcc24fb42585dc9f490cf7789a917358414bdab5 Author: Jesse Barnes Date: Mon Aug 31 10:24:31 2009 -0700 drm/i915: increase default latency constant (v2 w/comment) Some i915/i945 platforms have a fairly high memory latency in certain situations, so increase our constant a bit to avoid FIFO underruns. The effect should be positive on other platforms as well; we'll have a bit more insurance against a busy memory subsystem due to the extra FIFO entries. Fixes fdo bug #23368. Needed for 2.6.31. Tested-by: Sven Arvidsson Tested-by: Chris Wilson Signed-off-by: Jesse Barnes Signed-off-by: Eric Anholt commit 5afe18d2f58812f3924edbd215464e5e3e8545e7 Author: Jiri Bohac Date: Wed Sep 2 11:00:46 2009 +0200 [IA64] fix csum_ipv6_magic() The 32-bit parameters (len and csum) of csum_ipv6_magic() are passed in 64-bit registers in2 and in4. The high order 32 bits of the registers were never cleared, and garbage was sometimes calculated into the checksum. Fix this by clearing the high order 32 bits of these registers. Signed-off-by: Jiri Bohac Signed-off-by: Tony Luck commit f2486f26692433ba27cc10991a085b503b0422a3 Author: Luck, Tony Date: Mon Aug 31 16:54:03 2009 -0700 [IA64] Fix warning in dma-mapping.c arch/ia64/kernel/dma-mapping.c:14: warning: control reaches end of non-void function arch/ia64/kernel/dma-mapping.c:14: warning: no return statement in function returning non-void This warning was introduced by commit: 390bd132b2831a2ad0268e84bffbfc0680debfe5 Add dma_debug_init() for ia64 Signed-off-by: Tony Luck commit 2fbd3da3877ad8d923b055e5996f80b4d4a6daf4 Author: David S. Miller Date: Tue Sep 1 17:59:25 2009 -0700 pkt_sched: Revert tasklet_hrtimer changes. These are full of unresolved problems, mainly that conversions don't work 1-1 from hrtimers to tasklet_hrtimers because unlike hrtimers tasklets can't be killed from softirq context. And when a qdisc gets reset, that's exactly what we need to do here. We'll work this out in the net-next-2.6 tree and if warranted we'll backport that work to -stable. This reverts the following 3 changesets: a2cb6a4dd470d7a64255a10b843b0d188416b78f ("pkt_sched: Fix bogon in tasklet_hrtimer changes.") 38acce2d7983632100a9ff3fd20295f6e34074a8 ("pkt_sched: Convert CBQ to tasklet_hrtimer.") ee5f9757ea17759e1ce5503bdae2b07e48e32af9 ("pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer") Signed-off-by: David S. Miller commit d66ee0587c3927aea5178a822976c7c853d815fe Author: Jarek Poplawski Date: Sun Aug 30 23:15:36 2009 +0000 net: sk_free() should be allowed right after sk_alloc() After commit 2b85a34e911bf483c27cfdd124aeb1605145dc80 (net: No more expensive sock_hold()/sock_put() on each tx) sk_free() frees socks conditionally and depends on sk_wmem_alloc being set e.g. in sock_init_data(). But in some cases sk_free() is called earlier, usually after other alloc errors. Fix is to move sk_wmem_alloc initialization from sock_init_data() to sk_alloc() itself. Signed-off-by: Jarek Poplawski Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 3725867dccfb83e4b0cff64e916a04258f300591 Author: Christoph Hellwig Date: Tue Sep 1 14:03:08 2009 -0400 xfs: actually enable the swapext compat handler Fix a small typo in the compat ioctl handler that cause the swapext compat handler to never be called. Signed-off-by: Christoph Hellwig Reviewed-by: Torsten Kaiser Tested-by: Torsten Kaiser Reviewed-by: Eric Sandeen Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit c295fc05789653ef24f296299df7c5f92fe74dce Author: Nikanth Karthikesan Date: Tue Sep 1 22:40:15 2009 +0200 block: Allow changing max_sectors_kb above the default 512 The patch "block: Use accessor functions for queue limits" (ae03bf639a5027d27270123f5f6e3ee6a412781d) changed queue_max_sectors_store() to use blk_queue_max_sectors() instead of directly assigning the value. But blk_queue_max_sectors() differs a bit 1. It sets both max_sectors_kb, and max_hw_sectors_kb 2. Never allows one to change max_sectors_kb above BLK_DEF_MAX_SECTORS. If one specifies a value greater then max_hw_sectors is set to that value but max_sectors is set to BLK_DEF_MAX_SECTORS I am not sure whether blk_queue_max_sectors() should be changed, as it seems to be that way for a long time. And there may be callers dependent on that behaviour. This patch simply reverts to the older way of directly assigning the value to max_sectors as it was before. Signed-off-by: Nikanth Karthikesan Signed-off-by: Jens Axboe commit ce6c3997c2fce74d12e6d8887a1d8cdf024fa850 Author: Dominik Brodowski Date: Fri Aug 7 22:58:51 2009 +0200 [CPUFREQ] Re-enable cpufreq suspend and resume code Commit 4bc5d3413503 is broken and causes regressions: (1) cpufreq_driver->resume() and ->suspend() were only called on __powerpc__, but you could set them on all architectures. In fact, ->resume() was defined and used before the PPC-related commit 42d4dc3f4e1e complained about in 4bc5d3413503. (2) Therfore, the resume functions in acpi_cpufreq and speedstep-smi would never be called. (3) This means speedstep-smi would be unusuable after suspend or resume. The _real_ problem was calling cpufreq_driver->get() with interrupts off, but it re-enabling interrupts on some platforms. Why is ->get() necessary? Some systems like to change the CPU frequency behind our back, especially during BIOS-intensive operations like suspend or resume. If such systems also use a CPU frequency-dependant timing loop, delays might be off by large factors. Therefore, we need to ascertain as soon as possible that the CPU frequency is indeed at the speed we think it is. You can do this two ways: either setting it anew, or trying to get it. The latter is what was done, the former also has the same IRQ issue. So, let's try something different: defer the checking to after interrupts are re-enabled, by calling cpufreq_update_policy() (via schedule_work()). Timings may be off until this later stage, so let's watch out for resume regressions caused by the deferred handling of frequency changes behind the kernel's back. Signed-off-by: Dominik Brodowski Signed-off-by: Dave Jones commit 04a13c7c632e1fe04a5f6e6c83565d2559e37598 Author: Tejun Heo Date: Tue Sep 1 21:12:28 2009 +0900 percpu: don't assume existence of cpu0 percpu incorrectly assumed that cpu0 was always there which led to the following warning and eventual oops on sparc machines w/o cpu0. WARNING: at mm/percpu.c:651 pcpu_map+0xdc/0x100() Modules linked in: Call Trace: [000000000045eb70] warn_slowpath_common+0x50/0xa0 [000000000045ebdc] warn_slowpath_null+0x1c/0x40 [00000000004d493c] pcpu_map+0xdc/0x100 [00000000004d59a4] pcpu_alloc+0x3e4/0x4e0 [00000000004d5af8] __alloc_percpu+0x18/0x40 [00000000005b112c] __percpu_counter_init+0x4c/0xc0 ... Unable to handle kernel NULL pointer dereference ... I7: Disabling lock debugging due to kernel taint Caller[000000000053c1b0]: sysfs_new_dirent+0x30/0x120 Caller[000000000053c7a4]: create_dir+0x24/0xc0 Caller[000000000053c870]: sysfs_create_dir+0x30/0x80 Caller[00000000005990e8]: kobject_add_internal+0xc8/0x200 ... Kernel panic - not syncing: Attempted to kill the idle task! This patch fixes the problem by backporting parts from devel branch to make percpu core not depend on the existence of cpu0. Signed-off-by: Tejun Heo Reported-by: Meelis Roos Cc: David Miller commit b91ab72b830e1494c2c7f8de05ccb2ab2c9cfb26 Author: Clemens Ladisch Date: Tue Sep 1 08:23:58 2009 +0200 sound: oxygen: fix MCLK rate for 192 kHz playback Do not forget to program the MCLK ratio for the I2S output. Otherwise, the master clock frequency can be too high for the DACs at sample frequencies above 96 kHz. Signed-off-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai commit 37d0892c5a94e208cf863e3b7bac014edee4346d Author: Ian Kent Date: Tue Sep 1 11:26:22 2009 +0800 autofs4 - fix missed case when changing to use struct path In the recent change by Al Viro that changes verious subsystems to use "struct path" one case was missed in the autofs4 module which causes mounts to no longer expire. Signed-off-by: Ian Kent Signed-off-by: Linus Torvalds commit cda9856f1ca62484433b9f734cd0fd553a5e4850 Merge: af39989 a3f730a Author: Linus Torvalds Date: Mon Aug 31 17:36:10 2009 -1000 Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix MacBookPro 3,1/4,1 quirk with ALC889A ALSA: hda - Add missing mux check for VT1708 commit af3998909772f766f27ba432f281d60098354269 Merge: 1a37f18 d95c5b0 Author: Linus Torvalds Date: Mon Aug 31 17:31:02 2009 -1000 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: V4L/DVB (12564a): MAINTAINERS: Update gspca sn9c20x name style V4L/DVB (12502): gspca - sn9c20x: Fix gscpa sn9c20x build errors. V4L/DVB (12495): em28xx: Don't call em28xx_ir_init when disable_ir is true V4L/DVB (12457): zr364: wrong indexes V4L/DVB (12451): Update KConfig File to enable SDIO and USB interfaces V4L/DVB (12450): Siano: Fixed SDIO compilation bugs V4L/DVB (12449): adds webcam for Micron device MT9M111 0x143A to em28xx V4L/DVB (12446): sms1xxx: restore GPIO functionality for all Hauppauge devices commit 1a37f184fa7824982a5f434c06981ec46a66cef7 Author: Benjamin Herrenschmidt Date: Mon Aug 31 13:48:16 2009 +1000 lmb: Also remove __init from lmb_end_of_RAM() declaration in lmb.h My previous patch (commit 4f8ee2c9cc: "lmb: Remove __init from lmb_end_of_DRAM()") removed __init in lmb.c but missed the fact that it was also marked as such in the .h Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit 60c3be387bb6cd39707d3ec0ebc324a0c96181f8 Author: Bartlomiej Zolnierkiewicz Date: Sun Aug 30 14:56:30 2009 +0200 ata_piix: parallel scanning on PATA needs an extra locking Commit log for commit 517d3cc15b36392e518abab6bacbb72089658313 ("[libata] ata_piix: Enable parallel scan") says: This patch turns on parallel scanning for the ata_piix driver. This driver is used on most netbooks (no AHCI for cheap storage it seems). The scan is the dominating time factor in the kernel boot for these devices; with this flag it gets cut in half for the device I used for testing (eeepc). Alan took a look at the driver source and concluded that it ought to be safe to do for this driver. Alan has also checked with the hardware team. and it is all true but once we put all things together additional constraints for PATA controllers show up (some hardware registers have per-host not per-port atomicity) and we risk misprogramming the controller. I used the following test to check whether the issue is real: @@ -736,8 +736,20 @@ static void piix_set_piomode(struct ata_ (timings[pio][1] << 8); } pci_write_config_word(dev, master_port, master_data); - if (is_slave) + if (is_slave) { + if (ap->port_no == 0) { + u8 tmp = slave_data; + + while (slave_data == tmp) { + pci_read_config_byte(dev, slave_port, &tmp); + msleep(50); + } + + dev_printk(KERN_ERR, &dev->dev, "PATA parallel scan " + "race detected\n"); + } pci_write_config_byte(dev, slave_port, slave_data); + } /* Ensure the UDMA bit is off - it will be turned back on if UDMA is selected */ and it indeed triggered the error message. Lets fix all such races by adding an extra locking to ->set_piomode and ->set_dmamode methods for PATA controllers. [ Alan: would be better to take the host lock in libata-core for these cases so that we fix all the adapters in one swoop. "Looks fine as a temproary quickfix tho" ] Cc: Arjan van de Ven Acked-by: Alan Cox Cc: Jeff Garzik Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Linus Torvalds commit b5af754405e8cb8b14b3f5958581ebf63c3601e9 Merge: adda766 db54501 Author: Linus Torvalds Date: Mon Aug 31 17:22:10 2009 -1000 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: drm/i915: Improve CRTDDC mapping by using VBT info drm/i915: Fix CPU-spinning hangs related to fence usage by using an LRU. drm/i915: Set crtc/clone mask in different output devices drm/i915: Always use SDVO_B detect bit for SDVO output detection. drm/i915: Fix typo that broke SVID1 in intel_sdvo_multifunc_encoder() drm/i915: Check if BIOS enabled dual-channel LVDS on 8xx, not only on 9xx drm/i915: Set the multiplier for SDVO on G33 platform commit a3f730af7e33cea10ea66f05b2565fde1f9512df Author: Takashi Iwai Date: Mon Aug 31 08:15:26 2009 +0200 ALSA: hda - Fix MacBookPro 3,1/4,1 quirk with ALC889A This patch fixes the wrong headphone output routing for MacBookPro 3,1/4,1 quirk with ALC889A codec, which caused the silent headphone output. Also, this gives the individual Headphone and Speaker volume controls. Reference: kernel bug#14078 http://bugzilla.kernel.org/show_bug.cgi?id=14078 Signed-off-by: Takashi Iwai Cc: commit 0f67a611629f84dd0afacd23d422b4b9c2558285 Author: Takashi Iwai Date: Mon Aug 31 08:12:29 2009 +0200 ALSA: hda - Add missing mux check for VT1708 In patch_vt1708(), the check of MUX nids is missing and this results in the -EINVAL error in accessing Input Source mixer element. Simpliy adding the call of get_mux_nids() fixes the problem. Reference: Novell bnc#534904 https://bugzilla.novell.com/show_bug.cgi?id=534904 Signed-off-by: Takashi Iwai commit d95c5b0b905aa9b70521eeb83ad4aea85f5e5fd0 Author: Joe Perches Date: Sun Aug 16 20:03:51 2009 -0300 V4L/DVB (12564a): MAINTAINERS: Update gspca sn9c20x name style To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Signed-off-by: Joe Perches Signed-off-by: Mauro Carvalho Chehab commit b6b85048c059e3f085095e48e12ed3f7a92c88d4 Author: Randy Dunlap Date: Wed Aug 26 03:34:16 2009 -0300 V4L/DVB (12502): gspca - sn9c20x: Fix gscpa sn9c20x build errors. Reported-by: Toralf Forster Signed-off-by: Randy Dunlap Signed-off-by: Jean-Francois Moine Signed-off-by: Andrew Morton Signed-off-by: Mauro Carvalho Chehab commit f4c5e80faba8ae420d7dc5d9237cc1e0262d7386 Author: Shine Liu Date: Thu Aug 20 23:49:26 2009 -0300 V4L/DVB (12495): em28xx: Don't call em28xx_ir_init when disable_ir is true We should call em28xx_ir_init(dev) only when disable_ir is true. Signed-off-by: Shine Liu Reviewed-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab commit 7b808924d65a4d1a0332d0043e02e9eb5dafe32b Author: Roel Kluin Date: Tue Aug 11 08:10:25 2009 -0300 V4L/DVB (12457): zr364: wrong indexes The order of indexes is reversed Signed-off-by: Roel Kluin Signed-off-by: Antoine Jacquet Signed-off-by: Mauro Carvalho Chehab commit 31e0ad693fb4e1d1be19dbe1c4f5a1ab9978e810 Author: Udi Atar Date: Thu Aug 13 16:30:25 2009 -0300 V4L/DVB (12451): Update KConfig File to enable SDIO and USB interfaces Update KConfig file to enbale selection of SDIO and USB interfaces, and add dependancy on relevant modules. [mchehab@redhat.com: fix merge conflicts, remove default: m, add missing endmenu] Signed-off-by: Udi Atar Signed-off-by: Mauro Carvalho Chehab commit ef2d12ce12117bb97fa35bbcf677c28e14667efa Author: Udi Atar Date: Sun Jun 28 04:22:55 2009 -0300 V4L/DVB (12450): Siano: Fixed SDIO compilation bugs Fixed SDIO compilation bugs Also fixed a memory overrun issue in buffer management. Signed-off-by: Udi Atar Signed-off-by: Mauro Carvalho Chehab commit f2e26ae7c8c077d001c77b330130f98e42ccad70 Author: Mauro Carvalho Chehab Date: Wed Aug 12 20:21:44 2009 -0300 V4L/DVB (12449): adds webcam for Micron device MT9M111 0x143A to em28xx [mchehab@redhat.com: fix merge conflict and a few CodingStyle issues] Signed-off-by: Steve Gotthardt Signed-off-by: Mauro Carvalho Chehab commit 3746b6178070958279010d112703bca9cdc15e0a Author: Michael Krufky Date: Sun Jul 12 23:30:14 2009 -0300 V4L/DVB (12446): sms1xxx: restore GPIO functionality for all Hauppauge devices Previous changesets broke Hauppauge devices and their GPIO configurations. This changeset restores the LED & LNA functionality. Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 38bddf04bcfe661fbdab94888c3b72c32f6873b3 Author: Toru UCHIYAMA Date: Sun Aug 30 22:04:07 2009 -0700 gianfar: gfar_remove needs to call unregister_netdev() This patch solves the problem that the Oops(BUG_ON) occurs by rmmod. # rmmod gianfar_driver ------------[ cut here ]------------ Kernel BUG at c01fec48 [verbose debug info unavailable] Oops: Exception in kernel mode, sig: 5 [#1] MPC837x MDS Modules linked in: gianfar_driver(-) usb_storage scsi_wait_scan NIP: c01fec48 LR: c01febf4 CTR: c01feba8 REGS: dec5bd60 TRAP: 0700 Tainted: G W (2.6.31-rc2) MSR: 00029032 CR: 22000424 XER: 20000000 TASK = dec4cac0[1135] 'rmmod' THREAD: dec5a000 GPR00: 00000002 dec5be10 dec4cac0 dfba1820 c035d444 c035d478 ffffffff 00000000 GPR08: 0000002b 00000001 dfba193c 00000001 22000424 10019b34 1ffcb000 00000000 GPR16: 10012008 00000000 bf82ebe0 100017ec bf82ebec bf82ebe8 bf82ebd0 00000880 GPR24: 00000000 bf82ebf0 c03532f0 c03532e4 c036b594 dfba183c dfba1800 dfba1820 NIP [c01fec48] free_netdev+0xa0/0xb8 LR [c01febf4] free_netdev+0x4c/0xb8 Call Trace: [dec5be10] [c01febf4] free_netdev+0x4c/0xb8 (unreliable) [dec5be30] [e105f290] gfar_remove+0x50/0x68 [gianfar_driver] [dec5be40] [c01ec534] of_platform_device_remove+0x30/0x44 [dec5be50] [c0181760] __device_release_driver+0x68/0xc8 [dec5be60] [c0181868] driver_detach+0xa8/0xac [dec5be80] [c0180814] bus_remove_driver+0x9c/0xd8 [dec5bea0] [c0181efc] driver_unregister+0x60/0x98 [dec5beb0] [c01ec650] of_unregister_driver+0x14/0x24 [dec5bec0] [e10631bc] gfar_exit+0x18/0x4bc [gianfar_driver] [dec5bed0] [c0047584] sys_delete_module+0x16c/0x228 [dec5bf40] [c00116bc] ret_from_syscall+0x0/0x38 --- Exception: c01 at 0xff3669c LR = 0x10000f34 Instruction dump: 409e0024 a07e00c0 7c63f050 4be74429 80010024 bba10014 38210020 7c0803a6 4e800020 68000003 3160ffff 7d2b0110 <0f090000> 38000004 387e01f0 901e01d4 ---[ end trace 8c595bcd37230a0f ]--- localhost kernel: ------------[ cut here ]------------ Signed-off-by: Toru UCHIYAMA uchiyama.toru@jp.fujitsu.com Signed-off-by: David S. Miller commit b1f1b8ce0a1d71cbc72f7540134d52b79bd8f5ac Author: Ryusuke Konishi Date: Sun Aug 30 04:21:41 2009 +0900 nilfs2: fix preempt count underflow in nilfs_btnode_prepare_change_key This will fix the following preempt count underflow reported from users with the title "[NILFS users] segctord problem" (Message-ID: <949415.6494.qm@web58808.mail.re1.yahoo.com> and Message-ID: ): WARNING: at kernel/sched.c:4890 sub_preempt_count+0x95/0xa0() Hardware name: HP Compaq 6530b (KR980UT#ABC) Modules linked in: bridge stp llc bnep rfcomm l2cap xfs exportfs nilfs2 cowloop loop vboxnetadp vboxnetflt vboxdrv btusb bluetooth uvcvideo videodev v4l1_compat v4l2_compat_ioctl32 arc4 snd_hda_codec_analog ecb iwlagn iwlcore rfkill lib80211 mac80211 snd_hda_intel snd_hda_codec ehci_hcd uhci_hcd usbcore snd_hwdep snd_pcm tg3 cfg80211 psmouse snd_timer joydev libphy ohci1394 snd_page_alloc hp_accel lis3lv02d ieee1394 led_class i915 drm i2c_algo_bit video backlight output i2c_core dm_crypt dm_mod Pid: 4197, comm: segctord Not tainted 2.6.30-gentoo-r4-64 #7 Call Trace: [] ? sub_preempt_count+0x95/0xa0 [] warn_slowpath_common+0x78/0xd0 [] warn_slowpath_null+0xf/0x20 [] sub_preempt_count+0x95/0xa0 [] nilfs_btnode_prepare_change_key+0x11b/0x190 [nilfs2] [] nilfs_btree_assign_p+0x19d/0x1e0 [nilfs2] [] nilfs_btree_assign+0xbd/0x130 [nilfs2] [] nilfs_bmap_assign+0x47/0x70 [nilfs2] [] nilfs_segctor_do_construct+0x956/0x20f0 [nilfs2] [] ? _spin_unlock_irqrestore+0x12/0x40 [] ? __up_write+0xe0/0x150 [] ? up_write+0x9/0x10 [] ? nilfs_bmap_test_and_clear_dirty+0x43/0x60 [nilfs2] [] ? nilfs_mdt_fetch_dirty+0x27/0x60 [nilfs2] [] nilfs_segctor_construct+0x8c/0xd0 [nilfs2] [] nilfs_segctor_thread+0x15c/0x3a0 [nilfs2] [] ? nilfs_construction_timeout+0x0/0x10 [nilfs2] [] ? add_timer+0x13/0x20 [] ? __wake_up_common+0x5a/0x90 [] ? autoremove_wake_function+0x0/0x40 [] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2] [] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2] [] kthread+0x56/0x90 [] child_rip+0xa/0x20 [] ? kthread+0x0/0x90 [] ? child_rip+0x0/0x20 This problem was caused due to a missing radix_tree_preload() call in the retry path of nilfs_btnode_prepare_change_key() function. Reported-by: Eric A Reported-by: Jerome Poulin Signed-off-by: Ryusuke Konishi Tested-by: Jerome Poulin Cc: stable@kernel.org commit 6faf17f6f1ffc586d16efc2f9fa2083a7785ee74 Author: Chris Wright Date: Fri Aug 28 13:00:06 2009 -0700 PCI SR-IOV: correct broken resource alignment calculations An SR-IOV capable device includes an SR-IOV PCIe capability which describes the Virtual Function (VF) BAR requirements. A typical SR-IOV device can support multiple VFs whose BARs must be in a contiguous region, effectively an array of VF BARs. The BAR reports the size requirement for a single VF. We calculate the full range needed by simply multiplying the VF BAR size with the number of possible VFs and create a resource spanning the full range. This all seems sane enough except it artificially inflates the alignment requirement for the VF BAR. The VF BAR need only be aligned to the size of a single BAR not the contiguous range of VF BARs. This can cause us to fail to allocate resources for the BAR despite the fact that we actually have enough space. This patch adds a thin PCI specific layer over the generic resource_alignment() function which is aware of the special nature of VF BARs and does sorting and allocation based on the smaller alignment requirement. I recognize that while resource_alignment is generic, it's basically a PCI helper. An alternative to this patch is to add PCI VF BAR specific information to struct resource. I opted for the extra layer rather than adding such PCI specific information to struct resource. This does have the slight downside that we don't cache the BAR size and re-read for each alignment query (happens a small handful of times during boot for each VF BAR). Signed-off-by: Chris Wright Cc: Ivan Kokshaysky Cc: Linus Torvalds Cc: Matthew Wilcox Cc: Yu Zhao Cc: stable@kernel.org Signed-off-by: Jesse Barnes commit db54501900ad3665dd669f5708ecd04fc5aed495 Author: David Müller (ELSOFT AG) Date: Sat Aug 29 08:54:45 2009 +0200 drm/i915: Improve CRTDDC mapping by using VBT info Use VBT information to determine which DDC bus to use for CRTDCC. Fall back to GPIOA if VBT info is not available. Signed-off-by: David Müller Reviewed-by: Jesse Barnes Signed-off-by: Eric Anholt Tested on: 855 (David), and 945GM, 965GM, GM45, and G45 (anholt) commit a09ba7faf75fa4b21980d81de8e5f3d5c0785ccf Author: Eric Anholt Date: Sat Aug 29 12:49:51 2009 -0700 drm/i915: Fix CPU-spinning hangs related to fence usage by using an LRU. The lack of a proper LRU was partially worked around by taking the fence from the object containing the oldest seqno. But if there are multiple objects inactive, then they don't have seqnos and the first fence reg among them would be chosen. If you were trying to copy data between two mappings, this could result in each page fault stealing the fence from the other argument, and your application hanging. https://bugs.freedesktop.org/show_bug.cgi?id=23566 https://bugs.freedesktop.org/show_bug.cgi?id=23220 https://bugs.freedesktop.org/show_bug.cgi?id=23253 https://bugs.freedesktop.org/show_bug.cgi?id=23366 Cc: Stable Team Signed-off-by: Eric Anholt Reviewed-by: Jesse Barnes Reviewed-by: Chris Wilson commit eced1dfcfcf6b0a35e925d73916a9d8e36ab5457 Author: Peter Zijlstra Date: Fri Aug 28 17:10:47 2009 +0200 perf_counter: Fix /0 bug in swcounters We have a race in the swcounter stuff where we can start counting a counter that has never been enabled, this leads to a /0 situation. The below avoids the /0 but doesn't close the race, this would need a new counter state. The race is due to perf_swcounter_is_counting() which cannot discern between disabled due to scheduled out, and disabled for any other reason. Such a crash has been seen by Ingo: [ 967.092372] divide error: 0000 [#1] SMP [ 967.096499] last sysfs file: /sys/devices/system/cpu/cpu15/cache/index2/shared_cpu_map [ 967.104846] CPU 5 [ 967.106965] Modules linked in: [ 967.110169] Pid: 3351, comm: hackbench Not tainted 2.6.31-rc8-tip-01158-gd940a54-dirty #1568 X8DTN [ 967.119456] RIP: 0010:[] [] perf_swcounter_ctx_event+0x127/0x1af [ 967.129137] RSP: 0018:ffff8801a95abd70 EFLAGS: 00010046 [ 967.134699] RAX: 0000000000000002 RBX: ffff8801bd645c00 RCX: 0000000000000002 [ 967.142162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8801bd645d40 [ 967.149584] RBP: ffff8801a95abdb0 R08: 0000000000000001 R09: ffff8801a95abe00 [ 967.157042] R10: 0000000000000037 R11: ffff8801aa1245f8 R12: ffff8801a95abe00 [ 967.164481] R13: ffff8801a95abe00 R14: ffff8801aa1c0e78 R15: 0000000000000001 [ 967.171953] FS: 0000000000000000(0000) GS:ffffc90000a00000(0063) knlGS:00000000f7f486c0 [ 967.180406] CS: 0010 DS: 002b ES: 002b CR0: 000000008005003b [ 967.186374] CR2: 000000004822c0ac CR3: 00000001b19a2000 CR4: 00000000000006e0 [ 967.193770] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 967.201224] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 967.208692] Process hackbench (pid: 3351, threadinfo ffff8801a95aa000, task ffff8801a96b0000) [ 967.217607] Stack: [ 967.219711] 0000000000000000 0000000000000037 0000000200000001 ffffc90000a1107c [ 967.227296] <0> ffff8801a95abe00 0000000000000001 0000000000000001 0000000000000037 [ 967.235333] <0> ffff8801a95abdf0 ffffffff810c0c20 0000000200a14f30 ffff8801a95abe40 [ 967.243532] Call Trace: [ 967.246103] [] do_perf_swcounter_event+0xde/0xec [ 967.252635] [] perf_tpcounter_event+0x79/0x7b [ 967.258957] [] ftrace_profile_sched_switch+0xc0/0xcb [ 967.265791] [] schedule+0x429/0x4c4 [ 967.271156] [] int_careful+0xd/0x14 Reported-by: Ingo Molnar Signed-off-by: Peter Zijlstra Cc: Paul Mackerras LKML-Reference: <1251472247.17617.74.camel@laptop> Signed-off-by: Ingo Molnar commit 0c7d400fafaeab6014504a6a6249f01bac7f7db4 Author: Herbert Xu Date: Sat Aug 29 20:44:04 2009 +1000 crypto: skcipher - Fix skcipher_dequeue_givcrypt NULL test As struct skcipher_givcrypt_request includes struct crypto_request at a non-zero offset, testing for NULL after converting the pointer returned by crypto_dequeue_request does not work. This can result in IPsec crashes when the queue is depleted. This patch fixes it by doing the pointer conversion only when the return value is non-NULL. In particular, we create a new function __crypto_dequeue_request that does the pointer conversion. Reported-by: Brad Bosch Signed-off-by: Herbert Xu commit ab1f5e49f84e7072a0aade47cfeecef70be46c0f Merge: 3161e45 11ebd1b Author: David S. Miller Date: Fri Aug 28 23:04:57 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit adda766193ea1cf3137484a9521972d080d0b7af Merge: 8442edc e29b3ee Author: Linus Torvalds Date: Fri Aug 28 19:41:05 2009 -1000 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6: ACPI: don't free non-existent backlight in acpi video module toshiba_acpi: return on a fail path ACPICA: Windows compatibility fix: same buffer/string store commit 8442edc18843491978f7820f87dbdf293461290e Merge: 825e1e2 750a887 Author: Linus Torvalds Date: Fri Aug 28 19:39:44 2009 -1000 Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify * 'for-linus' of git://git.infradead.org/users/eparis/notify: inotify: update the group mask on mark addition inotify: fix length reporting and size checking inotify: do not send a block of zeros when no pathname is available commit 825e1e23914b9c3dbc49ee8c5a1d1cb421c1270a Author: Grant Grundler Date: Fri Aug 28 15:00:36 2009 -0400 parisc: fix warning in traps.c On Tue, Aug 18, 2009 at 01:45:17PM -0400, John David Anglin wrote: > CC arch/parisc/kernel/traps.o > arch/parisc/kernel/traps.c: In function 'handle_interruption': > arch/parisc/kernel/traps.c:535:18: warning: operation on 'regs->iasq[0]' > may be undefined Yes - Line 535 should use both [0] and [1]. Reported-by: John David Anglin Signed-off-by: Grant Grundler Signed-off-by: Kyle McMartin Signed-off-by: Linus Torvalds commit 2574cc9f4ffc6c681c9177111357efe5b76f0e36 Author: Trond Myklebust Date: Fri Aug 28 11:12:12 2009 -0400 SUNRPC: Fix rpc_task_force_reencode This patch fixes the bug that was reported in http://bugzilla.kernel.org/show_bug.cgi?id=14053 If we're in the case where we need to force a reencode and then resend of the RPC request, due to xprt_transmit failing with a networking error, then we _must_ retransmit the entire request. Signed-off-by: Trond Myklebust Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit ea6bff368548d79529421a9dc0710fc5330eb504 Author: Ingo Molnar Date: Fri Aug 28 10:44:56 2009 +0200 modules: Fix build error in the !CONFIG_KALLSYMS case > James Bottomley (1): > module: workaround duplicate section names -tip testing found that this patch breaks the build on x86 if CONFIG_KALLSYMS is disabled: kernel/module.c: In function ‘load_module’: kernel/module.c:2367: error: ‘struct module’ has no member named ‘sect_attrs’ distcc[8269] ERROR: compile kernel/module.c on ph/32 failed make[1]: *** [kernel/module.o] Error 1 make: *** [kernel] Error 2 make: *** Waiting for unfinished jobs.... Commit 1b364bf misses the fact that section attributes are only built and dealt with if kallsyms is enabled. The patch below fixes this. ( note, technically speaking this should depend on CONFIG_SYSFS as well but this patch is correct too and keeps the #ifdef less intrusive - in the KALLSYMS && !SYSFS case the code is a NOP. ) Signed-off-by: Ingo Molnar [ Replaced patch with a slightly cleaner variation by James Bottomley ] Signed-off-by: Linus Torvalds commit 4ed86af67e04cb5eb93faba589d102726207865a Merge: 326ba50 295594e Author: Linus Torvalds Date: Fri Aug 28 19:32:32 2009 -1000 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Fix vSMP boot crash x86, xen: Initialize cx to suppress warning x86, xen: Suppress WP test on Xen commit e29b3ee3b005897fbdcfdd4b3190776e38739d70 Author: Keith Packard Date: Thu Aug 6 15:57:54 2009 -0700 ACPI: don't free non-existent backlight in acpi video module acpi_video_put_one_device was attempting to remove sysfs entries and unregister a backlight device without first checking that said backlight device structure had been created. Signed-off-by: Keith Packard Acked-by: Zhang Rui Signed-off-by: Andrew Morton Signed-off-by: Len Brown commit 82e7784f57a81faf673b09bc468e736d582fe754 Author: Jiri Slaby Date: Thu Aug 6 15:57:51 2009 -0700 toshiba_acpi: return on a fail path Return from bt_rfkill_poll() when hci_get_radio_state() fails. value is invalid in that case and should not be assigned to the rfkill state. This also fixes a double unlock bug. Signed-off-by: Jiri Slaby Cc: John W. Linville Cc: Johannes Berg Cc: Henrique de Moraes Holschuh Signed-off-by: Andrew Morton Signed-off-by: Len Brown commit b0de22bdffa2e9a8e280d769c59f866605268484 Author: Lin Ming Date: Wed Aug 26 09:01:34 2009 +0800 ACPICA: Windows compatibility fix: same buffer/string store Fix a compatibility issue when the same buffer or string is stored to itself. This has been seen in the field. Previously, ACPICA would zero out the buffer/string. Now, the operation is treated as a NOP. http://bugzilla.acpica.org/show_bug.cgi?id=803 Reported-by: Rezwanul Kabir Signed-off-by: Lin Ming Signed-off-by: Bob Moore Signed-off-by: Len Brown commit 11ebd1bf07fafde8d16562966c96b05b0d4ced9e Author: Zhu Yi Date: Fri Aug 28 11:42:31 2009 +0800 ipw2200: firmware DMA loading rework Bartlomiej Zolnierkiewicz reported an atomic order-6 allocation failure for ipw2200 firmware loading in kernel 2.6.30. High order allocation is likely to fail and should always be avoided. The patch fixes this problem by replacing the original order-6 pci_alloc_consistent() with an array of order-1 pages from a pci pool. This utilized the ipw2200 DMA command blocks (up to 64 slots). The maximum firmware size support remains the same (64*8K). This patch fixes bug http://bugzilla.kernel.org/show_bug.cgi?id=14016 Cc: Andrew Morton Cc: Mel Gorman Signed-off-by: Zhu Yi Signed-off-by: John W. Linville commit 750a8870fe4016ef3091fc97e084d58c613c2cc7 Author: Eric Paris Date: Fri Aug 28 12:50:47 2009 -0400 inotify: update the group mask on mark addition Seperating the addition and update of marks in inotify resulted in a regression in that inotify never gets events. The inotify group mask is always 0. This mask should be updated any time a new mark is added. Signed-off-by: Eric Paris commit 83cb10f0ef3c96162be92339ccf8c0c9c9f2d13e Author: Eric Paris Date: Fri Aug 28 11:57:55 2009 -0400 inotify: fix length reporting and size checking 0db501bd0610ee0c0 introduced a regresion in that it now sends a nul terminator but the length accounting when checking for space or reporting to userspace did not take this into account. This corrects all of the rounding logic. Signed-off-by: Eric Paris commit b962e7312ae87006aed6f68ceee94bdf8db08338 Author: Brian Rogers Date: Fri Aug 28 10:00:05 2009 -0400 inotify: do not send a block of zeros when no pathname is available When an event has no pathname, there's no need to pad it with a null byte and therefore generate an inotify_event sized block of zeros. This fixes a regression introduced by commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd where my system wouldn't finish booting because some process was being confused by this. Signed-off-by: Brian Rogers Signed-off-by: Eric Paris commit 6bb56347f5162d1a7cb1dc461023360781ecd4c0 Author: Ingo Molnar Date: Fri Aug 28 13:44:53 2009 +0200 perf_counters: Increase paranoia level Per-cpu counters are an ASLR information leak as they show the execution other tasks do. Increase the paranoia level to 1, which disallows per-cpu counters. (they still allow counting/profiling of own tasks - and admin can profile everything.) Acked-by: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit a1b08e75dff3dc18a88444803753e667bb1d126e Author: Tao Ma Date: Thu Aug 27 14:46:56 2009 +0800 ocfs2: invalidate dentry if its dentry_lock isn't initialized. In commit a5a0a630922a2f6a774b6dac19f70cb5abd86bb0, when ocfs2_attch_dentry_lock fails, we call an extra iput and reset dentry->d_fsdata to NULL. This resolve a bug, but it isn't completed and the dentry is still there. When we want to use it again, ocfs2_dentry_revalidate doesn't catch it and return true. That make future ocfs2_dentry_lock panic out. One bug is http://oss.oracle.com/bugzilla/show_bug.cgi?id=1162. The resolution is to add a check for dentry->d_fsdata in revalidate process and return false if dentry->d_fsdata is NULL, so that a new ocfs2_lookup will be called again. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit 326ba5010a5429a5a528b268b36a5900d4ab0eba Author: Linus Torvalds Date: Thu Aug 27 17:59:04 2009 -0700 Linux 2.6.31-rc8 commit 1b364bf438cf337a3818aee77d68c0713f3e1fc4 Author: James Bottomley Date: Wed Aug 26 22:04:12 2009 +0930 module: workaround duplicate section names The root cause is a duplicate section name (.text); is this legal? [ Amerigo Wang: "AFAIK, yes." ] However, there's a problem with commit 6d76013381ed28979cd122eb4b249a88b5e384fa in that if you fail to allocate a mod->sect_attrs (in this case it's null because of the duplication), it still gets used without checking in add_notes_attrs() This should fix it [ This patch leaves other problems, particularly the sections directory, but recent parisc toolchains seem to produce these modules and this prevents a crash and is a minimal change -- RR ] Signed-off-by: James Bottomley Signed-off-by: Rusty Russell Tested-by: Helge Deller Signed-off-by: Linus Torvalds commit 7d1d16e416e61aeef8655d542f8e4a4fc6e808e4 Author: Rusty Russell Date: Wed Aug 26 22:02:54 2009 +0930 module: fix BUG_ON() for powerpc (and other function descriptor archs) The rarely-used symbol_put_addr() needs to use dereference_function_descriptor on powerpc. Reported-by: Paul Mackerras Signed-off-by: Rusty Russell commit 0a80fb10239b04c45e5e80aad8d4b2ca5ac407b2 Author: Jeremy Fitzhardinge Date: Thu Aug 27 12:22:43 2009 -0700 xenfb: connect to backend before registering fb As soon as the framebuffer is registered, our methods may be called by the kernel. This leads to a crash as xenfb_refresh() gets called before we have the irq. Connect to the backend before registering our framebuffer with the kernel. [ Fixes bug http://bugzilla.kernel.org/show_bug.cgi?id=14059 ] Signed-off-by: Michal Schmidt Signed-off-by: Jeremy Fitzhardinge Signed-off-by: Linus Torvalds commit 9c504cadc443a3d002fa581ec5109c0ef02d7b14 Merge: 4f8ee2c 0db501b Author: Linus Torvalds Date: Thu Aug 27 12:26:02 2009 -0700 Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify * 'for-linus' of git://git.infradead.org/users/eparis/notify: inotify: Ensure we alwasy write the terminating NULL. inotify: fix locking around inotify watching in the idr inotify: do not BUG on idr entries at inotify destruction inotify: seperate new watch creation updating existing watches commit 4f8ee2c9cc0e885d2bb50ef26db66150ab25213e Author: Benjamin Herrenschmidt Date: Thu Aug 27 17:20:30 2009 +1000 lmb: Remove __init from lmb_end_of_DRAM() We call lmb_end_of_DRAM() to test whether a DMA mask is ok on a machine without IOMMU, but this function is marked as __init. I don't think there's a clean way to get the top of RAM max_pfn doesn't appear to include highmem or I missed (or we have a bug :-) so for now, let's just avoid having a broken 2.6.31 by making this function non-__init and we can revisit later. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Linus Torvalds commit cf481442f2e086316ed8a1b3046f00ad23632ac4 Merge: 788d908 7815f4b Author: Linus Torvalds Date: Thu Aug 27 12:24:08 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: 9p: update documentation pointers 9p: remove unnecessary v9fses->options which duplicates the mount string net/9p: insulate the client against an invalid error code sent by a 9p server 9p: Add missing cast for the error return value in v9fs_get_inode 9p: Remove redundant inode uid/gid assignment 9p: Fix possible regressions when ->get_sb fails. 9p: Fix v9fs show_options 9p: Fix possible memleak in v9fs_inode_from fid. 9p: minor comment fixes 9p: Fix possible inode leak in v9fs_get_inode. 9p: Check for error in return value of v9fs_fid_add commit 788d908f2879a17e5f80924f3da2e23f1034482d Author: Julien TINNES Date: Thu Aug 27 15:26:58 2009 +0200 ipv4: make ip_append_data() handle NULL routing table Add a check in ip_append_data() for NULL *rtp to prevent future bugs in callers from being exploitable. Signed-off-by: Julien Tinnes Signed-off-by: Tavis Ormandy Acked-by: David S. Miller Signed-off-by: Linus Torvalds commit 9886e836a6a5dbd273dc55b17e713f0a188d137f Author: David Howells Date: Thu Aug 27 13:09:06 2009 +0100 AFS: Stop readlink() on AFS crashing due to NULL 'file' ptr kAFS crashes when asked to read a symbolic link because page_getlink() passes a NULL file pointer to read_mapping_page(), but afs_readpage() expects a file pointer from which to extract a key. Modify afs_readpage() to request the appropriate key from the calling process's keyrings if a file struct is not supplied with one attached. Signed-off-by: David Howells Acked-by: Anton Blanchard Signed-off-by: Linus Torvalds commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd Author: Eric W. Biederman Date: Thu Aug 27 03:20:04 2009 -0700 inotify: Ensure we alwasy write the terminating NULL. Before the rewrite copy_event_to_user always wrote a terqminating '\0' byte to user space after the filename. Since the rewrite that terminating byte was skipped if your filename is exactly a multiple of event_size. Ouch! So add one byte to name_size before we round up and use clear_user to set userspace to zero like /dev/zero does instead of copying the strange nul_inotify_event. I can't quite convince myself len_to_zero will never exceed 16 and even if it doesn't clear_user should be more efficient and a more accurate reflection of what the code is trying to do. Signed-off-by: Eric W. Biederman Signed-off-by: Eric Paris commit dead537dd8a1c9495322c1d6f7c780697f474af0 Author: Eric Paris Date: Mon Aug 24 16:03:35 2009 -0400 inotify: fix locking around inotify watching in the idr The are races around the idr storage of inotify watches. It's possible that a watch could be found from sys_inotify_rm_watch() in the idr, but it could be removed from the idr before that code does it's removal. Move the locking and the refcnt'ing so that these have to happen atomically. Signed-off-by: Eric Paris commit cf4374267fbe966e8e4e7db68f5dc7b267439780 Author: Eric Paris Date: Mon Aug 24 16:03:35 2009 -0400 inotify: do not BUG on idr entries at inotify destruction If an inotify watch is left in the idr when an fsnotify group is destroyed this will lead to a BUG. This is not a dangerous situation and really indicates a programming bug and leak of memory. This patch changes it to use a WARN and a printk rather than killing people's boxes. Signed-off-by: Eric Paris commit 52cef7555adf5ca09b3b7283097466759120d901 Author: Eric Paris Date: Mon Aug 24 16:03:35 2009 -0400 inotify: seperate new watch creation updating existing watches There is nothing known wrong with the inotify watch addition/modification but this patch seperates the two code paths to make them each easy to verify as correct. Signed-off-by: Eric Paris commit 1e23502cc57cef33455ac7cb9111e3c6d991a894 Merge: e99b1f2 3161e45 Author: Linus Torvalds Date: Wed Aug 26 20:54:48 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: virtio: net refill on out-of-memory smc91x: fix compilation on SMP commit e99b1f22f91cc5e2d06699b3d8958a0ff6cb24d9 Merge: 5311034 b080f18 Author: Linus Torvalds Date: Wed Aug 26 20:39:31 2009 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/ps3: Update ps3_defconfig powerpc/ps3: Add missing check for PS3 to rtc-ps3 platform device registration commit b080f187adb79bbcbe28814b07cbc1ead34c469a Author: Geoff Levand Date: Tue Aug 25 07:53:35 2009 +0000 powerpc/ps3: Update ps3_defconfig Update ps3_defconfig. o Refresh for 2.6.31. o Remove MTD support. o Add more HID drivers. Signed-off-by: Geoff Levand Signed-off-by: Benjamin Herrenschmidt commit 7b6a09f3d6aedeaac923824af2a5df30300b56e9 Author: Geert Uytterhoeven Date: Sun Aug 23 22:54:32 2009 +0000 powerpc/ps3: Add missing check for PS3 to rtc-ps3 platform device registration On non-PS3, we get: | kernel BUG at drivers/rtc/rtc-ps3.c:36! because the rtc-ps3 platform device is registered unconditionally in a kernel with builtin support for PS3. Reported-by: Sachin Sant Signed-off-by: Geert Uytterhoeven Acked-by: Geoff Levand Signed-off-by: Benjamin Herrenschmidt commit 5311034ddda7aad48934520d3536b9d0e4502672 Merge: 533995e 53a7197 Author: Linus Torvalds Date: Wed Aug 26 20:17:07 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: IMA: iint put in ima_counts_get and put commit 533995ed85730a1f5f385b9ecb2d2b4b731d27b4 Merge: cc674c8 9848484 Author: Linus Torvalds Date: Wed Aug 26 20:16:38 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k,m68knommu: Wire up rt_tgsigqueueinfo and perf_counter_open m68k: Fix redefinition of pgprot_noncached arch/m68k/include/asm/motorola_pgalloc.h: fix kunmap arg m68k: cnt reaches -1, not 0 m68k: count can reach 51, not 50 commit cc674c81f01a6151ca00c617e5efa0812ee5fdbe Author: Thadeu Lima de Souza Cascardo Date: Wed Aug 26 14:29:32 2009 -0700 leds: after setting inverted attribute, we must update the LED If we change the inverted attribute to another value, the LED will not be inverted until we change the GPIO state. Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Samuel R. C. Vale Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 48cccd26f36511ddb6aeca07485ecf2829683907 Author: Thadeu Lima de Souza Cascardo Date: Wed Aug 26 14:29:31 2009 -0700 leds: fix multiple requests and releases of IRQ for GPIO LED Trigger When setting the same GPIO number, multiple IRQ shared requests will be done without freing the previous request. It will also try to free a failed request or an already freed IRQ if 0 was written to the gpio file. All these oops and leaks were fixed with the following solution: keep the previous allocated GPIO (if any) still allocated in case the new request fails. The alternative solution would desallocate the previous allocated GPIO and set gpio as 0. Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Samuel R. C. Vale Cc: Richard Purdie Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bdf57de4e6abc389cc3f3bd94ec15cce74cf6f4b Author: Frans Pop Date: Wed Aug 26 14:29:30 2009 -0700 acpi processor: remove superfluous warning message This failure is very common on many platforms. Handling it in the ACPI processor driver is enough, and we don't need a warning message unless CONFIG_ACPI_DEBUG is set. Based on a patch from Zhang Rui. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13389 Signed-off-by: Frans Pop Acked-by: Zhang Rui Cc: Len Brown Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2a908002c7b1b666616103e9df2419b38d7c6f1f Author: Frans Pop Date: Wed Aug 26 14:29:29 2009 -0700 ACPI processor: force throttling state when BIOS returns incorrect value If the BIOS reports an invalid throttling state (which seems to be fairly common after system boot), a reset is done to state T0. Because of a check in acpi_processor_get_throttling_ptc(), the reset never actually gets executed, which results in the error reoccurring on every access of for example /proc/acpi/processor/CPU0/throttling. Add a 'force' option to acpi_processor_set_throttling() to ensure the reset really takes effect. Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13389 This patch, together with the next one, fixes a regression introduced in 2.6.30, listed on the regression list. They have been available for 2.5 months now in bugzilla, but have not been picked up, despite various reminders and without any reason given. Google shows that numerous people are hitting this issue. The issue is in itself relatively minor, but the bug in the code is clear. The patches have been in all my kernels and today testing has shown that throttling works correctly with the patches applied when the system overheats (http://bugzilla.kernel.org/show_bug.cgi?id=13918#c14). Signed-off-by: Frans Pop Acked-by: Zhang Rui Cc: Len Brown Cc: "Rafael J. Wysocki" Cc: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f3d83e2415445e5b157bef404d38674e9e8de169 Author: Costantino Leandro Date: Wed Aug 26 14:29:28 2009 -0700 wmi: fix kernel panic when stack protection enabled. Summary: Kernel panic arise when stack protection is enabled, since strncat will add a null terminating byte '\0'; So in functions like this one (wmi_query_block): char wc[4]="WC"; .... strncat(method, block->object_id, 2); ... the length of wc should be n+1 (wc[5]) or stack protection fault will arise. This is not noticeable when stack protection is disabled,but , isn't good either. Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y, CONFIG_CC_STACKPROTECTOR=y] Panic Trace ------------ .... stack-protector: kernel stack corrupted in : fa7b182c 2.6.30-rc8-obelisco-generic call_trace: [] ? panic+0x45/0xd9 [] ? __stack_chk_fail+0x1c/0x40 [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? acer_wmi_init+0x00/0x61a [acer_wmi] [] ? acer_wmi_init+0x135/0x61a [acer_wmi] [] ? do_one_initcall+0x50+0x126 Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514 Signed-off-by: Costantino Leandro Signed-off-by: Carlos Corbacho Cc: Len Brown Cc: Bjorn Helgaas Cc: "Rafael J. Wysocki" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit ce8442b55135c679809311997d1446f3bbc05de2 Author: Yinghai Lu Date: Wed Aug 26 14:29:26 2009 -0700 acpi: don't call acpi_processor_init if acpi is disabled Jens reported early_ioremap messages with old ASUS board... > [ 1.507461] pci 0000:00:09.0: Firmware left e100 interrupts enabled; disabling > [ 1.532778] early_ioremap(3fffd080, 0000005c) [0] => Pid: 1, comm: swapper Not tainted 2.6.31-rc4 #36 > [ 1.561007] Call Trace: > [ 1.568638] [] ? printk+0x18/0x1d > [ 1.581734] [] __early_ioremap+0x74/0x1e9 > [ 1.596898] [] early_ioremap+0x1a/0x1c > [ 1.611270] [] __acpi_map_table+0x18/0x1a > [ 1.626451] [] acpi_os_map_memory+0x1d/0x25 > [ 1.642129] [] acpi_tb_verify_table+0x20/0x49 > [ 1.658321] [] acpi_get_table_with_size+0x53/0xa1 > [ 1.675553] [] acpi_get_table+0x10/0x15 > [ 1.690192] [] acpi_processor_init+0x23/0xab > [ 1.706126] [] do_one_initcall+0x33/0x180 > [ 1.721279] [] ? acpi_processor_init+0x0/0xab > [ 1.737479] [] ? register_irq_proc+0xaa/0xc0 > [ 1.753411] [] ? init_irq_proc+0x67/0x80 > [ 1.768316] [] kernel_init+0x120/0x176 > [ 1.782678] [] ? kernel_init+0x0/0x176 > [ 1.797062] [] kernel_thread_helper+0x7/0x10 > [ 1.812984] 00000080 + ffe00000 that is rather later. acpi_gbl_permanent_mmap should be set in acpi_early_init() if acpi is not disabled and we have > [ 0.000000] ASUS P2B-DS detected: force use of acpi=ht just don't load acpi_processor_init... Reported-and-tested-by: Jens Rosenboom Signed-off-by: Yinghai Lu Acked-by: Ingo Molnar Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0d288162f2afc42b37aab656f4622c076babbca3 Author: Michael Brunner Date: Wed Aug 26 14:29:25 2009 -0700 thermal_sys: check get_temp return value The return value of the get_temp function is not checked when doing a thermal zone update. This may lead to a critical shutdown if get_temp fails and the content of the temp variable is incorrectly set higher than the critical trip point. This has been observed on a system with incorrect ACPI implementation where the corresponding methods were not serialized and therefore sometimes triggered ACPI errors (AE_ALREADY_EXISTS). The following critical shutdowns indicated a temperature of 2097 C, which was obviously wrong. The patch adds a return value check that jumps over all trip point evaluations printing a warning if get_temp fails. The trip points are evaluated again on the next polling interval with successful get_temp execution. Signed-off-by: Michael Brunner Acked-by: Zhang Rui Cc: Len Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4ab6c08336535f8c8e42cf45d7adeda882eff06e Author: Oleg Nesterov Date: Wed Aug 26 14:29:24 2009 -0700 clone(): fix race between copy_process() and de_thread() Spotted by Hiroshi Shimamoto who also provided the test-case below. copy_process() uses signal->count as a reference counter, but it is not. This test case #include #include #include #include #include #include void *null_thread(void *p) { for (;;) sleep(1); return NULL; } void *exec_thread(void *p) { execl("/bin/true", "/bin/true", NULL); return null_thread(p); } int main(int argc, char **argv) { for (;;) { pid_t pid; int ret, status; pid = fork(); if (pid < 0) break; if (!pid) { pthread_t tid; pthread_create(&tid, NULL, exec_thread, NULL); for (;;) pthread_create(&tid, NULL, null_thread, NULL); } do { ret = waitpid(pid, &status, 0); } while (ret == -1 && errno == EINTR); } return 0; } quickly creates an unkillable task. If copy_process(CLONE_THREAD) races with de_thread() copy_signal()->atomic(signal->count) breaks the signal->notify_count logic, and the execing thread can hang forever in kernel space. Change copy_process() to increment count/live only when we know for sure we can't fail. In this case the forked thread will take care of its reference to signal correctly. If copy_process() fails, check CLONE_THREAD flag. If it it set - do nothing, the counters were not changed and current belongs to the same thread group. If it is not set, ->signal must be released in any case (and ->count must be == 1), the forked child is the only thread in the thread group. We need more cleanups here, in particular signal->count should not be used by de_thread/__exit_signal at all. This patch only fixes the bug. Reported-by: Hiroshi Shimamoto Tested-by: Hiroshi Shimamoto Signed-off-by: Oleg Nesterov Acked-by: Roland McGrath Cc: KAMEZAWA Hiroyuki Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 03ef83af528899aa339e42d8024b37e2f434fba4 Author: Minchan Kim Date: Wed Aug 26 14:29:23 2009 -0700 mm: fix for infinite churning of mlocked pages An mlocked page might lose the isolatation race. This causes the page to clear PG_mlocked while it remains in a VM_LOCKED vma. This means it can be put onto the [in]active list. We can rescue it by using try_to_unmap() in shrink_page_list(). But now, As Wu Fengguang pointed out, vmscan has a bug. If the page has PG_referenced, it can't reach try_to_unmap() in shrink_page_list() but is put into the active list. If the page is referenced repeatedly, it can remain on the [in]active list without being moving to the unevictable list. This patch fixes it. Reported-by: Wu Fengguang Signed-off-by: Minchan Kim Reviewed-by: KOSAKI Motohiro < Cc: Lee Schermerhorn Acked-by: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b62e408c05228f40e69bb38a48db8961cac6cd23 Author: David Rientjes Date: Wed Aug 26 14:29:22 2009 -0700 flex_array: convert element_nr formals to unsigned It's problematic to allow signed element_nr's or total's to be passed as part of the flex array API. flex_array_alloc() allows total_nr_elements to be set to a negative quantity, which is obviously erroneous. flex_array_get() and flex_array_put() allows negative array indices in dereferencing an array part, which could address memory mapped before struct flex_array. The fix is to convert all existing element_nr formals to be qualified as unsigned. Existing checks to compare it to total_nr_elements or the max array size based on element_size need not be changed. Signed-off-by: David Rientjes Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8e7ee27095aee87b5db1b0061e2ceea5878a1bbd Author: David Rientjes Date: Wed Aug 26 14:29:21 2009 -0700 flex_array: declare parts member to have incomplete type The `parts' member of struct flex_array should evaluate to an incomplete type so that sizeof() cannot be used and C99 does not require the zero-length specification. Signed-off-by: David Rientjes Acked-by: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 105b6e8a74cac11cdf70903877593c7f202075cc Author: David Rientjes Date: Wed Aug 26 14:29:20 2009 -0700 flex_array: fix flex_array_free_parts comment flex_array_free_parts() does not take `src' or `element_nr' formals, so remove their respective comments. Signed-off-by: David Rientjes Acked-by: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a30b595d2ca6d39e784a1bed5f2b35f3d7a03af7 Author: David Rientjes Date: Wed Aug 26 14:29:20 2009 -0700 flex_array: fix get function for elements in base starting at non-zero If all array elements fit into the base structure and data is copied using flex_array_put() starting at a non-zero index, flex_array_get() will fail to return the data. This fixes the bug by only checking for NULL parts when all elements do not fit in the base structure when flex_array_get() is used. Otherwise, fa_element_to_part_nr() will always be 0 since there are no parts structures needed and such element may never have been put. Thus, it will remain NULL due to the kzalloc() of the base. Additionally, flex_array_put() now only checks for a NULL part when all elements do not fit in the base structure. This is otherwise unnecessary since the base structure is guaranteed to exist (or we would have already hit a NULL pointer). Signed-off-by: David Rientjes Acked-by: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 054b2b13ccba4876a1ce98a7ede7dab7d6893d01 Author: Joonwoo Park Date: Wed Aug 26 14:29:18 2009 -0700 pps: fix incorrect verdict check Fix incorrect verdict check and returns error if device_create failed, otherwise driver triggers kernel oops. Signed-off-by: Joonwoo Park Cc: Rodolfo Giometti Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 53a7197aff20e341487fca8575275056fe1c63e5 Author: Eric Paris Date: Wed Aug 26 14:56:48 2009 -0400 IMA: iint put in ima_counts_get and put ima_counts_get() calls ima_iint_find_insert_get() which takes a reference to the iint in question, but does not put that reference at the end of the function. This can lead to a nasty memory leak. Easy enough to reproduce: #include #include int main (void) { int i; void *ptr; for (i=0; i < 100000; i++) { ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_ANONYMOUS, -1, 0); if (ptr == MAP_FAILED) return 2; munmap(ptr, 4096); } return 0; } Signed-off-by: Eric Paris Signed-off-by: James Morris commit 9848484fad9ddeb18f18f02f9ecdcd330ac9a216 Author: Geert Uytterhoeven Date: Fri Aug 21 22:03:54 2009 +0200 m68k,m68knommu: Wire up rt_tgsigqueueinfo and perf_counter_open Signed-off-by: Geert Uytterhoeven Acked-by: Greg Ungerer commit 9fd926b4ab1e38ac5e3eb3ba0afb56726d90aa88 Author: Alexey Dobriyan Date: Thu Jul 9 17:08:38 2009 +0400 m68k: Fix redefinition of pgprot_noncached arch/m68k/include/asm/pgtable_mm.h:148:1: warning: "pgprot_noncached" redefined In file included from arch/m68k/include/asm/pgtable_mm.h:138, from arch/m68k/include/asm/pgtable.h:4, from include/linux/mm.h:40, from include/linux/pagemap.h:7, from include/linux/blkdev.h:12, from arch/m68k/emu/nfblock.c:17: include/asm-generic/pgtable.h:133:1: warning: this is the location of the previous definition pgprot_noncached() should be defined _before_ including asm-generic/pgtable.h Signed-off-by: Alexey Dobriyan Signed-off-by: Geert Uytterhoeven commit dc71c7d5dbd8cd8bb6e3b548ddc0454b64ded5f8 Author: Andrew Morton Date: Wed Jun 17 13:13:58 2009 -0700 arch/m68k/include/asm/motorola_pgalloc.h: fix kunmap arg arch/m68k/include/asm/motorola_pgalloc.h: In function 'pte_alloc_one': arch/m68k/include/asm/motorola_pgalloc.h:44: warning: passing argument 1 of 'kunmap' from incompatible pointer type Also, remove unneeded test for kmap() failure. Signed-off-by: Andrew Morton Signed-off-by: Geert Uytterhoeven commit dd9b3e84f2095ed19582f4df5d20e1e40c01ca3c Author: Roel Kluin Date: Wed Jun 17 13:13:57 2009 -0700 m68k: cnt reaches -1, not 0 With the postfix decrement cnt reaches -1 rather than 0. Signed-off-by: Roel Kluin Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Geert Uytterhoeven commit dac9ff79a8122b30176e23359bb879b3144d7f1f Author: Roel Kluin Date: Wed Jun 17 13:13:56 2009 -0700 m68k: count can reach 51, not 50 With while (count++ < 50) { ... } count can reach 51, not 50, so we shouldn't give an error message on a count of 50. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: Roel Kluin Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Geert Uytterhoeven commit 3161e453e496eb5643faad30fff5a5ab183da0fe Author: Rusty Russell Date: Wed Aug 26 12:22:32 2009 -0700 virtio: net refill on out-of-memory If we run out of memory, use keventd to fill the buffer. There's a report of this happening: "Page allocation failures in guest", Message-ID: <20090713115158.0a4892b0@mjolnir.ossman.eu> Signed-off-by: Rusty Russell Signed-off-by: David S. Miller commit 0b4f2928f14c4a9770b0866923fc81beb7f4aa57 Author: Alexey Dobriyan Date: Wed Aug 26 12:03:35 2009 -0700 smc91x: fix compilation on SMP Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit ced909ff048c9950e211783417f3c01361f3be28 Author: Dmitry Torokhov Date: Tue Aug 25 19:24:10 2009 -0700 Input: i8042 - add Acer Aspire 5536 to the nomux list When KBC is in active multiplexing mode, disabling and re-enabling the touchpad with the special key leaves the touchpad dead. Since the laptop does not have any external PS/2 ports disabling MUX mode should be safe. Reported-by: Eugeniy Meshcheryakov Signed-off-by: Dmitry Torokhov commit 295594e9cf6ae2efd73371777aa8feba0f87f42f Author: Yinghai Lu Date: Tue Aug 25 13:44:44 2009 -0700 x86: Fix vSMP boot crash 2.6.31-rc7 does not boot on vSMP systems: [ 8.501108] CPU31: Thermal monitoring enabled (TM1) [ 8.501127] CPU 31 MCA banks SHD:2 SHD:3 SHD:5 SHD:6 SHD:8 [ 8.650254] CPU31: Intel(R) Xeon(R) CPU E5540 @ 2.53GHz stepping 04 [ 8.710324] Brought up 32 CPUs [ 8.713916] Total of 32 processors activated (162314.96 BogoMIPS). [ 8.721489] ERROR: parent span is not a superset of domain->span [ 8.727686] ERROR: domain->groups does not contain CPU0 [ 8.733091] ERROR: groups don't span domain->span [ 8.737975] ERROR: domain->cpu_power not set [ 8.742416] Ravikiran Thirumalai bisected it to: | commit 2759c3287de27266e06f1f4e82cbd2d65f6a044c | x86: don't call read_apic_id if !cpu_has_apic The problem is that on vSMP systems the CPUID derived initial-APICIDs are overlapping - so we need to fall back on hard_smp_processor_id() which reads the local APIC. Both come from the hardware (influenced by firmware though) so it's a tough call which one to trust. Doing the quirk expresses the vSMP property properly and also does not affect other systems, so we go for this solution instead of a revert. Reported-and-Tested-by: Ravikiran Thirumalai Signed-off-by: Yinghai Lu Cc: Linus Torvalds Cc: Cyrill Gorcunov Cc: Shai Fultheim Cc: Suresh Siddha LKML-Reference: <4A944D3C.5030100@kernel.org> Signed-off-by: Ingo Molnar commit f415c413f458837bd0c27086b79aca889f9435e4 Merge: 4dc627d 4484b9c Author: Linus Torvalds Date: Tue Aug 25 21:24:49 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: irda/sa1100_ir: fix broken netdev_ops conversion irda/au1k_ir: fix broken netdev_ops conversion pkt_sched: Fix bogon in tasklet_hrtimer changes. commit 4dc627d55edad85e26ae81f17634bd4590993ba0 Merge: 9c93768 d8ed1d4 Author: Linus Torvalds Date: Tue Aug 25 21:24:26 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Validate linear D-TLB misses. sparc64: Update defconfig. sparc32: Update defconfig. sparc32: Kill trap table freeing code. sparc: sys32.S incorrect compat-layer splice() system call sparc: Use page_fault_out_of_memory() for VM_FAULT_OOM. sparc64: Sign extend length arg to truncate syscalls when compat. sparc: Fix cleanup crash in bbc_envctrl_cleanup() commit 7adb4df410966dfe43e4815256e3215110648fb8 Author: H. Peter Anvin Date: Tue Aug 25 21:06:03 2009 -0700 x86, xen: Initialize cx to suppress warning Initialize cx before calling xen_cpuid(), in order to suppress the "may be used uninitialized in this function" warning. Signed-off-by: H. Peter Anvin Cc: Jeremy Fitzhardinge commit d560bc61575efae43595cbcb56d0ba3b9450139c Author: Jeremy Fitzhardinge Date: Tue Aug 25 12:53:02 2009 -0700 x86, xen: Suppress WP test on Xen Xen always runs on CPUs which properly support WP enforcement in privileged mode, so there's no need to test for it. This also works around a crash reported by Arnd Hannemann, though I think its just a band-aid for that case. Reported-by: Arnd Hannemann Signed-off-by: Jeremy Fitzhardinge Acked-by: Pekka Enberg Signed-off-by: H. Peter Anvin commit 4484b9c8b4976acee181d377f8ba571109d1a2be Author: Alexander Beregalov Date: Tue Aug 25 20:39:37 2009 -0700 irda/sa1100_ir: fix broken netdev_ops conversion This patch is based on commit d2f3ad4 (pxaficp-ir: remove incorrect net_device_ops). Do the same for sa1100_ir. Untested. Signed-off-by: Alexander Beregalov Signed-off-by: David S. Miller commit 730a9cfc2dcead5538c0c96a046000d97140b0c0 Author: Alexander Beregalov Date: Tue Aug 25 20:39:18 2009 -0700 irda/au1k_ir: fix broken netdev_ops conversion This patch is based on commit d2f3ad4 (pxaficp-ir: remove incorrect net_device_ops). Do the same for au1k_ir. Untested. Signed-off-by: Alexander Beregalov Signed-off-by: David S. Miller commit d8ed1d43e17898761c7221014a15a4c7501d2ff3 Author: David S. Miller Date: Tue Aug 25 16:47:46 2009 -0700 sparc64: Validate linear D-TLB misses. When page alloc debugging is not enabled, we essentially accept any virtual address for linear kernel TLB misses. But with kgdb, kernel address probing, and other facilities we can try to access arbitrary crap. So, make sure the address we miss on will translate to physical memory that actually exists. In order to make this work we have to embed the valid address bitmap into the kernel image. And in order to make that less expensive we make an adjustment, in that the max physical memory address is decreased to "1 << 41", even on the chips that support a 42-bit physical address space. We can do this because bit 41 indicates "I/O space" and thus covers non-memory ranges. The result of this is that: 1) kpte_linear_bitmap shrinks from 2K to 1K in size 2) we need 64K more for the valid address bitmap We can't let the valid address bitmap be dynamically allocated once we start using it to validate TLB misses, otherwise we have crazy issues to deal with wrt. recursive TLB misses and such. If we're in a TLB miss it could be the deepest trap level that's legal inside of the cpu. So if we TLB miss referencing the bitmap, the cpu will be out of trap levels and enter RED state. To guard against out-of-range accesses to the bitmap, we have to check to make sure no bits in the physical address above bit 40 are set. We could export and use last_valid_pfn for this check, but that's just an unnecessary extra memory reference. On the plus side of all this, since we load all of these translations into the special 4MB mapping TSB, and we check the TSB first for TLB misses, there should be absolutely no real cost for these new checks in the TLB miss path. Reported-by: heyongli@gmail.com Signed-off-by: David S. Miller commit 9c9376886622b45c32f64c4444f5628dde77dfe6 Merge: 87bcfa33 4464fca Author: Linus Torvalds Date: Tue Aug 25 11:24:37 2009 -0700 Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf_counter: Fix typo in read() output generation perf tools: Check perf.data owner commit 87bcfa33669449e517fda718ed3c2e1899e6541b Merge: 44afa9a ec9c96e Author: Linus Torvalds Date: Tue Aug 25 11:24:24 2009 -0700 Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: dma-debug: Fix check_unmap null pointer dereference commit 44afa9a4b8c5773f47e6494da12ca086c9ffea34 Merge: 7d63e63 f833bab Author: Linus Torvalds Date: Tue Aug 25 11:24:04 2009 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: clockevent: Prevent dead lock on clockevents_lock timers: Drop write permission on /proc/timer_list commit 7d63e6359a2e86cd6335337de99354ab07680c55 Merge: 9f459fa 4a683bf Author: Linus Torvalds Date: Tue Aug 25 11:23:43 2009 -0700 Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: tracing: Fix too large stack usage in do_one_initcall() tracing: handle broken names in ftrace filter ftrace: Unify effect of writing to trace_options and option/* commit 9f459fadbb38abe68aa342f533ca17d8d90d6f2e Merge: e9cab24 c62e432 Author: Linus Torvalds Date: Tue Aug 25 11:23:25 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Fix build with older binutils and consolidate linker script x86: Fix an incorrect argument of reserve_bootmem() x86: add vmlinux.lds to targets in arch/x86/boot/compressed/Makefile xen: rearrange things to fix stackprotector x86: make sure load_percpu_segment has no stackprotector i386: Fix section mismatches for init code with !HOTPLUG_CPU x86, pat: Allow ISA memory range uncacheable mapping requests commit e9cab24cf3e5610898fb26bfd664615d0fd6a8d6 Merge: a206e94 3c4cec6 Author: Linus Torvalds Date: Tue Aug 25 09:47:36 2009 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6: ext3: Improve error message that changing journaling mode on remount is not possible ext3: Update Kconfig description of EXT3_DEFAULTS_TO_ORDERED commit a206e9417f19cf42156249953b72223a0076dc6b Merge: 7cafe60 b1ddaf6 Author: Linus Torvalds Date: Tue Aug 25 09:47:06 2009 -0700 Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: sound: pcm_lib: fix unsorted list constraint handling sound: vx222: fix input level control range check ALSA: ali5451: fix timeout handling in snd_ali_{codecs,timer}_ready() commit 7cafe60550469ad80e990d9223c4b5d501635015 Merge: 5c58cef c5e7f5a Author: Linus Torvalds Date: Tue Aug 25 09:30:58 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: [WATCHDOG] ar7_wdt: fix path to ar7-specific headers commit 5c58ceff103d8a654f24769bb1baaf84a841b0cc Author: Linus Torvalds Date: Tue Aug 25 09:12:43 2009 -0700 tty: make sure to flush any pending work when halting the ldisc When I rewrote tty ldisc code to use proper reference counts (commits 65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, the test-program that Eric Biederman used to trigger the original problem seems to have exposed another long-standing bug: the hangup code did the 'tty_ldisc_halt()' to stop any buffer flushing activity, but unlike the other call sites it never actually flushed any pending work. As a result, if you get just the right timing, the pending work may be just about to execute (ie the timer has already triggered and thus cancel_delayed_work() was a no-op), when we then re-initialize the ldisc from under it. That, in turn, results in various random problems, usually seen as a NULL pointer dereference in run_timer_softirq() or a BUG() in worker_thread (but it can be almost anything). Fix it by adding the required 'flush_scheduled_work()' after doing the tty_ldisc_halt() (this also requires us to move the ldisc halt to before taking the ldisc mutex in order to avoid a deadlock with the workqueue executing do_tty_hangup, which requires the mutex). The locking should be cleaned up one day (the requirement to do this outside the ldisc_mutex is very annoying, and weakens the lock), but that's a larger and separate undertaking. Reported-by: Eric W. Biederman Tested-by: Xiaotian Feng Tested-by: Yanmin Zhang Tested-by: Dave Young Cc: Frederic Weisbecker Cc: Greg Kroah-Hartman Cc: Alan Cox Signed-off-by: Linus Torvalds commit c62e43202e7cf50ca24bce58b255df7bf5de69d0 Author: Jan Beulich Date: Tue Aug 25 14:50:53 2009 +0100 x86: Fix build with older binutils and consolidate linker script binutils prior to 2.17 can't deal with the currently possible situation of a new segment following the per-CPU segment, but that new segment being empty - objcopy misplaces the .bss (and perhaps also the .brk) sections outside of any segment. However, the current ordering of sections really just appears to be the effect of cumulative unrelated changes; re-ordering things allows to easily guarantee that the segment following the per-CPU one is non-empty, and at once eliminates the need for the bogus data.init2 segment. Once touching this code, also use the various data section helper macros from include/asm-generic/vmlinux.lds.h. -v2: fix !SMP builds. Signed-off-by: Jan Beulich Cc: LKML-Reference: <4A94085D02000078000119A5@vpn.id2.novell.com> Signed-off-by: Ingo Molnar commit b1ddaf681e362ed453182ddee1699d7487069a16 Author: Clemens Ladisch Date: Tue Aug 25 08:15:41 2009 +0200 sound: pcm_lib: fix unsorted list constraint handling snd_interval_list() expected a sorted list but did not document this, so there are drivers that give it an unsorted list. To fix this, change the algorithm to work with any list. This fixes the "Slave PCM not usable" error with USB devices that have multiple alternate settings with sample rates in decreasing order, such as the Philips Askey VC010 WebCam. http://bugzilla.kernel.org/show_bug.cgi?id=14028 Reported-and-tested-by: Andrzej Signed-off-by: Clemens Ladisch Cc: Signed-off-by: Takashi Iwai commit a2cb6a4dd470d7a64255a10b843b0d188416b78f Author: David S. Miller Date: Mon Aug 24 19:37:05 2009 -0700 pkt_sched: Fix bogon in tasklet_hrtimer changes. Reported by Stephen Rothwell, luckily it's harmless: net/sched/sch_api.c: In function 'qdisc_watchdog': net/sched/sch_api.c:460: warning: initialization from incompatible pointer type net/sched/sch_cbq.c: In function 'cbq_undelay': net/sched/sch_cbq.c:595: warning: initialization from incompatible pointer type Signed-off-by: David S. Miller commit f8aed700c6ec46ddade6570004ce25332283b306 Author: Ma Ling Date: Mon Aug 24 13:50:24 2009 +0800 drm/i915: Set crtc/clone mask in different output devices Based on Bspec each encoder has different sharing pipe property, i.e. Integrated or SDVO TV both will occupy one pipe exclusively, and sdvo-non-tv and crt are allowed to share one. The patch moves sharing judgment into differnet output functions, and sets the right clone bit. This fixes both HDMI outputs choosing the same pipe. https://bugs.freedesktop.org/show_bug.cgi?id=22247 Signed-off-by: Ma Ling Reviewed-by : Jesse Barnes Signed-off-by: Zhao Yakui Signed-off-by: Eric Anholt commit 27185ae1b795a4ba5e25b95fb5584e950545d774 Author: Ma Ling Date: Mon Aug 24 13:50:23 2009 +0800 drm/i915: Always use SDVO_B detect bit for SDVO output detection. After the following commit is shipped, the SDVO C detection will depend on the SDVO_C/DP detion bit. commit 13520b051e8888dd3af9bda639d83e7df76613d1 Author: Kristian Høgsberg Date: Fri Mar 13 15:42:14 2009 -0400 drm/i915: Read the right SDVO register when detecting SVDO/HDMI. According to the spec we should continue to detect the SDVO_B/C based on the SDVO_B detection bit. The new detection bit on G4X platform is for the HDMI_C detection rather than SDVO_C detection. https://bugs.freedesktop.org/show_bug.cgi?id=20639 Signed-off-by: Ma Ling Acked-by: Zhao Yakui Signed-off-by: Eric Anholt commit 19e1f888c681d9f71ae0a814902d334eac1911dd Author: Roel Kluin Date: Sun Aug 9 13:50:53 2009 +0200 drm/i915: Fix typo that broke SVID1 in intel_sdvo_multifunc_encoder() Bit SDVO_OUTPUT_SVID0 was tested twice Signed-off-by: Roel Kluin Signed-off-by: Eric Anholt commit bc5e5718acd7f7d000d913e619562767863610bf Author: Bruno Prémont Date: Sat Aug 8 13:01:17 2009 +0200 drm/i915: Check if BIOS enabled dual-channel LVDS on 8xx, not only on 9xx Commit 0c2e39525b3b53a97a0202c5f35058147e53977e is not sufficient to get fd.o bug #20115 fixed. In addition intel_find_best_PLL() must not only rely on BIOS settings for i9xx chips but also for i8xx, so drop the IS_I9XX() check. Signed-off-by: Bruno Prémont Signed-off-by: Eric Anholt commit 942642a412454c3365f0abc8399c8ef2944f4eac Author: Sean Young Date: Thu Aug 6 17:35:50 2009 +0800 drm/i915: Set the multiplier for SDVO on G33 platform http://bugs.freedesktop.org/show_bug.cgi?id=21417 Signed-off-by: Sean Young Reviewed-by: Zhao Yakui Acked-by: Zhenyu Wang Signed-off-by: Eric Anholt commit 7111dc73923e9737b38a3ef5b5f236109000ff28 Author: Trond Myklebust Date: Mon Aug 24 19:21:29 2009 -0400 NFSv4: Fix an infinite looping problem with the nfs4_state_manager Commit 76db6d9500caeaa774a3e32a997eba30bbdc176b (nfs41: add session setup to the state manager) introduces an infinite loop possibility in the NFSv4 state manager. By first checking nfs4_has_session() before clearing the NFS4CLNT_SESSION_SETUP flag, it allows for a situation where someone sets that flag, but it never gets cleared, and so the state manager loops. In fact commit c3fad1b1aaf850bf692642642ace7cd0d64af0a3 (nfs41: add session reset to state manager) causes this to happen every time we get a network partition error. Signed-off-by: Trond Myklebust Tested-by: Daniel J Blueman Signed-off-by: Linus Torvalds commit 2584e7986f235572d4b03bbe52fd1e85c1679b8e Merge: 7c0a57d c795b33 Author: Linus Torvalds Date: Mon Aug 24 14:41:28 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: ocfs2/dlm: Wait on lockres instead of erroring cancel requests ocfs2: Add missing lock name ocfs2: Don't oops in ocfs2_kill_sb on a failed mount ocfs2: release the buffer head in ocfs2_do_truncate. ocfs2: Handle quota file corruption more gracefully commit 7c0a57d5c47bcfc492b3139e77400f888a935c44 Merge: 353d5c3 94da210 Author: Linus Torvalds Date: Mon Aug 24 12:53:45 2009 -0700 Merge branch 'fixes' of git://git.marvell.com/orion * 'fixes' of git://git.marvell.com/orion: [ARM] Orion NAND: Make asm volatile avoid GCC pushing ldrd out of the loop [ARM] Kirkwood: enable eSATA on QNAP TS-219P [ARM] Kirkwood: __init requires linux/init.h commit 353d5c30c666580347515da609dd74a2b8e9b828 Author: Hugh Dickins Date: Mon Aug 24 16:30:28 2009 +0100 mm: fix hugetlb bug due to user_shm_unlock call 2.6.30's commit 8a0bdec194c21c8fdef840989d0d7b742bb5d4bc removed user_shm_lock() calls in hugetlb_file_setup() but left the user_shm_unlock call in shm_destroy(). In detail: Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock() is not called in hugetlb_file_setup(). However, user_shm_unlock() is called in any case in shm_destroy() and in the following atomic_dec_and_lock(&up->__count) in free_uid() is executed and if up->__count gets zero, also cleanup_user_struct() is scheduled. Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set. However, the ref counter up->__count gets unexpectedly non-positive and the corresponding structs are freed even though there are live references to them, resulting in a kernel oops after a lots of shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set. Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the time of shm_destroy() may give a different answer from at the time of hugetlb_file_setup(). And fixed newseg()'s no_id error path, which has missed user_shm_unlock() ever since it came in 2.6.9. Reported-by: Stefan Huber Signed-off-by: Hugh Dickins Tested-by: Stefan Huber Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 0257a0c0c1997aac28420e784b3ef8f3ce17f093 Merge: e40c905 9f844e5 Author: Linus Torvalds Date: Mon Aug 24 12:48:41 2009 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: Fix radeon_gem_busy_ioctl harder. commit e40c9056db75e093e6d99d2c14510cb131eb482a Merge: 22e93ed 92c548c Author: Linus Torvalds Date: Mon Aug 24 12:26:48 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6: favr32: improve touchscreen response avr32/lib: fix unaligned memcpy where len < 4 avr32/lib: fix unaligned memcpy() commit 22e93eddd9c63c61e5a38b82eea08f6095189e7f Merge: 1cac6ec 9b2fb2d Author: Linus Torvalds Date: Mon Aug 24 12:25:27 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: ucb1400_ts - enable interrupt unconditionally Input: ucb1400_ts - enable ADC Filter Input: wacom - don't use on-stack memory for report buffers Input: iforce - support new revision of ACT LABS Force RS Input: joydev - decouple axis and button map ioctls from input constants commit 1cac6ec9b7f9c48a26309380656f399a0587b860 Merge: ce0cfd4 8ff499e Author: Linus Torvalds Date: Mon Aug 24 12:25:03 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: smc91x: let smc91x work well under netpoll pxaficp-ir: remove incorrect net_device_ops NET: llc, zero sockaddr_llc struct drivers/net: fixed drivers that support netpoll use ndo_start_xmit() netpoll: warning for ndo_start_xmit returns with interrupts enabled net: Fix Micrel KSZ8842 Kconfig description netfilter: xt_quota: fix wrong return value (error case) ipv6: Fix commit 63d9950b08184e6531adceb65f64b429909cc101 (ipv6: Make v4-mapped bindings consistent with IPv4) E100: fix interaction with swiotlb on X86. pkt_sched: Convert CBQ to tasklet_hrtimer. pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer rtl8187: always set MSR_LINK_ENEDCA flag with RTL8187B ibm_newemac: emac_close() needs to call netif_carrier_off() net: fix ks8851 build errors net: Rename MAC platform driver for w90p910 platform yellowfin: Fix buffer underrun after dev_alloc_skb() failure orinoco: correct key bounds check in orinoco_hw_get_tkip_iv mac80211: fix todo lock commit ce0cfd4ca817dbfd5f8267e7a6a235ed2041bf4a Merge: 637952c 16bfa38 Author: Linus Torvalds Date: Mon Aug 24 12:24:01 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: ima: hashing large files bug fix kernel_read: redefine offset type commit a6a06f7b577f89d0b916c5ccaff67ca5ed444a78 Author: Amerigo Wang Date: Fri Aug 21 04:34:45 2009 -0400 x86: Fix an incorrect argument of reserve_bootmem() This line looks suspicious, because if this is true, then the 'flags' parameter of function reserve_bootmem_generic() will be unused when !CONFIG_NUMA. I don't think this is what we want. Signed-off-by: WANG Cong Cc: Yinghai Lu Cc: akpm@linux-foundation.org LKML-Reference: <20090821083709.5098.52505.sendpatchset@localhost.localdomain> Signed-off-by: Ingo Molnar commit 94da210af4978b94cb70318bd1b282a73c50b175 Author: Simon Kagstrom Date: Thu Aug 20 09:19:53 2009 +0200 [ARM] Orion NAND: Make asm volatile avoid GCC pushing ldrd out of the loop GCC 4.3.3 and 4.4.1 happily moves the dword load instruction out of the loop in orion_nand_read_buf. This patch makes the instruction volatile to avoid the issue. I've discussed this at gcc-help, refer to the thread at http://gcc.gnu.org/ml/gcc-help/2009-08/msg00187.html The early clobber is added to avoid the destination registers and the source register overlapping. Signed-off-by: Simon Kagstrom Signed-off-by: Nicolas Pitre commit c55bf102b675c94edef006ce487d909669221d90 Author: John Holland Date: Wed Aug 19 13:24:03 2009 -1000 [ARM] Kirkwood: enable eSATA on QNAP TS-219P Initialize PCI/PCIe on the QNAP TS-119, TS-219 and TS-219P hardware allowing the use of the discrete eSATA controller connected to the PCIe bus in the TS-219P. Signed-off-by: John Holland Tested-by: Thomas Reitmayr Signed-off-by: Martin Michlmayr Signed-off-by: Nicolas Pitre commit 3e475f579e56caf57cadc0cc995c152f9da641a9 Author: Martin Michlmayr Date: Mon Aug 17 23:34:10 2009 -1000 [ARM] Kirkwood: __init requires linux/init.h Include linux/init.h for __init to fix this error: CC [M] drivers/net/wireless/wl12xx/boot.o In file included from arch/arm/mach-kirkwood/include/mach/gpio.h:13, from arch/arm/include/asm/gpio.h:5, from include/linux/gpio.h:7, from drivers/net/wireless/wl12xx/boot.c:24: arch/arm/plat-orion/include/plat/gpio.h:32: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘orion_gpio_init’ make[6]: *** [drivers/net/wireless/wl12xx/boot.o] Error 1 make[5]: *** [drivers/net/wireless/wl12xx] Error 2 Signed-off-by: Martin Michlmayr Signed-off-by: Nicolas Pitre commit 3c4cec65274481ec6332b0a91f19b4c8c5394801 Author: Jan Kara Date: Mon Aug 24 16:38:43 2009 +0200 ext3: Improve error message that changing journaling mode on remount is not possible This patch makes the error message about changing journaling mode on remount more descriptive. Some people are going to hit this error now due to commit bbae8bcc49bc4d002221dab52c79a50a82e7cd1f if they configure a kernel to default to data=writeback mode. The problem happens if they have data=ordered set for the root filesystem in /etc/fstab but not in the kernel command line (and they don't use initrd). Their filesystem then gets mounted as data=writeback by kernel but then their boot fails because init scripts won't be able to remount the filesystem rw. Better error message will hopefully make it easier for them to find the error in their setup and bother us less with error reports :). Signed-off-by: Jan Kara commit 6d41807614151829ae17a3a58bff8572af5e407e Author: Theodore Ts'o Date: Mon Aug 10 16:03:43 2009 -0400 ext3: Update Kconfig description of EXT3_DEFAULTS_TO_ORDERED The old description for this configuration option was perhaps not completely balanced in terms of describing the tradeoffs of using a default of data=writeback vs. data=ordered. Despite the fact that old description very strongly recomended disabling this feature, all of the major distributions have elected to preserve the existing 'legacy' default, which is a strong hint that it perhaps wasn't telling the whole story. This revised description has been vetted by a number of ext3 developers as being better at informing the user about the tradeoffs of enabling or disabling this configuration feature. Cc: linux-ext4@vger.kernel.org Signed-off-by: "Theodore Ts'o" Signed-off-by: Jan Kara commit edd1365e90eb32625041d09de427d7b03461bc5c Author: Clemens Ladisch Date: Mon Aug 24 09:11:58 2009 +0200 sound: vx222: fix input level control range check Fix a logic error in the range check of the input level control that would prevent setting any volume less than the maximum. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai commit 8ff499e43c537648399fca8ba39d24c0768b3fab Author: Dongdong Deng Date: Sun Aug 23 22:59:04 2009 -0700 smc91x: let smc91x work well under netpoll The NETPOLL requires that interrupts remain disabled in its callbacks. Using *_irq_save()/irq_restore() to replace *_irq_disable()/irq_enable() functions in NETPOLL's callbacks of smc91x, so that it doesn't enable interrupts when already disabled, and kgdboe/netconsole would work properly over smc91x. Signed-off-by: Dongdong Deng Acked-by: Nicolas Pitre Signed-off-by: David S. Miller commit d2f3ad4cedc00c8ee848e7abe9b2bbc93b9a8c2d Author: Marek Vasut Date: Sun Aug 23 22:57:30 2009 -0700 pxaficp-ir: remove incorrect net_device_ops This patch fixes broken pxaficp-ir. The problem was in incorrect net_device_ops being specified which prevented the driver from operating. The symptoms were: - failing ifconfig for IrLAN, resulting in SIOCSIFFLAGS: Cannot assign requested address - irattach working for IrCOMM, but the port stayed disabled Moreover this patch corrects missing sysfs device link. Signed-off-by: Marek Vasut Signed-off-by: David S. Miller commit 28e9fc592cb8c7a43e4d3147b38be6032a0e81bc Author: Jiri Slaby Date: Sun Aug 23 22:55:51 2009 -0700 NET: llc, zero sockaddr_llc struct sllc_arphrd member of sockaddr_llc might not be changed. Zero sllc before copying to the above layer's structure. Signed-off-by: Jiri Slaby Signed-off-by: David S. Miller commit 16bfa38b1936212428cb38fbfbbb8f6c62b8d81f Author: Mimi Zohar Date: Fri Aug 21 14:32:49 2009 -0400 ima: hashing large files bug fix Hashing files larger than INT_MAX causes process to loop. Dependent on redefining kernel_read() offset type to loff_t. (http://bugzilla.kernel.org/show_bug.cgi?id=13909) Cc: stable@kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris commit 6777d773a463ac045d333b989d4e44660f8d92ad Author: Mimi Zohar Date: Fri Aug 21 14:32:48 2009 -0400 kernel_read: redefine offset type vfs_read() offset is defined as loff_t, but kernel_read() offset is only defined as unsigned long. Redefine kernel_read() offset as loff_t. Cc: stable@kernel.org Signed-off-by: Mimi Zohar Signed-off-by: James Morris commit 4871953c0ef2cafeb37bbe186d9d13dcb24fc2c5 Author: Dongdong Deng Date: Sun Aug 23 19:49:07 2009 -0700 drivers/net: fixed drivers that support netpoll use ndo_start_xmit() The NETPOLL API requires that interrupts remain disabled in netpoll_send_skb(). The use of "A functions set" in the NETPOLL API callbacks causes the interrupts to get enabled and can lead to kernel instability. The solution is to use "B functions set" to prevent the irqs from getting enabled while in netpoll_send_skb(). A functions set: local_irq_disable()/local_irq_enable() spin_lock_irq()/spin_unlock_irq() spin_trylock_irq()/spin_unlock_irq() B functions set: local_irq_save()/local_irq_restore() spin_lock_irqsave()/spin_unlock_irqrestore() spin_trylock_irqsave()/spin_unlock_irqrestore() Signed-off-by: Dongdong Deng Acked-by: Matt Mackall Signed-off-by: David S. Miller commit 79b1bee888d43b14cf0c08fb8e5aa6cb161e48f8 Author: Dongdong Deng Date: Fri Aug 21 03:33:36 2009 +0000 netpoll: warning for ndo_start_xmit returns with interrupts enabled WARN_ONCE for ndo_start_xmit() enable interrupts in netpoll_send_skb(), because the NETPOLL API requires that interrupts remain disabled in netpoll_send_skb(). Signed-off-by: Dongdong Deng Acked-by: Matt Mackall Signed-off-by: David S. Miller commit c189308bd8b6a29b11c3ec29a42a3f0aabad6bc8 Author: Andreas Mohr Date: Fri Aug 21 00:46:06 2009 +0000 net: Fix Micrel KSZ8842 Kconfig description Signed-off-by: Andreas Mohr Acked-by: Richard Röjfors Signed-off-by: David S. Miller commit 2149f66f49ab07515666127bf5140c5c94677af8 Author: Patrick McHardy Date: Thu Aug 20 02:47:34 2009 +0000 netfilter: xt_quota: fix wrong return value (error case) Success was indicated on a memory allocation failure, thereby causing a crash due to a later NULL deref. (Affects v2.6.30-rc1 up to here.) Signed-off-by: Jan Engelhardt Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit ca6982b858e1d08010c1d29d8e8255b2ac2ad70a Author: Bruno Prémont Date: Sun Aug 23 19:06:28 2009 -0700 ipv6: Fix commit 63d9950b08184e6531adceb65f64b429909cc101 (ipv6: Make v4-mapped bindings consistent with IPv4) Commit 63d9950b08184e6531adceb65f64b429909cc101 (ipv6: Make v4-mapped bindings consistent with IPv4) changes behavior of inet6_bind() for v4-mapped addresses so it should behave the same way as inet_bind(). During this change setting of err to -EADDRNOTAVAIL got lost: af_inet.c:469 inet_bind() err = -EADDRNOTAVAIL; if (!sysctl_ip_nonlocal_bind && !(inet->freebind || inet->transparent) && addr->sin_addr.s_addr != htonl(INADDR_ANY) && chk_addr_ret != RTN_LOCAL && chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST) goto out; af_inet6.c:463 inet6_bind() if (addr_type == IPV6_ADDR_MAPPED) { int chk_addr_ret; /* Binding to v4-mapped address on a v6-only socket * makes no sense */ if (np->ipv6only) { err = -EINVAL; goto out; } /* Reproduce AF_INET checks to make the bindings consitant */ v4addr = addr->sin6_addr.s6_addr32[3]; chk_addr_ret = inet_addr_type(net, v4addr); if (!sysctl_ip_nonlocal_bind && !(inet->freebind || inet->transparent) && v4addr != htonl(INADDR_ANY) && chk_addr_ret != RTN_LOCAL && chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST) goto out; } else { Signed-off-by Bruno Prémont Signed-off-by: David S. Miller commit 6ff9c2e7fa8ca63a575792534b63c5092099c286 Author: Krzysztof Hałasa Date: Sun Aug 23 19:02:13 2009 -0700 E100: fix interaction with swiotlb on X86. E100 places it's RX packet descriptors inside skb->data and uses them with bidirectional streaming DMA mapping. Data in descriptors is accessed simultaneously by the chip (writing status and size when a packet is received) and CPU (reading to check if the packet was received). This isn't a valid usage of PCI DMA API, which requires use of the coherent (consistent) memory for such purpose. Unfortunately e100 chips working in "simplified" RX mode have to store received data directly after the descriptor. Fixing the driver to conform to the API would require using unsupported "flexible" RX mode or receiving data into a coherent memory and using CPU to copy it to network buffers. This patch, while not yet making the driver conform to the PCI DMA API, allows it to work correctly on X86 with swiotlb (while not breaking other architectures). Signed-off-by: Krzysztof Hałasa Signed-off-by: David S. Miller commit 38acce2d7983632100a9ff3fd20295f6e34074a8 Author: David S. Miller Date: Fri Aug 21 16:51:38 2009 -0700 pkt_sched: Convert CBQ to tasklet_hrtimer. This code expects to run in softirq context, and bare hrtimers run in hw IRQ context. Signed-off-by: David S. Miller Acked-by: Thomas Gleixner commit 70bdbd3d1ae9c4ca3e84a43df34262face26575d Author: Bartlomiej Zolnierkiewicz Date: Sun Aug 23 15:27:25 2009 +0200 ALSA: ali5451: fix timeout handling in snd_ali_{codecs,timer}_ready() Modify loops in such way that the register value is checked also after the timeout condition, just in case the heavy interrupt load etc. caused the thread to sleep for the time period exceeding the timeout value. While at it remove an extra ALI_STIMER read from snd_ali_stimer_ready(). Reported-by: Jack Byer Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Takashi Iwai commit 637952ca689013339b977558061fa4ca8e07e1c1 Author: Hendrik Brueckner Date: Sun Aug 23 18:09:06 2009 +0200 [S390] set preferred console based on conmode setup_arch() unconditionally sets the preferred console to ttyS. This breaks the use of 3270 devices as the console. Provide a new function to set the default preferred console for s390. The preferred console depends on the conmode parameter that is used to switch between 3270 and 3215 terminal/console mode. Signed-off-by: Hendrik Brueckner Signed-off-by: Martin Schwidefsky commit cf05b824dbb871159e1b4c4f2733b9c9d2f756cf Author: Julia Lawall Date: Sun Aug 23 18:09:05 2009 +0200 [S390] drivers/s390: put NULL test before dereference If the NULL test on block is needed, it should be before the dereference of the base field. The semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @r@ expression E1,E2; identifier fld; statement S1,S2; @@ E1 = E2->fld; ( if (E1 == NULL) S1 else S2 | *if (E2 == NULL) S1 else S2 ) // Signed-off-by: Julia Lawall Signed-off-by: Martin Schwidefsky commit 06739a8ad321b1e5140b318c648b0cc4bf8c6daa Author: Sebastian Ott Date: Sun Aug 23 18:09:04 2009 +0200 [S390] cio: fix double free after failed device initialization If io_subchannel_initialize_dev fails it will release the only reference to the ccw device therefore the caller should not kfree this device since this is done in the release function. Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky commit 9f844e5118d1627025c8ea7cfc0ea69038ea63fd Author: Michel Dänzer Date: Sat Aug 22 17:38:23 2009 +0200 drm/radeon/kms: Fix radeon_gem_busy_ioctl harder. It was mixing up TTM placement values and flags. Signed-off-by: Michel Dänzer Signed-off-by: Dave Airlie commit ee5f9757ea17759e1ce5503bdae2b07e48e32af9 Author: David S. Miller Date: Fri Aug 21 16:33:34 2009 -0700 pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer None of this stuff should execute in hw IRQ context, therefore use a tasklet_hrtimer so that it runs in softirq context. Signed-off-by: David S. Miller Acked-by: Thomas Gleixner commit 3edf2fb9d80a46d6c32ba12547a42419845b4b76 Merge: e3054ea c82f63e Author: Linus Torvalds Date: Sat Aug 22 12:14:01 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI: check saved state before restore commit e3054ea7f79db2c694a4f74febead2d4f8de5a98 Merge: 422bef8 388ce4b Author: Linus Torvalds Date: Sat Aug 22 08:30:58 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] mpt2sas: fix config request and diag reset deadlock [SCSI] mpt2sas: Bump driver version 01.100.04.00 [SCSI] mpt2sas: fix oops because drv data points to NULL on resume from hibernate [SCSI] mpt2sas: fix crash due to Watchdog is active while OS in standby mode [SCSI] mpt2sas: fix infinite loop inside config request [SCSI] mpt2sas: Excessive log info causes sas iounit page time out [SCSI] mpt2sas: Raid 10 Value is showing as Raid 1E in /va/log/messages [SCSI] mpt2sas: Expander fix oops saying "Already part of another port" [SCSI] mpt2sas: Introduced check for enclosure_handle to avoid crash commit 422bef879e84104fee6dc68ded0e371dbeb5f88e Author: Linus Torvalds Date: Fri Aug 21 18:00:46 2009 -0700 Linux 2.6.31-rc7 commit 8e9d78edea3ce5c0036f85b93091483f2f15443a Author: Linus Torvalds Date: Fri Aug 21 17:40:08 2009 -0700 Re-introduce page mapping check in mark_buffer_dirty() In commit a8e7d49aa7be728c4ae241a75a2a124cdcabc0c5 ("Fix race in create_empty_buffers() vs __set_page_dirty_buffers()"), I removed a test for a NULL page mapping unintentionally when some of the code inside __set_page_dirty() was moved to the callers. That removal generally didn't matter, since a filesystem would serialize truncation (which clears the page mapping) against writing (which marks the buffer dirty), so locking at a higher level (either per-page or an inode at a time) should mean that the buffer page would be stable. And indeed, nothing bad seemed to happen. Except it turns out that apparently reiserfs does something odd when under load and writing out the journal, and we have a number of bugzilla entries that look similar: http://bugzilla.kernel.org/show_bug.cgi?id=13556 http://bugzilla.kernel.org/show_bug.cgi?id=13756 http://bugzilla.kernel.org/show_bug.cgi?id=13876 and it looks like reiserfs depended on that check (the common theme seems to be "data=journal", and a journal writeback during a truncate). I suspect reiserfs should have some additional locking, but in the meantime this should get us back to the pre-2.6.29 behavior. Pattern-pointed-out-by: Roland Kletzing Cc: stable@kernel.org (2.6.29 and 2.6.30) Cc: Jeff Mahoney Cc: Nick Piggin Cc: Al Viro Signed-off-by: Linus Torvalds commit 649bf17829d087f83754e2a8161e094a167ce3d3 Merge: d3b325f 1a9937b Author: David S. Miller Date: Fri Aug 21 13:13:04 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 4dfd79e7b42bff334128907e28c3b41f1ef1cec8 Merge: b57f921 f779b3e Author: Linus Torvalds Date: Fri Aug 21 10:45:09 2009 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon: add GET_PARAM/INFO support for Z pipes drm/radeon/kms: add r100/r200 OQ support. drm: Fix sysfs device confusion. drm/radeon/kms: implement the bo busy ioctl properly. commit b57f92157e6517f0b3bd22e3a8ce7227e230c4f5 Merge: b04e637 03e860b Author: Linus Torvalds Date: Fri Aug 21 09:56:55 2009 -0700 Merge branch 'btrfs' of git://git.kernel.dk/linux-2.6-block * 'btrfs' of git://git.kernel.dk/linux-2.6-block: btrfs: fix inode rbtree corruption commit b04e6373d694e977c95ae0ae000e2c1e2cf92d73 Author: Linus Torvalds Date: Fri Aug 21 09:48:10 2009 -0700 x86: don't call '->send_IPI_mask()' with an empty mask As noted in 83d349f35e1ae72268c5104dbf9ab2ae635425d4 ("x86: don't send an IPI to the empty set of CPU's"), some APIC's will be very unhappy with an empty destination mask. That commit added a WARN_ON() for that case, and avoided the resulting problem, but didn't fix the underlying reason for why those empty mask cases happened. This fixes that, by checking the result of 'cpumask_andnot()' of the current CPU actually has any other CPU's left in the set of CPU's to be sent a TLB flush, and not calling down to the IPI code if the mask is empty. The reason this started happening at all is that we started passing just the CPU mask pointers around in commit 4595f9620 ("x86: change flush_tlb_others to take a const struct cpumask"), and when we did that, the cpumask was no longer thread-local. Before that commit, flush_tlb_mm() used to create it's own copy of 'mm->cpu_vm_mask' and pass that copy down to the low-level flush routines after having tested that it was not empty. But after changing it to just pass down the CPU mask pointer, the lower level TLB flush routines would now get a pointer to that 'mm->cpu_vm_mask', and that could still change - and become empty - after the test due to other CPU's having flushed their own TLB's. See http://bugzilla.kernel.org/show_bug.cgi?id=13933 for details. Tested-by: Thomas Björnell Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 1a9937b7f07ab6e35515e32a7625f0ba50ab7670 Author: Herton Ronaldo Krzesinski Date: Thu Aug 20 21:16:17 2009 -0300 rtl8187: always set MSR_LINK_ENEDCA flag with RTL8187B RTL8187B always needs MSR_LINK_ENEDCA flag to be set even when it is in no link mode, otherwise it'll not be able to associate when this flag is not set after the change "mac80211: fix managed mode BSSID handling". By accident, setting BSSID of AP before association makes 8187B to successfuly associate even when ENEDCA flag isn't set, which was the case before the mac80211 change. But now the BSSID of AP we are trying to associate is only available after association is successful, and any attempt to associate without the needed flag doesn't work. Signed-off-by: Herton Ronaldo Krzesinski Tested-by: Larry Finger Acked-by: Hin-Tak Leung Signed-off-by: John W. Linville commit f4b0373b26567cafd421d91101852ed7a34e9e94 Author: Linus Torvalds Date: Fri Aug 21 09:26:15 2009 -0700 Make bitmask 'and' operators return a result code When 'and'ing two bitmasks (where 'andnot' is a variation on it), some cases want to know whether the result is the empty set or not. In particular, the TLB IPI sending code wants to do cpumask operations and determine if there are any CPU's left in the final set. So this just makes the bitmask (and cpumask) functions return a boolean for whether the result has any bits set. Cc: stable@kernel.org (2.6.30, needed by TLB shootdown fix) Signed-off-by: Linus Torvalds commit 83d349f35e1ae72268c5104dbf9ab2ae635425d4 Author: Linus Torvalds Date: Fri Aug 21 09:23:57 2009 -0700 x86: don't send an IPI to the empty set of CPU's The default_send_IPI_mask_logical() function uses the "flat" APIC mode to send an IPI to a set of CPU's at once, but if that set happens to be empty, some older local APIC's will apparently be rather unhappy. So just warn if a caller gives us an empty mask, and ignore it. This fixes a regression in 2.6.30.x, due to commit 4595f9620 ("x86: change flush_tlb_others to take a const struct cpumask"), documented here: http://bugzilla.kernel.org/show_bug.cgi?id=13933 which causes a silent lock-up. It only seems to happen on PPro, P2, P3 and Athlon XP cores. Most developers sadly (or not so sadly, if you're a developer..) have more modern CPU's. Also, on x86-64 we don't use the flat APIC mode, so it would never trigger there even if the APIC didn't like sending an empty IPI mask. Reported-by: Pavel Vilim Reported-and-tested-by: Thomas Björnell Reported-and-tested-by: Martin Rogge Cc: Mike Travis Cc: Ingo Molnar Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 4464fcaa9cbfc9c551956b48af203e2f775ca892 Author: Peter Zijlstra Date: Fri Aug 21 17:19:36 2009 +0200 perf_counter: Fix typo in read() output generation When you iterate a list, using the iterator is useful. Before: ID: 5 ID: 5 ID: 5 ID: 5 EVNT: 0x40088b scale: nan ID: 5 CNT: 1006252 ID: 6 CNT: 1011090 ID: 7 CNT: 1011196 ID: 8 CNT: 1011095 EVNT: 0x40088c scale: 1.000000 ID: 5 CNT: 2003065 ID: 6 CNT: 2011671 ID: 7 CNT: 2012620 ID: 8 CNT: 2013479 EVNT: 0x40088c scale: 1.000000 ID: 5 CNT: 3002390 ID: 6 CNT: 3015996 ID: 7 CNT: 3018019 ID: 8 CNT: 3020006 EVNT: 0x40088b scale: 1.000000 ID: 5 CNT: 4002406 ID: 6 CNT: 4021120 ID: 7 CNT: 4024241 ID: 8 CNT: 4027059 After: ID: 1 ID: 2 ID: 3 ID: 4 EVNT: 0x400889 scale: nan ID: 1 CNT: 1005270 ID: 2 CNT: 1009833 ID: 3 CNT: 1010065 ID: 4 CNT: 1010088 EVNT: 0x400898 scale: nan ID: 1 CNT: 2001531 ID: 2 CNT: 2022309 ID: 3 CNT: 2022470 ID: 4 CNT: 2022627 EVNT: 0x400888 scale: 0.489467 ID: 1 CNT: 3001261 ID: 2 CNT: 3027088 ID: 3 CNT: 3027941 ID: 4 CNT: 3028762 Reported-by: stephane eranian Signed-off-by: Peter Zijlstra Cc: Paul Mackerras Cc: Corey J Ashford Cc: perfmon2-devel LKML-Reference: <1250867976.7538.73.camel@twins> Signed-off-by: Ingo Molnar commit 4a683bf94b8a10e2bb0da07aec3ac0a55e5de61f Author: Ingo Molnar Date: Fri Aug 21 12:53:36 2009 +0200 tracing: Fix too large stack usage in do_one_initcall() One of my testboxes triggered this nasty stack overflow crash during SCSI probing: [ 5.874004] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 5.875004] device: 'sda': device_add [ 5.878004] BUG: unable to handle kernel NULL pointer dereference at 00000a0c [ 5.878004] IP: [] print_context_stack+0x81/0x110 [ 5.878004] *pde = 00000000 [ 5.878004] Thread overran stack, or stack corrupted [ 5.878004] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 5.878004] last sysfs file: [ 5.878004] [ 5.878004] Pid: 1, comm: swapper Not tainted (2.6.31-rc6-tip-01272-g9919e28-dirty #5685) [ 5.878004] EIP: 0060:[] EFLAGS: 00010083 CPU: 0 [ 5.878004] EIP is at print_context_stack+0x81/0x110 [ 5.878004] EAX: cf8a3000 EBX: cf8a3fe4 ECX: 00000049 EDX: 00000000 [ 5.878004] ESI: b1cfce84 EDI: 00000000 EBP: cf8a3018 ESP: cf8a2ff4 [ 5.878004] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 5.878004] Process swapper (pid: 1, ti=cf8a2000 task=cf8a8000 task.ti=cf8a3000) [ 5.878004] Stack: [ 5.878004] b1004867 fffff000 cf8a3ffc [ 5.878004] Call Trace: [ 5.878004] [] ? kernel_thread_helper+0x7/0x10 [ 5.878004] BUG: unable to handle kernel NULL pointer dereference at 00000a0c [ 5.878004] IP: [] print_context_stack+0x81/0x110 [ 5.878004] *pde = 00000000 [ 5.878004] Thread overran stack, or stack corrupted [ 5.878004] Oops: 0000 [#2] PREEMPT SMP DEBUG_PAGEALLOC The oops did not reveal any more details about the real stack that we have and the system got into an infinite loop of recursive pagefaults. So i booted with CONFIG_STACK_TRACER=y and the 'stacktrace' boot parameter. The box did not crash (timings/conditions probably changed a tiny bit to trigger the catastrophic crash), but the /debug/tracing/stack_trace file was rather revealing: Depth Size Location (72 entries) ----- ---- -------- 0) 3704 52 __change_page_attr+0xb8/0x290 1) 3652 24 __change_page_attr_set_clr+0x43/0x90 2) 3628 60 kernel_map_pages+0x108/0x120 3) 3568 40 prep_new_page+0x7d/0x130 4) 3528 84 get_page_from_freelist+0x106/0x420 5) 3444 116 __alloc_pages_nodemask+0xd7/0x550 6) 3328 36 allocate_slab+0xb1/0x100 7) 3292 36 new_slab+0x1c/0x160 8) 3256 36 __slab_alloc+0x133/0x2b0 9) 3220 4 kmem_cache_alloc+0x1bb/0x1d0 10) 3216 108 create_object+0x28/0x250 11) 3108 40 kmemleak_alloc+0x81/0xc0 12) 3068 24 kmem_cache_alloc+0x162/0x1d0 13) 3044 52 scsi_pool_alloc_command+0x29/0x70 14) 2992 20 scsi_host_alloc_command+0x22/0x70 15) 2972 24 __scsi_get_command+0x1b/0x90 16) 2948 28 scsi_get_command+0x35/0x90 17) 2920 24 scsi_setup_blk_pc_cmnd+0xd4/0x100 18) 2896 128 sd_prep_fn+0x332/0xa70 19) 2768 36 blk_peek_request+0xe7/0x1d0 20) 2732 56 scsi_request_fn+0x54/0x520 21) 2676 12 __generic_unplug_device+0x2b/0x40 22) 2664 24 blk_execute_rq_nowait+0x59/0x80 23) 2640 172 blk_execute_rq+0x6b/0xb0 24) 2468 32 scsi_execute+0xe0/0x140 25) 2436 64 scsi_execute_req+0x152/0x160 26) 2372 60 scsi_vpd_inquiry+0x6c/0x90 27) 2312 44 scsi_get_vpd_page+0x112/0x160 28) 2268 52 sd_revalidate_disk+0x1df/0x320 29) 2216 92 rescan_partitions+0x98/0x330 30) 2124 52 __blkdev_get+0x309/0x350 31) 2072 8 blkdev_get+0xf/0x20 32) 2064 44 register_disk+0xff/0x120 33) 2020 36 add_disk+0x6e/0xb0 34) 1984 44 sd_probe_async+0xfb/0x1d0 35) 1940 44 __async_schedule+0xf4/0x1b0 36) 1896 8 async_schedule+0x12/0x20 37) 1888 60 sd_probe+0x305/0x360 38) 1828 44 really_probe+0x63/0x170 39) 1784 36 driver_probe_device+0x5d/0x60 40) 1748 16 __device_attach+0x49/0x50 41) 1732 32 bus_for_each_drv+0x5b/0x80 42) 1700 24 device_attach+0x6b/0x70 43) 1676 16 bus_attach_device+0x47/0x60 44) 1660 76 device_add+0x33d/0x400 45) 1584 52 scsi_sysfs_add_sdev+0x6a/0x2c0 46) 1532 108 scsi_add_lun+0x44b/0x460 47) 1424 116 scsi_probe_and_add_lun+0x182/0x4e0 48) 1308 36 __scsi_add_device+0xd9/0xe0 49) 1272 44 ata_scsi_scan_host+0x10b/0x190 50) 1228 24 async_port_probe+0x96/0xd0 51) 1204 44 __async_schedule+0xf4/0x1b0 52) 1160 8 async_schedule+0x12/0x20 53) 1152 48 ata_host_register+0x171/0x1d0 54) 1104 60 ata_pci_sff_activate_host+0xf3/0x230 55) 1044 44 ata_pci_sff_init_one+0xea/0x100 56) 1000 48 amd_init_one+0xb2/0x190 57) 952 8 local_pci_probe+0x13/0x20 58) 944 32 pci_device_probe+0x68/0x90 59) 912 44 really_probe+0x63/0x170 60) 868 36 driver_probe_device+0x5d/0x60 61) 832 20 __driver_attach+0x89/0xa0 62) 812 32 bus_for_each_dev+0x5b/0x80 63) 780 12 driver_attach+0x1e/0x20 64) 768 72 bus_add_driver+0x14b/0x2d0 65) 696 36 driver_register+0x6e/0x150 66) 660 20 __pci_register_driver+0x53/0xc0 67) 640 8 amd_init+0x14/0x16 68) 632 572 do_one_initcall+0x2b/0x1d0 69) 60 12 do_basic_setup+0x56/0x6a 70) 48 20 kernel_init+0x84/0xce 71) 28 28 kernel_thread_helper+0x7/0x10 There's a lot of fat functions on that stack trace, but the largest of all is do_one_initcall(). This is due to the boot trace entry variables being on the stack. Fixing this is relatively easy, initcalls are fundamentally serialized, so we can move the local variables to file scope. Note that this large stack footprint was present for a couple of months already - what pushed my system over the edge was the addition of kmemleak to the call-chain: 6) 3328 36 allocate_slab+0xb1/0x100 7) 3292 36 new_slab+0x1c/0x160 8) 3256 36 __slab_alloc+0x133/0x2b0 9) 3220 4 kmem_cache_alloc+0x1bb/0x1d0 10) 3216 108 create_object+0x28/0x250 11) 3108 40 kmemleak_alloc+0x81/0xc0 12) 3068 24 kmem_cache_alloc+0x162/0x1d0 13) 3044 52 scsi_pool_alloc_command+0x29/0x70 This pushes the total to ~3800 bytes, only a tiny bit more was needed to corrupt the on-kernel-stack thread_info. The fix reduces the stack footprint from 572 bytes to 28 bytes. Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Frederic Weisbecker Cc: Steven Rostedt Cc: Catalin Marinas Cc: Jens Axboe Cc: Linus Torvalds Cc: LKML-Reference: Signed-off-by: Ingo Molnar commit f779b3e513478218cbaaaa0a506d7801cab6fd14 Author: Alex Deucher Date: Wed Aug 19 19:11:39 2009 -0400 drm/radeon: add GET_PARAM/INFO support for Z pipes Needed for occlusion queries on rv530 chips. Signed-off-by: Alex Deucher Signed-off-by: Dave Airlie commit 03e860bd9f6a3cca747b0795bed26279a8b420a0 Author: From: Nick Piggin Date: Fri Aug 21 10:09:44 2009 +0200 btrfs: fix inode rbtree corruption Node may not be inserted over existing node. This causes inode tree corruption and I was seeing crashes in inode_tree_del which I can not reproduce after this patch. The other way to fix this would be to tie inode lifetime in the rbtree with inode while not in freeing state. I had a look at this but it is not so trivial at this point. At least this patch gets things working again. Signed-off-by: Nick Piggin Cc: Chris Mason Acked-by: Yan Zheng Signed-off-by: Jens Axboe commit ec9c96ef3cc0124cb94375b17faaa8cff5dfdf97 Author: Kyle McMartin Date: Wed Aug 19 21:17:08 2009 -0400 dma-debug: Fix check_unmap null pointer dereference While it's debatable whether or not a NULL device argument to the DMA API functions is valid... since it certainly isn't valid on devices with an IOMMU... dma-debug really shouldn't be dereferencing null pointers either. Guard against that in err_printk and the driver_filter functions. A Fedora rawhide user was seeing this in one of the dvb drivers resulting in an oops on boot. [ A patch has been sent for testing to the driver, but I feel the dma debugging support should be fixed as well. (There's still a pile of legacy garbage in the kernel passing null pointers to dma_{alloc,free}_*. :( ] Signed-off-by: Kyle McMartin Cc: mchehab@infradead.org Cc: Joerg Roedel LKML-Reference: <20090820011708.GP25206@bombadil.infradead.org> Signed-off-by: Ingo Molnar commit 9b2fb2da4edfb163842800abbeb4c14bc1759469 Author: Pavel Revak Date: Thu Aug 20 22:30:54 2009 -0700 Input: ucb1400_ts - enable interrupt unconditionally Sometimes, when using the touchscreen, it stops working till next restart and the following message is printed: ucb1400: unexpected IE_STATUS = 0x0 The following patch retriggers the touchscreen interrupt unconditionally. This prevents hanging of the touchscreen in case of bogus interrupt occurence. Signed-off-by: Pavel Revak Acked-by: Marek Vasut Signed-off-by: Dmitry Torokhov commit 1700f5fde88f9a251037bc86bde538ee32c59905 Author: Marek Vasut Date: Thu Aug 20 22:05:53 2009 -0700 Input: ucb1400_ts - enable ADC Filter This patch enables ADC filtering on UCB1400 codec by default. The benefit from this change is mostly on some Colibri boards where the ADCSYNC pin of the UCB1400 codec isn't connected causing the touchscreen to jitter very badly. This change has no visible effect on boards where the ADCSYNC pin is connected. Signed-off-by: Marek Vasut Tested-by: Palo Revak Signed-off-by: Dmitry Torokhov commit 3b7307c2d66dd575ef24b88898b4bc4bddb254f4 Author: Dmitry Torokhov Date: Thu Aug 20 21:41:04 2009 -0700 Input: wacom - don't use on-stack memory for report buffers Tested-by: Martin Capitanio Signed-off-by: Dmitry Torokhov commit c795b33ba171e41563ab7e25105c0cd4edd81cd7 Author: Goldwyn Rodrigues Date: Thu Aug 20 13:43:19 2009 -0500 ocfs2/dlm: Wait on lockres instead of erroring cancel requests In case a downconvert is queued, and a flock receives a signal, BUG_ON(lockres->l_action != OCFS2_AST_INVALID) is triggered because a lock cancel triggers a dlmunlock while an AST is scheduled. To avoid this, allow a LKM_CANCEL to pass through, and let it wait on __dlm_wait_on_lockres(). Signed-off-by: Goldwyn Rodrigues Acked-off-by: Mark Fasheh Signed-off-by: Joel Becker commit 17782d99502851dc7e48114ee9c5a6d6741cba18 Author: Dave Airlie Date: Fri Aug 21 10:07:54 2009 +1000 drm/radeon/kms: add r100/r200 OQ support. This adds the relocation necessary for OQ support on the r100/r200 chipsets. Signed-off-by: Dave Airlie commit 08e4d534743f4e9af3602aebbc1cca9372762028 Author: Thomas Hellstrom Date: Thu Aug 20 19:02:31 2009 +1000 drm: Fix sysfs device confusion. The drm sysfs class suspend / resume methods could not distinguish between different device types wich could lead to illegal type casts. Use struct device_type and make sure the class suspend / resume callbacks are aware of those. There is no per device-type suspend / resume. Only new-style PM. Signed-off-by: Thomas Hellstrom Reviewed-by: Jesse Barnes Signed-off-by: Dave Airlie commit e3b2415e281a97ade36d88404094a90cfea838c0 Author: Dave Airlie Date: Fri Aug 21 09:47:45 2009 +1000 drm/radeon/kms: implement the bo busy ioctl properly. The previous patch assumes the ioctl already existed, when it actually didn't. It also didn't return the correct error code. Signed-off-by: Dave Airlie commit a8b88d3d49623ac701b5dc996cbd61219c793c7c Author: Jan Kara Date: Thu Aug 20 18:26:52 2009 +0200 ocfs2: Add missing lock name There is missing name for NFSSync cluster lock. This makes lockdep unhappy because we end up passing NULL to lockdep when initializing lock key. Fix it. Signed-off-by: Jan Kara Signed-off-by: Joel Becker commit fc0ce23506d943b9eaa731a051769d0e0605eb03 Author: Jan Beulich Date: Thu Aug 20 16:14:15 2009 +0100 x86: add vmlinux.lds to targets in arch/x86/boot/compressed/Makefile The absence of vmlinux.lds here keeps .vmlinux.lds.cmd from being included, which in turn leads to it and all its dependents always getting rebuilt independent of whether they are already up-to-date. Signed-off-by: Jan Beulich LKML-Reference: <4A8D84670200007800010D31@vpn.id2.novell.com> Signed-off-by: H. Peter Anvin commit 429966b8f644dda2afddb4f834a944e9b46a7645 Merge: a1d1251 c37faaf Author: Linus Torvalds Date: Thu Aug 20 14:55:24 2009 -0700 Merge branch 'i2c-fixes-rc6' of git://aeryn.fluff.org.uk/bjdooks/linux * 'i2c-fixes-rc6' of git://aeryn.fluff.org.uk/bjdooks/linux: i2c-stu300: I2C STU300 stability updates i2c-omap: Enable workaround for Errata 1.153 based on i2c-omap: ACK pending [R/X]DR and [R/X]RDY interrupts i2c-omap: Fix I2C status ACK commit c37faafa7d46622b749437f7d294201a63af4beb Author: Linus Walleij Date: Thu Aug 13 22:14:23 2009 +0200 i2c-stu300: I2C STU300 stability updates - blk clk is enabled when an irq arrives. The clk should be enabled, but just to make sure. - All error bits are handled no matter state machine state - All irq's will run complete() except for irq's that wasn't an event. - No more looking into status registers just in case an interrupt has happend and the irq handle wasn't executed. - irq_disable/enable are now separete functions. - clk settings calculation changed to round upwards instead of downwards. - Number of address send attempts before giving up is increased to 12 from 10 since it most times take 8 tries before getting through. Signed-off-by: Linus Walleij Signed-off-by: Ben Dooks commit 61149787d65b4a2f9c638d363dc65e13cb063e29 Author: Moiz Sonasath Date: Thu Aug 20 11:21:16 2009 -0500 i2c-omap: Enable workaround for Errata 1.153 based on Silicon Errata 1.153 has been fixed on OMAP 3630|4430 with the use of a later version of I2C IP block. The errata impacts OMAP 2420|2430|3430, enable the workaround for these based on I2C IP block revision number instead of OMAP CPU type Signed-off-by: Moiz Sonasath Signed-off-by: Vikram Pandita Signed-off-by: Ben Dooks commit dd11976aea15bde53ce40b076dd5fa462c74f41a Author: Moiz Sonasath Date: Thu Aug 20 11:21:15 2009 -0500 i2c-omap: ACK pending [R/X]DR and [R/X]RDY interrupts ACK any pending read/write interrupts before exiting the ISR either after completing the operation [ARDY interrupt] or in case of an error [NACK|AL interrupt] Signed-off-by: Moiz Sonasath Signed-off-by: Vikram Pandita Signed-off-by: Ben Dooks commit dcc4ec26942d3bae2c5a82ab8346ab53b540a171 Author: Nishanth Menon Date: Thu Aug 20 11:21:14 2009 -0500 i2c-omap: Fix I2C status ACK I2C status ack for [RX]RDR and [RX]RDY could cause race conditions of clearing the event twice and a violation of the programing sequence as defined in TRM This patch fixes the same. Signed-off-by: Nishanth Menon Signed-off-by: Moiz Sonasath Signed-off-by: Ben Dooks commit a1d12511157c8d22a5a6779f8a9d73a1adcfc3b0 Merge: 6c30c53 3abf2f3 Author: Linus Torvalds Date: Thu Aug 20 10:19:39 2009 -0700 Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Fix probe of Toshiba laptops with ALC268 codec ALSA: hda: add model for Intel DG45ID/DG45FC boards ALSA: hda: enable speaker output for Compaq 6530s/6531s commit c82f63e411f1b58427c103bd95af2863b1c96dd1 Author: Alek Du Date: Sat Aug 8 08:46:19 2009 +0800 PCI: check saved state before restore Without the check, the config space may be filled with zeros. Though the driver should try to avoid call restoring before saving, but the pci layer also should check this. Also removes the existing check in pci_restore_standard_config, since it's superfluous with the new check in restore_state. Acked-by: Rafael J. Wysocki Signed-off-by: Alek Du Signed-off-by: Jesse Barnes commit cbcb340cb6a6f9f32724c90493f509dd41105e20 Merge: 78b89ec ce2eef3 Author: Ingo Molnar Date: Thu Aug 20 12:05:24 2009 +0200 Merge branch 'bugfix' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen into x86/urgent commit d3b325f9c25be6d504bc73afce7f92d0e25001d7 Author: Petri Gynther Date: Thu Aug 20 02:21:27 2009 -0700 ibm_newemac: emac_close() needs to call netif_carrier_off() When ibm_newemac netdev instance is shutdown with "ifconfig down", the netdev interface does not go properly down. netif_carrier_ok() keeps returning TRUE even after "ifconfig down". The problem can be seen when ibm_newemac instances are slaves of a bonding interface. The bonding interface code uses netif_carrier_ok() to determine the link status of its slaves. When ibm_newemac slave is shutdown with "ifconfig down", the bonding interface won't detect any link status change because netif_carrier_ok() keeps returning TRUE. Signed-off-by: Petri Gynther Signed-off-by: David S. Miller commit 68947b8f9a36f7f7f54ca95e0c6e169bb603e803 Author: Jiri Kosina Date: Wed Aug 19 22:07:44 2009 -0700 Input: iforce - support new revision of ACT LABS Force RS Reported-by: cemede@gmail.com Signed-off-by: Jiri Kosina Signed-off-by: Dmitry Torokhov commit ce2eef33d35cd7b932492b5a81fb0febd2b323cd Author: Jeremy Fitzhardinge Date: Mon Aug 17 12:26:53 2009 -0700 xen: rearrange things to fix stackprotector Make sure the stack-protector segment registers are properly set up before calling any functions which may have stack-protection compiled into them. [ Impact: prevent Xen early-boot crash when stack-protector is enabled ] Signed-off-by: Jeremy Fitzhardinge commit 5416c2663517ebd0be0664c4d4ce3df0b116c059 Author: Jeremy Fitzhardinge Date: Mon Aug 17 12:25:41 2009 -0700 x86: make sure load_percpu_segment has no stackprotector load_percpu_segment() is used to set up the per-cpu segment registers, which are also used for -fstack-protector. Make sure that the load_percpu_segment() function doesn't have stackprotector enabled. [ Impact: allow percpu setup before calling stack-protected functions ] Signed-off-by: Jeremy Fitzhardinge commit cbb35f8a2858f7e0fff5df598cb286c4bcae5976 Author: Randy Dunlap Date: Wed Aug 19 12:13:31 2009 -0700 net: fix ks8851 build errors Fix build errors due to missing Kconfig select of CRC32: ks8851.c:(.text+0x7d2ee): undefined reference to `crc32_le' ks8851.c:(.text+0x7d2f5): undefined reference to `bitrev32' Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 3abf2f3639959e4f53f209f93cd4d93fe9356de1 Author: Takashi Iwai Date: Wed Aug 19 20:05:02 2009 +0200 ALSA: hda - Fix probe of Toshiba laptops with ALC268 codec There are many variants of Toshiba laptops with ALC268 codec, and it seems that a few of them don't work with model=toshiba preset since they have the secondary ALC268 codec just for HDMI output. This is a regression due to the previous clean-up work to merge all Toshiba quirk entries into a single check. This patch adds the identification of such laptops to apply the standard BIOS-probing method. Unfortunately, Toshiba laptops have all the same PCI SSID, so we need to check the codec SSID to identify each device. Tested-by: Alexey Dobriyan Signed-off-by: Takashi Iwai commit 6c30c53fd5ae6a99a23ad78e90c428d2c8ffb07f Merge: 0dc9aa8 a924586 Author: Linus Torvalds Date: Wed Aug 19 10:40:24 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2: nilfs2: fix oopses with doubly mounted snapshots nilfs2: missing a read lock for segment writer in nilfs_attach_checkpoint() commit 0dc9aa845c20ed1f46c85f229591b811dffc4b3b Author: Anton Blanchard Date: Wed Aug 19 16:10:16 2009 +0100 AFS: Documentation updates Fix some issues with the AFS documentation, found when testing AFS on ppc64: - Update AFS features: reading/writing, local caching - Typo in kafs sysfs debug file - Use modprobe instead of insmod in example - Update IPs for grand.central.org Signed-off-by: Anton Blanchard Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit cad2c8fd9b3afceced08838c87c520e6da417a65 Merge: 4aa2d56 5ef5f72 Author: Linus Torvalds Date: Wed Aug 19 10:38:36 2009 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/kms: teardown crtc correctly when fb is destroyed. drm/kms/radeon: cleanup combios TV table like DDX. drm/radeon/kms: memset the allocated framebuffer before using it. drm/radeon/kms: although LVDS might be possible on crtc 1 don't do it. drm/radeon/kms: implement bo busy check + current domain drm/radeon/kms: cut down indirects in register accesses. drm/radeon/kms: Fix up vertical blank interrupt support. drm/radeon/kms: add rv530 R300_SU_REG_DEST + reloc for ZPASS_ADDR drm/edid: fixup detailed timings like the X server. drm/radeon/kms: Add specific rs690 authorized register table commit 4aa2d56b2149e70a0b944b4f21e4aed33d9ab94e Merge: d46c7d9 1fef789 Author: Linus Torvalds Date: Wed Aug 19 09:44:51 2009 -0700 Merge branch 'next' of git://git.monstr.eu/linux-2.6-microblaze * 'next' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: Update Microblaze defconfigs microblaze: Use klimit instead of _end for memory init microblaze: Enable ppoll syscall microblaze: Sane handling of missing timer/intc in device tree microblaze: use the generic ack_bad_irq implementation commit d46c7d9ab8289f23a5e161060b84fd7e63de7921 Merge: c124891 b395cd8 Author: Linus Torvalds Date: Wed Aug 19 09:43:19 2009 -0700 Merge branch 'perfcounters-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perfcounters-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf tools: Make 'make html' work perf annotate: Fix segmentation fault perf_counter: Fix the PARISC build perf_counter: Check task on counter read IPI perf: Rename perf-examples.txt to examples.txt perf record: Fix typo in pid_synthesize_comm_event commit f833bab87fca5c3ce13778421b1365845843b976 Author: Suresh Siddha Date: Mon Aug 17 14:34:59 2009 -0700 clockevent: Prevent dead lock on clockevents_lock Currently clockevents_notify() is called with interrupts enabled at some places and interrupts disabled at some other places. This results in a deadlock in this scenario. cpu A holds clockevents_lock in clockevents_notify() with irqs enabled cpu B waits for clockevents_lock in clockevents_notify() with irqs disabled cpu C doing set_mtrr() which will try to rendezvous of all the cpus. This will result in C and A come to the rendezvous point and waiting for B. B is stuck forever waiting for the spinlock and thus not reaching the rendezvous point. Fix the clockevents code so that clockevents_lock is taken with interrupts disabled and thus avoid the above deadlock. Also call lapic_timer_propagate_broadcast() on the destination cpu so that we avoid calling smp_call_function() in the clockevents notifier chain. This issue left us wondering if we need to change the MTRR rendezvous logic to use stop machine logic (instead of smp_call_function) or add a check in spinlock debug code to see if there are other spinlocks which gets taken under both interrupts enabled/disabled conditions. Signed-off-by: Suresh Siddha Signed-off-by: Venkatesh Pallipadi Cc: "Pallipadi Venkatesh" Cc: "Brown Len" LKML-Reference: <1250544899.2709.210.camel@sbs-t61.sc.intel.com> Signed-off-by: Thomas Gleixner commit fa6963b2481beff8b11f76006fbb63fdbbf2d2d7 Author: Peter Zijlstra Date: Wed Aug 19 11:18:26 2009 +0200 perf tools: Check perf.data owner Add an owner check to opening perf.data files and a switch to silence it. Because perf-report/perf-annotate are binary parsers reading another users' perf.data file could be a security risk if the file were explicitly engineered to trigger bugs in the parser (we hope of course there are non such bugs, but you never know). Signed-off-by: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Paul Mackerras LKML-Reference: <20090819092023.896648538@chello.nl> Signed-off-by: Ingo Molnar commit ae709440edb2d36f51f5ea51cfab931f45c03e02 Author: Wu Fengguang Date: Wed Aug 19 17:05:11 2009 +0800 ALSA: hda: add model for Intel DG45ID/DG45FC boards The BIOS pin configs are in fact correct and shall not be overwritten. Signed-off-by: Wu Fengguang Signed-off-by: Takashi Iwai commit 150fe14c1a1f08cb430d8382bf5554c2a168b79b Author: Wu Fengguang Date: Wed Aug 19 16:58:59 2009 +0800 ALSA: hda: enable speaker output for Compaq 6530s/6531s HP Compaq 6530s and 6531s internal speaker is silence or becomes silence within 1 minute after fresh boot. It is found that pin 0x1c must be set to PIN_OUT mode to make the speaker work. This is weird - line-in pin 0x1c and speaker pin 0x16 seem to be unrelated. The codec differences before/after patch are: @@ Node 0x17 [Pin Complex] wcaps 0x40020b: Pin Default 0x41a6e130: [N/A] Mic at Ext Rear Conn = Digital, Color = White DefAssociation = 0x3, Sequence = 0x0 Misc = NO_PRESENCE - Pin-ctls: 0x24: IN + Pin-ctls: 0x40: OUT @@ Node 0x1c [Pin Complex] wcaps 0x40018d: Pin Default 0x41813021: [N/A] Line In at Ext Rear Conn = 1/8, Color = Blue DefAssociation = 0x2, Sequence = 0x1 - Pin-ctls: 0x24: IN VREF_80 + Pin-ctls: 0x40: OUT VREF_HIZ Unsolicited: tag=00, enabled=0 Connection: 1 0x24 Tests show that it won't impact (external) Mic recording. Reported-by: "Lin, Ming M" Signed-off-by: Wu Fengguang Signed-off-by: Takashi Iwai commit 1ca3976d8ca8b0b44145994b1433f759a642615b Author: David S. Miller Date: Tue Aug 18 23:56:21 2009 -0700 sparc64: Update defconfig. Signed-off-by: David S. Miller commit 2193aa276e2579d9c781c5269521d43f47da9959 Author: David S. Miller Date: Tue Aug 18 23:46:12 2009 -0700 sparc32: Update defconfig. Signed-off-by: David S. Miller commit a9919646d12a13bea7eb74b996686f900dffb120 Author: David S. Miller Date: Tue Aug 18 23:44:08 2009 -0700 sparc32: Kill trap table freeing code. Normally, srmmu uses different trap table register values to allow determination of the cpu we're on. All of the trap tables have identical content, they just sit at different offsets from the first trap table, and the offset shifted down and masked out determines the cpu we are on. The code tries to free them up when they aren't actually used (don't have all 4 cpus, we're on sun4d, etc.) but that causes problems. For one thing it triggers false positives in the DMA debugging code. And fixing that up while preserving this relative offset thing isn't trivial. So just kill the freeing code, it costs us at most 3 pages, big deal... Signed-off-by: David S. Miller commit 456d8991a795ff5e44dbc1c2a7f8d5b4ed675866 Author: Wan ZongShun Date: Tue Aug 18 23:34:58 2009 -0700 net: Rename MAC platform driver for w90p910 platform Due to I modified the corresponding platform device name, so I make the patch to rename MAC platform driver for w90p910 platform. Signed-off-by: Wan ZongShun Signed-off-by: David S. Miller commit 5ef5f72febfea420ce58f670bad83830a5e5e3de Author: Dave Airlie Date: Mon Aug 17 13:11:23 2009 +1000 drm/kms: teardown crtc correctly when fb is destroyed. If userspace destroys a framebuffer that is in use on a crtc, don't just null it out, tear down the crtc properly so the hw gets turned off. Signed-off-by: Dave Airlie commit 6a719e05330ef19acd9392dbbfb95a774776dee5 Author: Dave Airlie Date: Mon Aug 17 10:19:51 2009 +1000 drm/kms/radeon: cleanup combios TV table like DDX. The fallback case wasn't getting executed properly if there was no TV table, which my T42 M7 hasn't got. Signed-off-by: Dave Airlie commit bf8e828b00a5b6a0fea16f452be578c060d57d64 Author: Dave Airlie Date: Mon Aug 17 10:20:47 2009 +1000 drm/radeon/kms: memset the allocated framebuffer before using it. This gets rid of some ugliness, we shuold probably find a way for the GPU to zero this. Signed-off-by: Dave Airlie commit 80e6914db18e702549a15dea36fa7ace17f25c50 Author: Dave Airlie Date: Mon Aug 17 10:22:37 2009 +1000 drm/radeon/kms: although LVDS might be possible on crtc 1 don't do it. LVDS always requests RMX_FULL, we need to fix it so that doesn't happen before we can enable LVDS on crtc 1. Signed-off-by: Dave Airlie commit e7a5965a81a29a13cd4994fa23a6a7a1488bcdb6 Author: Roel Kluin Date: Tue Aug 18 20:21:40 2009 -0700 yellowfin: Fix buffer underrun after dev_alloc_skb() failure yellowfin_init_ring() needs to clean up if dev_alloc_skb() fails and should pass an error status up to the caller. This also prevents an buffer underrun if failure occurred in the first iteration. yellowfin_open() which calls yellowfin_init_ring() should free its requested irq upon failure. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit e2c6cbd9ace61039d3de39e717195e38f1492aee Author: Mathieu Desnoyers Date: Tue Aug 18 20:16:55 2009 -0700 sparc: sys32.S incorrect compat-layer splice() system call I think arch/sparc/kernel/sys32.S has an incorrect splice definition: SIGN2(sys32_splice, sys_splice, %o0, %o1) The splice() prototype looks like : long splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, size_t len, unsigned int flags); So I think we should have : SIGN2(sys32_splice, sys_splice, %o0, %o2) Signed-off-by: Mathieu Desnoyers Signed-off-by: David S. Miller commit c124891f50f11e33acdfa276864ea089bab726b6 Merge: 77f312a 024e6cb Author: Linus Torvalds Date: Tue Aug 18 19:41:47 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: security: Fix prompt for LSM_MMAP_MIN_ADDR security: Make LSM_MMAP_MIN_ADDR default match its help text. commit 77f312a96dd1e01c49ccd872265e70a8346b53cc Merge: dc8ed71 142d44b Author: Linus Torvalds Date: Tue Aug 18 19:41:05 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu: percpu: use the right flag for get_vm_area() percpu, sparc64: fix sparse possible cpu map handling init: set nr_cpu_ids before setup_per_cpu_areas() commit eda1e328556565e211b7450250e40d6de751563a Author: Jiri Olsa Date: Tue Aug 11 17:29:04 2009 +0200 tracing: handle broken names in ftrace filter If one filter item (for set_ftrace_filter and set_ftrace_notrace) is being setup by more than 1 consecutive writes (FTRACE_ITER_CONT flag), it won't be handled corretly. I used following program to test/verify: [snip] #include #include #include #include #include int main(int argc, char **argv) { int fd, i; char *file = argv[1]; if (-1 == (fd = open(file, O_WRONLY))) { perror("open failed"); return -1; } for(i = 0; i < (argc - 2); i++) { int len = strlen(argv[2+i]); int cnt, off = 0; while(len) { cnt = write(fd, argv[2+i] + off, len); len -= cnt; off += cnt; } } close(fd); return 0; } [snip] before change: sh-4.0# echo > ./set_ftrace_filter sh-4.0# /test ./set_ftrace_filter "sys" "_open " sh-4.0# cat ./set_ftrace_filter #### all functions enabled #### sh-4.0# after change: sh-4.0# echo > ./set_ftrace_notrace sh-4.0# test ./set_ftrace_notrace "sys" "_open " sh-4.0# cat ./set_ftrace_notrace sys_open sh-4.0# Signed-off-by: Jiri Olsa LKML-Reference: <20090811152904.GA26065@jolsa.lab.eng.brq.redhat.com> Signed-off-by: Steven Rostedt commit dc8ed71eeb8adce08d3070f4130e12ee540baa59 Merge: 7f9cfb3 e412cd2 Author: Linus Torvalds Date: Tue Aug 18 16:55:43 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86, mce: Don't initialize MCEs on unknown CPUs x86, mce: don't log boot MCEs on Pentium M (model == 13) CPUs x86: Annotate section mismatch warnings in kernel/apic/x2apic_uv_x.c x86, mce: therm_throt: Don't log redundant normality x86: Fix UV BAU destination subnode id commit 7f9cfb31030737a7fc9a1cbca3fd01bec184c849 Author: Bo Liu Date: Tue Aug 18 14:11:19 2009 -0700 mm: build_zonelists(): move clear node_load[] to __build_all_zonelists() If node_load[] is cleared everytime build_zonelists() is called,node_load[] will have no help to find the next node that should appear in the given node's fallback list. Because of the bug, zonelist's node_order is not calculated as expected. This bug affects on big machine, which has asynmetric node distance. [synmetric NUMA's node distance] 0 1 2 0 10 12 12 1 12 10 12 2 12 12 10 [asynmetric NUMA's node distance] 0 1 2 0 10 12 20 1 12 10 14 2 20 14 10 This (my bug) is very old but no one has reported this for a long time. Maybe because the number of asynmetric NUMA is very small and they use cpuset for customizing node memory allocation fallback. [akpm@linux-foundation.org: fix CONFIG_NUMA=n build] Signed-off-by: Bo Liu Reviewed-by: KAMEZAWA Hiroyuki Cc: Mel Gorman Cc: Christoph Lameter Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 503f7944fac68f4fdf71f8ebd06907f51eb64515 Author: Joe Perches Date: Tue Aug 18 14:11:18 2009 -0700 REPORTING-BUGS: add get_maintainer.pl blurb Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 28d7a6ae92c099d81cbea08c20be0d2cf7ccd7ca Author: Graff Yang Date: Tue Aug 18 14:11:17 2009 -0700 nommu: check fd read permission in validate_mmap_request() According to the POSIX (1003.1-2008), the file descriptor shall have been opened with read permission, regardless of the protection options specified to mmap(). The ltp test cases mmap06/07 need this. Signed-off-by: Graff Yang Acked-by: Paul Mundt Signed-off-by: David Howells Acked-by: Greg Ungerer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 191529756633052680dd9d23ad63744ca5aa02a1 Author: Ben Dooks Date: Tue Aug 18 14:11:17 2009 -0700 spi_s3c24xx: fix transfer setup code Since the changes to the bitbang driver, there is the possibility we will be called with either the speed_hz or bpw values zero. We take these to mean that the default values (8 bits per word, or maximum bus speed). Signed-off-by: Ben Dooks Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b8978784544e8b4e8fbacb558df8580957d4f8a5 Author: Ben Dooks Date: Tue Aug 18 14:11:16 2009 -0700 spi_s3c24xx: fix clock rate calculation Currently the clock rate calculation may round as pleased, which means that it is possible that we will round down and end up with a faster clock rate than intended. Change the calculation to use DIV_ROUND_UP() to ensure that we end up with a clock rate either the same as or lower than the user requested one. Signed-off-by: Ben Dooks Cc: David Brownell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b2503a9408e44eb0531adc3436c513ea70f91c42 Author: Andrew Morton Date: Tue Aug 18 14:11:12 2009 -0700 mmc: add the new linux-mmc mailing list to MAINTAINERS There are a number of individual MMC drivers listed in MAINTAINERS. I didn't modify those records. Perhaps I should have. Cc: Cc: Manuel Lauss Cc: Nicolas Pitre Cc: Pierre Ossman Cc: Pavel Pisa Cc: Jarkko Lavinen Cc: Ben Dooks Cc: Sascha Sommer Cc: Ian Molton Cc: Joseph Chan Cc: Harald Welte Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0753ba01e126020bf0f8150934903b48935b697d Author: KOSAKI Motohiro Date: Tue Aug 18 14:11:10 2009 -0700 mm: revert "oom: move oom_adj value" The commit 2ff05b2b (oom: move oom_adj value) moveed the oom_adj value to the mm_struct. It was a very good first step for sanitize OOM. However Paul Menage reported the commit makes regression to his job scheduler. Current OOM logic can kill OOM_DISABLED process. Why? His program has the code of similar to the following. ... set_oom_adj(OOM_DISABLE); /* The job scheduler never killed by oom */ ... if (vfork() == 0) { set_oom_adj(0); /* Invoked child can be killed */ execve("foo-bar-cmd"); } .... vfork() parent and child are shared the same mm_struct. then above set_oom_adj(0) doesn't only change oom_adj for vfork() child, it's also change oom_adj for vfork() parent. Then, vfork() parent (job scheduler) lost OOM immune and it was killed. Actually, fork-setting-exec idiom is very frequently used in userland program. We must not break this assumption. Then, this patch revert commit 2ff05b2b and related commit. Reverted commit list --------------------- - commit 2ff05b2b4e (oom: move oom_adj value from task_struct to mm_struct) - commit 4d8b9135c3 (oom: avoid unnecessary mm locking and scanning for OOM_DISABLE) - commit 8123681022 (oom: only oom kill exiting tasks with attached memory) - commit 933b787b57 (mm: copy over oom_adj value at fork time) Signed-off-by: KOSAKI Motohiro Cc: Paul Menage Cc: David Rientjes Cc: KAMEZAWA Hiroyuki Cc: Rik van Riel Cc: Linus Torvalds Cc: Oleg Nesterov Cc: Nick Piggin Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 89a4eb4b66e8f4d395e14a14d262dac4d6ca52f0 Author: Jeff Layton Date: Tue Aug 18 14:11:08 2009 -0700 vfs: make get_sb_pseudo set s_maxbytes to value that can be cast to signed get_sb_pseudo sets s_maxbytes to ~0ULL which becomes negative when cast to a signed value. Fix it to use MAX_LFS_FILESIZE which casts properly to a positive signed value. Signed-off-by: Jeff Layton Reviewed-by: Johannes Weiner Acked-by: Steve French Reviewed-by: Christoph Hellwig Cc: Al Viro Cc: Robert Love Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6b6f0b6c131321e1bc34c47b7f671b0360315402 Author: Joe Perches Date: Tue Aug 18 14:11:06 2009 -0700 MAINTAINERS: OSD LIBRARY and FILESYSTEM pattern fix Signed-off-by: Joe Perches Acked-by: Benny Halevy Cc: Boaz Harrosh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 08fdef99342955a62884fb5c49ab43431a1cafbf Merge: c1a8f1f 518ff04 Author: David S. Miller Date: Tue Aug 18 16:29:16 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 024e6cb408307de41cbfcb1e5a170d9af60ab2a9 Author: Andreas Schwab Date: Tue Aug 18 22:14:29 2009 +0200 security: Fix prompt for LSM_MMAP_MIN_ADDR Fix prompt for LSM_MMAP_MIN_ADDR. (Verbs are cool!) Signed-off-by: Andreas Schwab Acked-by: Eric Paris Signed-off-by: James Morris commit a58578e47f004017cf47803ad372490806630e58 Author: Dave Jones Date: Tue Aug 18 13:47:37 2009 -0400 security: Make LSM_MMAP_MIN_ADDR default match its help text. Commit 788084aba2ab7348257597496befcbccabdc98a3 added the LSM_MMAP_MIN_ADDR option, whose help text states "For most ia64, ppc64 and x86 users with lots of address space a value of 65536 is reasonable and should cause no problems." Which implies that it's default setting was typoed. Signed-off-by: Dave Jones Acked-by: Eric Paris Signed-off-by: James Morris commit dcd94dbdaff452b95d4ba11fdbf853b5bda8e6e7 Merge: 8486a0f 69ab849 Author: Linus Torvalds Date: Tue Aug 18 13:57:38 2009 -0700 Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: genirq: Wake up irq thread after action has been installed commit 8486a0f95c844b27ecc855cfec89b7e34f831cad Merge: b9d030a c1a8f1f Author: Linus Torvalds Date: Tue Aug 18 13:55:01 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (60 commits) net: restore gnet_stats_basic to previous definition NETROM: Fix use of static buffer e1000e: fix use of pci_enable_pcie_error_reporting e1000e: WoL does not work on 82577/82578 with manageability enabled cnic: Fix locking in init/exit calls. cnic: Fix locking in start/stop calls. bnx2: Use mutex on slow path cnic calls. cnic: Refine registration with bnx2. cnic: Fix symbol_put_addr() panic on ia64. gre: Fix MTU calculation for bound GRE tunnels pegasus: Add new device ID. drivers/net: fixed drivers that support netpoll use ndo_start_xmit() via-velocity: Fix test of mii_status bit VELOCITY_DUPLEX_FULL rt2x00: fix memory corruption in rf cache, add a sanity check ixgbe: Fix receive on real device when VLANs are configured ixgbe: Do not return 0 in ixgbe_fcoe_ddp() upon FCP_RSP in DDP completion netxen: free napi resources during detach netxen: remove netxen workqueue ixgbe: fix issues setting rx-usecs with legacy interrupts can: fix oops caused by wrong rtnl newlink usage ... commit b9d030a123b6b7fbf262c995455197ea5184b497 Merge: 435a71d 237674e Author: Linus Torvalds Date: Tue Aug 18 13:54:26 2009 -0700 Merge branch 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: sh7724 ddr self-refresh changes sh: use in-soc KEYSC on se7724 sh: CMT suspend/resume sh: skip disabled LCDC channels commit 435a71d9ef68b03343949c814986e01dae849763 Merge: df4ecf1 80ffb3c Author: Linus Torvalds Date: Tue Aug 18 13:54:08 2009 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: Fix new incorrect error return from do_md_stop. commit a924586036833086b262a371b09d1266c23bb4d1 Author: Ryusuke Konishi Date: Wed Aug 19 00:29:43 2009 +0900 nilfs2: fix oopses with doubly mounted snapshots will fix kernel oopses like the following: # mount -t nilfs2 -r -o cp=20 /dev/sdb1 /test1 # mount -t nilfs2 -r -o cp=20 /dev/sdb1 /test2 # umount /test1 # umount /test2 BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1069 in_atomic(): 0, irqs_disabled(): 1, pid: 3886, name: umount.nilfs2 1 lock held by umount.nilfs2/3886: #0: (&type->s_umount_key#31){+.+...}, at: [] deactivate_super+0x52/0x6c irq event stamp: 1219 hardirqs last enabled at (1219): [] __mutex_unlock_slowpath+0xf8/0x119 hardirqs last disabled at (1218): [] __mutex_unlock_slowpath+0x59/0x119 softirqs last enabled at (1214): [] __do_softirq+0x1a5/0x1ad softirqs last disabled at (1205): [] do_softirq+0x36/0x5a Pid: 3886, comm: umount.nilfs2 Not tainted 2.6.31-rc6 #55 Call Trace: [] __might_sleep+0x107/0x10e [] do_page_fault+0x246/0x397 [] ? do_page_fault+0x0/0x397 [] error_code+0x6b/0x70 [] ? do_page_fault+0x0/0x397 [] ? __lock_acquire+0x91/0x12fd [] ? __lock_acquire+0x12ee/0x12fd [] ? __lock_acquire+0x12ee/0x12fd [] lock_acquire+0xba/0xdd [] ? nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2] [] down_write+0x2a/0x46 [] ? nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2] [] nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2] [] ? mark_held_locks+0x43/0x5b [] ? trace_hardirqs_on_caller+0x10b/0x133 [] ? trace_hardirqs_on+0xb/0xd [] nilfs_put_super+0x2f/0xca [nilfs2] [] generic_shutdown_super+0x49/0xb8 [] kill_block_super+0x1d/0x31 [] ? vfs_quota_off+0x0/0x12 [] deactivate_super+0x57/0x6c [] mntput_no_expire+0x8c/0xb4 [] sys_umount+0x27f/0x2a4 [] sys_oldumount+0xd/0xf [] sysenter_do_call+0x12/0x38 ... This turns out to be a bug brought by an -rc1 patch ("nilfs2: simplify remaining sget() use"). In the patch, a new "put resource" function, nilfs_put_sbinfo() was introduced to delay freeing nilfs_sb_info struct. But the nilfs_put_sbinfo() mistakenly used atomic_dec_and_test() function to check the reference count, and it caused the nilfs_sb_info was freed when user mounted a snapshot twice. This bug also suggests there was unseen memory leak in usual mount /umount operations for nilfs. Signed-off-by: Ryusuke Konishi commit b395cd8a74b4a8d943dd4b5585e676f62f7350b3 Author: Kyle McMartin Date: Tue Aug 18 12:41:25 2009 -0400 perf tools: Make 'make html' work pushd tools/perf/Documentation make html popd is failing for me... ASCIIDOC perf-annotate.html ERROR: unsafe: include file: /etc/asciidoc/./stylesheets/xhtml11.css ERROR: unsafe: include file: /etc/asciidoc/./stylesheets/xhtml11-manpage.css ERROR: unsafe: include file: /etc/asciidoc/./stylesheets/xhtml11-quirks.css make: *** [perf-annotate.html] Error 1 Apparently asciidoc "unsafe" is the default mode of operation in practice. https://bugzilla.redhat.com/show_bug.cgi?id=506953 Works tidily now. Signed-off-by: Kyle McMartin Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: <20090818164125.GM25206@bombadil.infradead.org> Signed-off-by: Ingo Molnar commit 78b89ecd731798f2fec8cc26ca90739253cec33c Author: Jan Beulich Date: Tue Aug 18 16:41:33 2009 +0100 i386: Fix section mismatches for init code with !HOTPLUG_CPU Commit 0e83815be719d3391bf5ea24b7fe696c07dbd417 changed the section the initial_code variable gets allocated in, in an attempt to address a section conflict warning. This, however created a new section conflict when building without HOTPLUG_CPU. The apparently only (reasonable) way to address this is to always use __REFDATA. Once at it, also fix a second section mismatch when not using HOTPLUG_CPU. Signed-off-by: Jan Beulich Cc: Robert Richter LKML-Reference: <4A8AE7CD020000780001054B@vpn.id2.novell.com> Signed-off-by: Ingo Molnar commit 69ab849439b506cd8dd2879527fdb64d95dd5211 Author: Thomas Gleixner Date: Mon Aug 17 14:07:16 2009 +0200 genirq: Wake up irq thread after action has been installed The wake_up_process() of the new irq thread in __setup_irq() is too early as the irqaction is not yet fully initialized especially action->irq is not yet set. The interrupt thread might dereference the wrong irq descriptor. Move the wakeup after the action is installed and action->irq has been set. Reported-by: Michael Buesch Signed-off-by: Thomas Gleixner Tested-by: Michael Buesch commit 15f3fa4e7f608c5ce19187b3b4a953222fdfa751 Author: Ingo Molnar Date: Tue Aug 18 13:52:28 2009 +0200 perf annotate: Fix segmentation fault Linus reported this perf annotate segfault: [torvalds@nehalem git]$ perf annotate unmap_vmas Segmentation fault #0 map__clone (self=) at builtin-annotate.c:236 #1 thread__fork (self=) at builtin-annotate.c:372 The bug here was that builtin-annotate.c was a copy of builtin-report.c and a threading related fix to builtin-report.c didnt get propagated to builtin-annotate.c ... Reported-by: Linus Torvalds Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit f738eb1b63edf664da1b4ac76895d988749b2f07 Author: Ingo Molnar Date: Tue Aug 18 11:32:24 2009 +0200 perf_counter: Fix the PARISC build PARISC does not build: /home/mingo/tip/kernel/perf_counter.c: In function 'perf_counter_index': /home/mingo/tip/kernel/perf_counter.c:2016: error: 'PERF_COUNTER_INDEX_OFFSET' undeclared (first use in this function) /home/mingo/tip/kernel/perf_counter.c:2016: error: (Each undeclared identifier is reported only once /home/mingo/tip/kernel/perf_counter.c:2016: error: for each function it appears in.) As PERF_COUNTER_INDEX_OFFSET is not defined. Now, we could define it in the architecture - but lets also provide a core default of 0 (which happens to be what all but one architecture uses at the moment). Architectures that need a different index offset should set this value in their asm/perf_counter.h files. Cc: Kyle McMartin Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit 1fef7891755d99039592aa8d1ed02e981f38de15 Author: Michal Simek Date: Tue Aug 18 11:05:11 2009 +0200 microblaze: Update Microblaze defconfigs Signed-off-by: Michal Simek commit 8f37b6c9852ff79cc8472c44ea6f6485dfd58bd2 Author: Michal Simek Date: Tue Aug 11 12:36:12 2009 +0200 microblaze: Use klimit instead of _end for memory init For noMMU system when you use larger rootfs image there is problem with using _end label because we increase klimit but in memory initialization we use still _end which is wrong. Larger mtd rootfs was rewritten by init_bootmem_node. MMU kernel use static initialization where klimit is setup to _end. There is no any other hanling with klimit. Signed-off-by: Michal Simek commit 2856ed35ead295a7cc8788d9ba860e746dfc92bb Author: Michal Simek Date: Thu Aug 6 16:00:52 2009 +0200 microblaze: Enable ppoll syscall Signed-off-by: Michal Simek commit 892ee92b81b6e7fa5f6147c96e11c6c1b9802fc6 Author: John Williams Date: Wed Jul 29 22:08:40 2009 +1000 microblaze: Sane handling of missing timer/intc in device tree This code path doesn't test any returned pointers for NULL, leading to a bad kernel page fault if there's no timer/intc found. Slightly better is to BUG(), but even better still would be a printk beforehand. Signed-off-by: John Williams Signed-off-by: Michal Simek commit 6b99ecec25c8fd501e74306f5d23dd0365065e2a Author: Christoph Hellwig Date: Thu Aug 6 23:00:38 2009 +0200 microblaze: use the generic ack_bad_irq implementation Signed-off-by: Christoph Hellwig Signed-off-by: Michal Simek commit 1154ecbd2f8298ef75609f5f8ed5aca96be599fb Author: Zhang Qiang Date: Tue Aug 18 14:58:24 2009 +0800 nilfs2: missing a read lock for segment writer in nilfs_attach_checkpoint() 'ns_cno' of structure 'the_nilfs' must be protected from segment writer, in other words, the caller of nilfs_get_checkpoint should hold read lock for nilfs->ns_segctor_sem. This patch adds the lock/unlock operations in nilfs_attach_checkpoint() when calling nilfs_cpfile_get_checkpoint(). Signed-off-by: Zhang Qiang Signed-off-by: Ryusuke Konishi commit c1a8f1f1c8e01eab5862c8db39b49ace814e6c66 Author: Eric Dumazet Date: Sun Aug 16 09:36:49 2009 +0000 net: restore gnet_stats_basic to previous definition In 5e140dfc1fe87eae27846f193086724806b33c7d "net: reorder struct Qdisc for better SMP performance" the definition of struct gnet_stats_basic changed incompatibly, as copies of this struct are shipped to userland via netlink. Restoring old behavior is not welcome, for performance reason. Fix is to use a private structure for kernel, and teach gnet_stats_copy_basic() to convert from kernel to user land, using legacy structure (struct gnet_stats_basic) Based on a report and initial patch from Michael Spang. Reported-by: Michael Spang Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c6ba973b8fa97422aab4204f7d79f1d413cde925 Author: Ralf Baechle Date: Mon Aug 17 18:05:32 2009 -0700 NETROM: Fix use of static buffer The static variable used by nr_call_to_digi might result in corruption if multiple threads are trying to usee a node or neighbour via ioctl. Fixed by having the caller pass a structure in. This is safe because nr_add_node rsp. nr_add_neigh will allocate a permanent structure, if needed. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 80ffb3cceaefa405f2ecd46d66500ed8d53efe74 Author: NeilBrown Date: Tue Aug 18 10:35:26 2009 +1000 Fix new incorrect error return from do_md_stop. Recent commit c8c00a6915a2e3d10416e8bdd3138429beb96210 changed the exit paths in do_md_stop and was not quite careful enough. There is one path were 'err' now needs to be cleared but it isn't. So setting an array to readonly (with mdadm --readonly) will work, but will incorrectly report and error: ENXIO. Signed-off-by: NeilBrown commit f2d84b65b9778e8a35dd904f7d3993f0a60c9756 Author: Zhaolei Date: Fri Aug 7 18:55:48 2009 +0800 ftrace: Unify effect of writing to trace_options and option/* "echo noglobal-clock > trace_options" can be used to change trace clock but "echo 0 > options/global-clock" can't. The flag toggling will be silently accepted without actually changing the clock callback. We can fix it by using set_tracer_flags() in trace_options_core_write(). Changelog: v1->v2: Simplified switch() after Li Zefan 's suggestion Signed-off-by: Zhao Lei Cc: Steven Rostedt Cc: Li Zefan Signed-off-by: Frederic Weisbecker commit 7815f4be4026b6c5027058102ae67a4b9feffa5f Author: Eric Van Hensbergen Date: Mon Aug 17 16:49:44 2009 -0500 9p: update documentation pointers Signed-off-by: Eric Van Hensbergen commit 4b53e4b500779230aedd5355940aeaaed0b5353b Author: Abhishek Kulkarni Date: Mon Aug 17 16:42:28 2009 -0500 9p: remove unnecessary v9fses->options which duplicates the mount string The mount options string is saved in sb->s_options. This patch removes the redundant duplicating of the mount options. Also, since we are not displaying anything special in show options, we replace v9fs_show_options with generic_show_options for now. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 0aad37ef3deed118d3816e1d1a600eb2ec9dcb87 Author: Abhishek Kulkarni Date: Mon Aug 17 16:38:45 2009 -0500 net/9p: insulate the client against an invalid error code sent by a 9p server A looney tunes server sending an invalid error code (which is !IS_ERR_VALUE) can result in a client oops. So fix it by adding a check and converting unknown or invalid error codes to -ESERVERFAULT. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 48559b4c30708ebdc849483da9fb83ee08c6c908 Author: Abhishek Kulkarni Date: Mon Aug 17 16:32:18 2009 -0500 9p: Add missing cast for the error return value in v9fs_get_inode Cast the error return value (ENOMEM) in v9fs_get_inode() to its correct type using ERR_PTR. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 5fd131893793567c361ae64cbeb28a2a753bbe35 Author: Jan Kara Date: Thu Jul 30 17:01:53 2009 +0200 ocfs2: Don't oops in ocfs2_kill_sb on a failed mount If we fail to mount the filesystem, we have to be careful not to dereference uninitialized structures in ocfs2_kill_sb. Signed-off-by: Jan Kara Signed-off-by: Joel Becker commit 4d3297ca5bf37ff5956f76fb352e009880aad62d Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:51 2009 -0600 9p: Remove redundant inode uid/gid assignment Remove a redundant update of inode's i_uid and i_gid after v9fs_get_inode() since the latter already sets up a new inode and sets the proper uid and gid values. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 1b5ab3e86712b6be38ebbe0d821387c1d8f91d7c Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:52 2009 -0600 9p: Fix possible regressions when ->get_sb fails. ->get_sb can fail causing some badness. this patch fixes * clear sb->fs_s_info in kill_sb. * deactivate_locked_super() calls kill_sb (v9fs_kill_super) which closes the destroys the client, clunks all its fids and closes the v9fs session. Attempting to do it twice will cause an oops. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 4f4038328da5eb9cc237b51d3fe68138fd3fea14 Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:53 2009 -0600 9p: Fix v9fs show_options Add the delimiter ',' before the options when they are passed and check if no option parameters are passed to prevent displaying NULL in /proc/mounts. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 02bc35672b2fdf251e264adca5407792f63191e4 Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:54 2009 -0600 9p: Fix possible memleak in v9fs_inode_from fid. Add missing p9stat_free in v9fs_inode_from_fid to avoid any possible leaks. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 0e15597ebfe00e28857185f46aba00f400480ffe Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:55 2009 -0600 9p: minor comment fixes Fix the comments -- mostly the improper and/or missing descriptions of function parameters. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 2bb541157fe2602af7b9952096d0524f6f9c1e73 Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:56 2009 -0600 9p: Fix possible inode leak in v9fs_get_inode. Add a missing iput when cleaning up if v9fs_get_inode fails after returning a valid inode. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 50fb6d2bd7062708892ae7147f30c3ee905b7a3d Author: Abhishek Kulkarni Date: Sun Jul 19 13:41:57 2009 -0600 9p: Check for error in return value of v9fs_fid_add Check if v9fs_fid_add was successful or not based on its return value. Signed-off-by: Abhishek Kulkarni Signed-off-by: Eric Van Hensbergen commit 1adcaafe7414c5731f758b158aa0525057225deb Author: Suresh Siddha Date: Mon Aug 17 13:23:50 2009 -0700 x86, pat: Allow ISA memory range uncacheable mapping requests Max Vozeler reported: > Bug 13877 - bogl-term broken with CONFIG_X86_PAT=y, works with =n > > strace of bogl-term: > 814 mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0) > = -1 EAGAIN (Resource temporarily unavailable) > 814 write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n", > 57) = 57 PAT code maps the ISA memory range as WB in the PAT attribute, so that fixed range MTRR registers define the actual memory type (UC/WC/WT etc). But the upper level is_new_memtype_allowed() API checks are failing, as the request here is for UC and the return tracked type is WB (Tracked type is WB as MTRR type for this legacy range potentially will be different for each 4k page). Fix is_new_memtype_allowed() by always succeeding the ISA address range checks, as the null PAT (WB) and def MTRR fixed range register settings satisfy the memory type needs of the applications that map the ISA address range. Reported-and-Tested-by: Max Vozeler Signed-off-by: Suresh Siddha Signed-off-by: Venkatesh Pallipadi Signed-off-by: H. Peter Anvin commit df4ecf1524c7793de3121b2d4e5fc6bcc0da3bfb Merge: c58afec 87c62a6 Author: Linus Torvalds Date: Mon Aug 17 13:39:52 2009 -0700 Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: MIPS: Fix HPAGE_SIZE redefinition commit c58afec8b2576b121eced7b94eb94eaf4626bacc Merge: 52dec22 bc990f5 Author: Linus Torvalds Date: Mon Aug 17 13:39:30 2009 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix locking in xfs_iget_cache_hit commit 52dec22e739eec8f3a0154f768a599f5489048bd Merge: 08e53fc 1d99597 Author: Linus Torvalds Date: Mon Aug 17 13:38:58 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: security: define round_hint_to_min in !CONFIG_SECURITY Security/SELinux: seperate lsm specific mmap_min_addr SELinux: call cap_file_mmap in selinux_file_mmap Capabilities: move cap_file_mmap to commoncap.c commit 08e53fcb0db34baca3db84a457b6d67faabee4c6 Author: Eric Paris Date: Sun Aug 16 21:51:55 2009 -0400 inotify: start watch descriptor count at 1 The inotify_add_watch man page specifies that inotify_add_watch() will return a non-negative integer. However, historically the inotify watches started at 1, not at 0. Turns out that the inotifywait program provided by the inotify-tools package doesn't properly handle a 0 watch descriptor. In 7e790dd5 we changed from starting at 1 to starting at 0. This patch starts at 1, just like in previous kernels, but also just like in previous kernels it's possible for it to wrap back to 0. This preserves the kernel functionality exactly like it was before the patch (neither method broke the spec) Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds commit cd94c8bbef8d4b796a7ed4c551355a334604fd36 Author: Eric Paris Date: Sun Aug 16 21:51:49 2009 -0400 inotify: tail drop inotify q_overflow events In f44aebcc the tail drop logic of events with no file backing (q_overflow and in_ignored) was reversed so IN_IGNORED events would never be tail dropped. This now means that Q_OVERFLOW events are NOT tail dropped. The fix is to not tail drop IN_IGNORED, but to tail drop Q_OVERFLOW. Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds commit eef3a116be11d35396efb2a8cc7345fd3221e294 Author: Eric Paris Date: Sun Aug 16 21:51:44 2009 -0400 notify: unused event private race inotify decides if private data it passed to get added to an event was used by checking list_empty(). But it's possible that the event may have been dequeued and the private event removed so it would look empty. The fix is to use the return code from fsnotify_add_notify_event rather than looking at the list. Signed-off-by: Eric Paris Signed-off-by: Linus Torvalds commit 0f66f96d21b4bbff49baaa337546e687d7c58e87 Merge: 894ef82 a2bb9f4 Author: Linus Torvalds Date: Mon Aug 17 13:36:39 2009 -0700 Merge master.kernel.org:/home/rmk/linux-2.6-arm * master.kernel.org:/home/rmk/linux-2.6-arm: (37 commits) ARM: 5673/1: U300 fix initsection compile warning ARM: Fix broken highmem support mx31moboard: invert sdhc ro signal sense ARM: S3C24XX: Fix clkout mpx error ARM: S3C64XX: serial: Fix a typo in Kconfig IXP4xx: Fix IO_SPACE_LIMIT for 2.6.31-rc core PCI changes OMAP3: RX51: Updated rx51_defconfig OMAP2/3: mmc-twl4030: Free up MMC regulators while cleaning up OMAP3: RX51: Define TWL4030 USB transceiver in board file OMAP3: Overo: Fix smsc911x platform device resource value OMAP3: Fix omap3 sram virtual addres overlap vmalloc space after increasing vmalloc size OMAP2/3: DMA errata correction OMAP: Fix testing of cpu defines for mach-omap1 OMAP3: Overo: add missing pen-down GPIO definition OMAP: GPIO: clear/restore level/edge detect settings on mask/unmask OMAP3: PM: Fix wrong sequence in suspend. OMAP: PM: CPUfreq: obey min/max settings of policy OMAP2/3/4: UART: allow in-order port traversal OMAP2/3/4: UART: Allow per-UART disabling wakeup for serial ports OMAP3: Fixed crash bug with serial + suspend ... commit 60e2ec48665b8495360ca4a6004c5cd52beb2bc1 Author: Tao Ma Date: Wed Aug 12 14:42:47 2009 +0800 ocfs2: release the buffer head in ocfs2_do_truncate. In ocfs2_do_truncate, we forget to release last_eb_bh which will cause memleak. So call brelse in the end. Signed-off-by: Tao Ma Signed-off-by: Joel Becker commit ada508274b8698a33cb0e5bd037db0f9dc781795 Author: Jan Kara Date: Mon Aug 3 18:24:21 2009 +0200 ocfs2: Handle quota file corruption more gracefully ocfs2_read_virt_blocks() does BUG when we try to read a block from a file beyond its end. Since this can happen due to filesystem corruption, it is not really an appropriate answer. Make ocfs2_read_quota_block() check the condition and handle it by calling ocfs2_error() and returning EIO. [ Modified to print ip_blkno in the error - Joel ] Reported-by: Tristan Ye Signed-off-by: Jan Kara Signed-off-by: Joel Becker commit 518ff04fd84290a7ad9042e8a46d78d29cb443d3 Author: John W. Linville Date: Mon Aug 17 12:09:26 2009 -0400 orinoco: correct key bounds check in orinoco_hw_get_tkip_iv If key is 4 that is an array out of bounds. Reported-by: Dan Carpenter Signed-off-by: John W. Linville commit 523d2f6982136d332c9b7dd00e9e16da1091f060 Author: Johannes Berg Date: Wed Jul 1 21:26:43 2009 +0200 mac80211: fix todo lock The key todo lock can be taken from different locks that require it to be _bh to avoid lock inversion due to (soft)irqs. This should fix the two problems reported by Bob and Gabor: http://mid.gmane.org/20090619113049.GB18956@hash.localnet http://mid.gmane.org/4A3FA376.8020307@openwrt.org Signed-off-by: Johannes Berg Cc: Bob Copeland Cc: Gabor Juhos Signed-off-by: John W. Linville commit 87c62a66edd645a9b1ff1f9b00ab20c5a93d8845 Author: Atsushi Nemoto Date: Tue Jul 14 22:37:09 2009 +0900 MIPS: Fix HPAGE_SIZE redefinition This patch fixes warnings like this: CC fs/proc/meminfo.o In file included from /work/linux/include/linux/mmzone.h:20, from /work/linux/include/linux/gfp.h:4, from /work/linux/include/linux/mm.h:8, from /work/linux/fs/proc/meminfo.c:5: /work/linux/arch/mips/include/asm/page.h:36:1: warning: "HPAGE_SIZE" redefined In file included from /work/linux/fs/proc/meminfo.c:2: /work/linux/include/linux/hugetlb.h:107:1: warning: this is the location of the previous definition Signed-off-by: Atsushi Nemoto Acked-by: David Daney Signed-off-by: Ralf Baechle commit e412cd257e0d51e0ecbb89f50953835b5a0681b2 Author: Ingo Molnar Date: Mon Aug 17 10:19:00 2009 +0200 x86, mce: Don't initialize MCEs on unknown CPUs An older test-box started hanging at the following point during bootup: [ 0.022996] Mount-cache hash table entries: 512 [ 0.024996] Initializing cgroup subsys debug [ 0.025996] Initializing cgroup subsys cpuacct [ 0.026995] Initializing cgroup subsys devices [ 0.027995] Initializing cgroup subsys freezer [ 0.028995] mce: CPU supports 5 MCE banks I've bisected it down to commit 4efc0670 ("x86, mce: use 64bit machine check code on 32bit"), which utilizes the MCE code on 32-bit systems too. The problem is caused by this detail in my config: # CONFIG_CPU_SUP_INTEL is not set This disables the quirks in mce_cpu_quirks() but still enables MCE support - which then hangs due to the missing quirk workaround needed on this CPU: if (c->x86 == 6 && c->x86_model < 0x1A && banks > 0) mce_banks[0].init = 0; The safe solution is to not initialize MCEs if we dont know on what CPU we are running (or if that CPU's support code got disabled in the config). Also be a bit more defensive on 32-bit systems: dont do a boot-time dump of pending MCEs not just on the specific system that we found a problem with (Pentium-M), but earlier ones as well. Now this problem is probably not common and disabling CPU support is rare - but still being more defensive in something we turned on for a wide range of CPUs is prudent. Cc: Hidetoshi Seto LKML-Reference: Message-ID: <4A88E3E4.40506@jp.fujitsu.com> Signed-off-by: Ingo Molnar commit de809347aeef0a68c04576c464414d0e4dce59fc Author: Amerigo Wang Date: Mon Aug 17 05:43:01 2009 -0400 timers: Drop write permission on /proc/timer_list /proc/timer_list and /proc/slabinfo are not supposed to be written, so there should be no write permissions on it. Signed-off-by: WANG Cong Cc: Pekka Enberg Cc: Vegard Nossum Cc: Eduard - Gabriel Munteanu Cc: linux-mm@kvack.org Cc: Christoph Lameter Cc: David Rientjes Cc: Amerigo Wang Cc: Matt Mackall Cc: Arjan van de Ven LKML-Reference: <20090817094525.6355.88682.sendpatchset@localhost.localdomain> Signed-off-by: Ingo Molnar commit e1ac3614ff606ae03677f47459113f98a19af63c Author: Paul Mackerras Date: Fri Aug 14 15:39:10 2009 +1000 perf_counter: Check task on counter read IPI In general, code in perf_counter.c that is called through an IPI checks, for per-task counters, that the counter's task is still the current task. This is to handle the race condition where the cpu switches from the task we want to another task in the interval between sending the IPI and the IPI arriving and being handled on the target CPU. For some reason, __perf_counter_read is missing this check, yet there is no reason why the race condition can't occur. This adds a check that the current task is the one we want. If it isn't, we just return. In that case the counter->count value should be up to date, since it will have been updated when the counter was scheduled out, which must have happened since the IPI was sent. I don't have an example of an actual failure due to this race, but it seems obvious that it could occur and we need to guard against it. Signed-off-by: Paul Mackerras Acked-by: Peter Zijlstra LKML-Reference: <19076.63614.277861.368125@drongo.ozlabs.ibm.com> Signed-off-by: Ingo Molnar commit 2932cffc89e9a1476b28a59896fa4f81e0d4f131 Author: Carlos R. Mafra Date: Mon Aug 17 00:36:21 2009 +0200 perf: Rename perf-examples.txt to examples.txt Rename it to examples.txt to avoid the perf-*.txt pattern in the Makefile, otherwise 'make doc' fails because perf-examples.txt is not formatted to be a man page: ERROR: perf-examples.txt: line 1: manpage document title is mandatory Signed-off-by: Carlos R. Mafra Cc: Peter Zijlstra Cc: Paul Mackerras LKML-Reference: Signed-off-by: Ingo Molnar commit c7f6fa44115d401e89db730f357629d39f8e4ba6 Author: Bartlomiej Zolnierkiewicz Date: Tue Jul 28 23:52:54 2009 +0200 x86, mce: don't log boot MCEs on Pentium M (model == 13) CPUs On my legacy Pentium M laptop (Acer Extensa 2900) I get bogus MCE on a cold boot with CONFIG_X86_NEW_MCE enabled, i.e. (after decoding it with mcelog): MCE 0 HARDWARE ERROR. This is *NOT* a software problem! Please contact your hardware vendor CPU 0 BANK 1 MCG status: MCi status: Error overflow Uncorrected error Error enabled Processor context corrupt MCA: Data CACHE Level-1 UNKNOWN Error STATUS f200000000000195 MCGSTATUS 0 [ The other STATUS values observed: f2000000000001b5 (... UNKNOWN error) and f200000000000115 (... READ Error). To verify that this is not a CONFIG_X86_NEW_MCE bug I also modified the CONFIG_X86_OLD_MCE code (which doesn't log any MCEs) to dump content of STATUS MSR before it is cleared during initialization. ] Since the bogus MCE results in a kernel taint (which in turn disables lockdep support) don't log boot MCEs on Pentium M (model == 13) CPUs by default ("mce=bootlog" boot parameter can be be used to get the old behavior). Signed-off-by: Bartlomiej Zolnierkiewicz Reviewed-by: Andi Kleen Signed-off-by: H. Peter Anvin Signed-off-by: Ingo Molnar commit bc990f5cb424cdca9dda866785d088e2c2110ecc Author: Christoph Hellwig Date: Sun Aug 16 20:36:34 2009 -0400 xfs: fix locking in xfs_iget_cache_hit The locking in xfs_iget_cache_hit currently has numerous problems: - we clear the reclaim tag without i_flags_lock which protects modifications to it - we call inode_init_always which can sleep with pag_ici_lock held (this is oss.sgi.com BZ #819) - we acquire and drop i_flags_lock a lot and thus provide no consistency between the various flags we set/clear under it This patch fixes all that with a major revamp of the locking in the function. The new version acquires i_flags_lock early and only drops it once we need to call into inode_init_always or before calling xfs_ilock. This patch fixes a bug seen in the wild where we race modifying the reclaim tag. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Reviewed-by: Eric Sandeen Signed-off-by: Felix Blyakher commit 1d9959734a1949ea4f2427bd2d8b21ede6b2441c Author: Eric Paris Date: Fri Aug 7 14:53:57 2009 -0400 security: define round_hint_to_min in !CONFIG_SECURITY Fix the header files to define round_hint_to_min() and to define mmap_min_addr_handler() in the !CONFIG_SECURITY case. Built and tested with !CONFIG_SECURITY Signed-off-by: Eric Paris Signed-off-by: James Morris commit 788084aba2ab7348257597496befcbccabdc98a3 Author: Eric Paris Date: Fri Jul 31 12:54:11 2009 -0400 Security/SELinux: seperate lsm specific mmap_min_addr Currently SELinux enforcement of controls on the ability to map low memory is determined by the mmap_min_addr tunable. This patch causes SELinux to ignore the tunable and instead use a seperate Kconfig option specific to how much space the LSM should protect. The tunable will now only control the need for CAP_SYS_RAWIO and SELinux permissions will always protect the amount of low memory designated by CONFIG_LSM_MMAP_MIN_ADDR. This allows users who need to disable the mmap_min_addr controls (usual reason being they run WINE as a non-root user) to do so and still have SELinux controls preventing confined domains (like a web server) from being able to map some area of low memory. Signed-off-by: Eric Paris Signed-off-by: James Morris commit 8cf948e744e0218af604c32edecde10006dc8e9e Author: Eric Paris Date: Fri Jul 31 12:54:05 2009 -0400 SELinux: call cap_file_mmap in selinux_file_mmap Currently SELinux does not check CAP_SYS_RAWIO in the file_mmap hook. This means there is no DAC check on the ability to mmap low addresses in the memory space. This function adds the DAC check for CAP_SYS_RAWIO while maintaining the selinux check on mmap_zero. This means that processes which need to mmap low memory will need CAP_SYS_RAWIO and mmap_zero but will NOT need the SELinux sys_rawio capability. Signed-off-by: Eric Paris Signed-off-by: James Morris commit 9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3 Author: Eric Paris Date: Fri Jul 31 12:53:58 2009 -0400 Capabilities: move cap_file_mmap to commoncap.c Currently we duplicate the mmap_min_addr test in cap_file_mmap and in security_file_mmap if !CONFIG_SECURITY. This patch moves cap_file_mmap into commoncap.c and then calls that function directly from security_file_mmap ifndef CONFIG_SECURITY like all of the other capability checks are done. Signed-off-by: Eric Paris Acked-by: Serge Hallyn Signed-off-by: James Morris commit cefb87efc9aa0288849149484870d5ab989fbd59 Author: Dave Airlie Date: Sun Aug 16 21:05:45 2009 +1000 drm/radeon/kms: implement bo busy check + current domain This implements the busy ioctl along with a current domain check. returns 0 or -EBUSY puts the current domain no matter what the answer. Signed-off-by: Dave Airlie commit 52459ab91363343af8ae252766e9da762344a2e7 Author: Leonardo Potenza Date: Sun Aug 16 18:55:48 2009 +0200 x86: Annotate section mismatch warnings in kernel/apic/x2apic_uv_x.c The function uv_acpi_madt_oem_check() has been marked __init, the struct apic_x2apic_uv_x has been marked __refdata. The aim is to address the following section mismatch messages: WARNING: arch/x86/kernel/apic/built-in.o(.data+0x1368): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary() The variable apic_x2apic_uv_x references the function __cpuinit uv_wakeup_secondary() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, WARNING: arch/x86/kernel/built-in.o(.data+0x68e8): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary() The variable apic_x2apic_uv_x references the function __cpuinit uv_wakeup_secondary() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, WARNING: arch/x86/built-in.o(.text+0x7b36f): Section mismatch in reference from the function uv_acpi_madt_oem_check() to the function .init.text:early_ioremap() The function uv_acpi_madt_oem_check() references the function __init early_ioremap(). This is often because uv_acpi_madt_oem_check lacks a __init annotation or the annotation of early_ioremap is wrong. WARNING: arch/x86/built-in.o(.text+0x7b38d): Section mismatch in reference from the function uv_acpi_madt_oem_check() to the function .init.text:early_iounmap() The function uv_acpi_madt_oem_check() references the function __init early_iounmap(). This is often because uv_acpi_madt_oem_check lacks a __init annotation or the annotation of early_iounmap is wrong. WARNING: arch/x86/built-in.o(.data+0x8668): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary() The variable apic_x2apic_uv_x references the function __cpuinit uv_wakeup_secondary() If the reference is valid then annotate the variable with __init* or __refdata (see linux/init.h) or name the variable: *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console, Signed-off-by: Leonardo Potenza LKML-Reference: <200908161855.48302.lpotenza@inwind.it> Signed-off-by: Ingo Molnar commit 894ef820b10d77e2d6d717342fc408bdd9825139 Author: Randy Dunlap Date: Sun Aug 16 07:33:30 2009 -0700 dm-log-userspace: fix printk format warning drivers/md/dm-log-userspace-transfer.c:110: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'size_t' Previously posted and acked, but apparently lost. http://lkml.indiana.edu/hypermail/linux/kernel/0906.2/02074.html Signed-off-by: Randy Dunlap Cc: dm-devel@redhat.com Signed-off-by: Linus Torvalds commit 4e5c25d405e18a2f279ca2bfc855508ec3a0186b Author: Hugh Dickins Date: Sun Aug 16 15:54:37 2009 +0100 x86, mce: therm_throt: Don't log redundant normality 0d01f31439c1e4d602bf9fdc924ab66f407f5e38 "x86, mce: therm_throt - change when we print messages" removed redundant announcements of "Temperature/speed normal". They're not worth logging and remove their accompanying "Machine check events logged" messages as well from the console. Signed-off-by: Hugh Dickins Cc: Hidetoshi Seto Cc: Andi Kleen Cc: Dmitry Torokhov LKML-Reference: Signed-off-by: Ingo Molnar commit 68eac4602b9104cdaa6c18b3edd914cececa6a1e Author: Xiaotian Feng Date: Fri Aug 14 14:35:52 2009 +0000 e1000e: fix use of pci_enable_pcie_error_reporting commit 111b9dc5 ("e1000e: add aer support") introduces pcie aer support for e1000e, but it is not reasonable to disable it in e1000_remove but enable it in e1000_resume. This patch enables aer support in e1000_probe. Signed-off-by: Xiaotian Feng Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 82776a4bcd7aa5fbcd2e6339b3ce88b727dd40ab Author: Bruce Allan Date: Fri Aug 14 14:35:33 2009 +0000 e1000e: WoL does not work on 82577/82578 with manageability enabled With manageability (Intel AMT) enabled via BIOS, PHY wakeup does not get configured on newer parts which use PHY wakeup vs. MAC wakeup which causes WoL to not work. The driver should configure PHY wakeup whether or not manageability is enabled. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 7fc1ece40704b150477e548a7a98d285cc418790 Author: Michael Chan Date: Fri Aug 14 15:49:47 2009 +0000 cnic: Fix locking in init/exit calls. The slow path ulp_init and ulp_exit calls to the bnx2i driver are sleepable calls and therefore should not be protected using rcu_read_lock. Fix it by using mutex and refcount during these calls. cnic_unregister_driver() will now wait for the refcount to go to zero before completing the call. Signed-off-by: Michael Chan Reviewed-by: Benjamin Li Signed-off-by: David S. Miller commit 681dbd710779e8b8d5bae926f6b11f30df70638b Author: Michael Chan Date: Fri Aug 14 15:49:46 2009 +0000 cnic: Fix locking in start/stop calls. The slow path ulp_start and ulp_stop calls to the bnx2i driver are sleepable calls and therefore should not be protected using rcu_read_lock. Fix it by using mutex and setting a bit during these calls. cnic_unregister_device() will now wait for the bit to clear before completing the call. Signed-off-by: Michael Chan Reviewed-by: Benjamin Li Signed-off-by: David S. Miller commit c5a889508203446c1abc1d670599b3a816841813 Author: Michael Chan Date: Fri Aug 14 15:49:45 2009 +0000 bnx2: Use mutex on slow path cnic calls. The slow path calls to the cnic driver are sleepable calls so we cannot use rcu_read_lock(). Use mutex for these slow path calls instead. Signed-off-by: Michael Chan Reviewed-by: Benjamin Li Signed-off-by: David S. Miller commit a3059b12adae868c42629ecf058a94195ef1e958 Author: Michael Chan Date: Fri Aug 14 15:49:44 2009 +0000 cnic: Refine registration with bnx2. Register and unregister with bnx2 during NETDEV_UP and NETDEV_DOWN events. This simplifies the sequence of events and allows locking fixes in the next patch. Signed-off-by: Michael Chan Reviewed-by: Benjamin Li Signed-off-by: David S. Miller commit 64c6460875957502541a4ba30835ac625a0bee79 Author: Michael Chan Date: Fri Aug 14 15:49:43 2009 +0000 cnic: Fix symbol_put_addr() panic on ia64. When the cnic driver tries to grab a symbol from bnx2 when bnx2 is running init code, symbol_get() will succeed but symbol_put_addr() will hit BUG() a moment later. module_text_address() fails because bnx2 is still in init code. This is fixed by using symbol_put() instead which does the exact opposite of symbol_get(). Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit b2add73dbf93fd50f00564d7abc3e2b9aa9dd20c Author: Guillaume Knispel Date: Sat Aug 15 19:30:24 2009 +0200 poll/select: initialize triggered field of struct poll_wqueues The triggered field of struct poll_wqueues introduced in commit 5f820f648c92a5ecc771a96b3c29aa6e90013bba ("poll: allow f_op->poll to sleep"). It was first set to 1 in pollwake() (now __pollwake() ), tested and later set to 0 in poll_schedule_timeout(), but not initialized before. As a result when the process needs to sleep, triggered was likely to be non-zero even if pollwake() is not called before the first poll_schedule_timeout(), meaning schedule_hrtimeout_range() would not be called and an extra loop calling all ->poll() would be done. This patch initialize triggered to 0 in poll_initwait() so the ->poll() are not called twice before the process goes to sleep when it needs to. Signed-off-by: Guillaume Knispel Acked-by: Thomas Gleixner Acked-by: Tejun Heo Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit de1b28989edff519d0548ebaa3f94fd3d1524cf2 Author: Dave Airlie Date: Wed Aug 12 18:43:14 2009 +1000 drm/radeon/kms: cut down indirects in register accesses. We really don't want to be doing all these indirects, updating the GPU gart table is something we do often so the less overhead the better. Signed-off-by: Dave Airlie commit 7ed220d738cf16adff6bc3b31ad25b8848a2fa9c Author: Michel Dänzer Date: Thu Aug 13 11:10:51 2009 +0200 drm/radeon/kms: Fix up vertical blank interrupt support. Fixes 3D apps timing out in the WAIT_VBLANK ioctl. AVIVO bits compile-tested only. Signed-off-by: Michel Dänzer Signed-off-by: Dave Airlie commit 3f8befec95d5c1bbc6e247e1a5dafa82519530f9 Author: Dave Airlie Date: Sat Aug 15 20:54:13 2009 +1000 drm/radeon/kms: add rv530 R300_SU_REG_DEST + reloc for ZPASS_ADDR These are needed for Occulsion Query support. Signed-off-by: Dave Airlie commit a2bb9f4d6a5a589b481595207ac3588cc08d1b60 Author: Linus Walleij Date: Thu Aug 13 21:57:22 2009 +0100 ARM: 5673/1: U300 fix initsection compile warning The u300_init_check_chip() function was not properly tagged with the __init macro and provided a initsection mismatch on compilation. Signed-off-by: Linus Walleij Signed-off-by: Russell King commit c5e7f5a38a7ebf3697281bc7cb494e676f287ac0 Author: Florian Fainelli Date: Wed Jun 3 13:05:48 2009 +0200 [WATCHDOG] ar7_wdt: fix path to ar7-specific headers AR7 is currently being resubmitted for mainline inclusion and we changed the path to the ar7-specific headers from ar7 to mach-ar7 to reflect the other MIPS-based boards header hierarchy. This patch will avoid any future compilation failure due to missing headers. Signed-off-by: Florian Fainelli Signed-off-by: Wim Van Sebroeck commit 824df399a31fe92d88eb8caf86768cc8c7c72a06 Merge: 8b61207 48ec45e Author: Russell King Date: Sat Aug 15 12:43:13 2009 +0100 Merge branch 's3c-fixes' of git://aeryn.fluff.org.uk/bjdooks/linux commit 8b6120789598d55f6aa2b4e9ac7e70a205d857da Merge: dde5828 563abb4 Author: Russell King Date: Sat Aug 15 12:42:46 2009 +0100 Merge branch 'for-rmk-rc' of git://git.pengutronix.de/git/imx/linux-2.6 commit dde5828f56cb2c1aa70365c476e6830482127258 Author: Russell King Date: Sat Aug 15 12:36:00 2009 +0100 ARM: Fix broken highmem support Currently, highmem is selectable, and you can request an increased vmalloc area. However, none of this has any effect on the memory layout since a patch in the highmem series was accidentally dropped. Moreover, even if you did want highmem, all memory would still be registered as lowmem, possibly resulting in overflow of the available virtual mapping space. The highmem boundary is determined by the highest allowed beginning of the vmalloc area, which depends on its configurable minimum size (see commit 60296c71f6c5063e3c1f1d2619ca0b60940162e7 for details on this). We should create mappings and initialize bootmem only for low memory, while the zone allocator must still be told about highmem. Currently, memory nodes which are completely located in high memory are not supported. This is not a huge limitation since systems relying on highmem support are unlikely to have discontiguous memory with large holes. [ A similar patch was meant to be merged before commit 5f0fbf9ecaf3 and be available in Linux v2.6.30, however some git rebase screw-up of mine dropped the first commit of the series, and that goofage escaped testing somehow as well. -- Nico ] Signed-off-by: Russell King Reviewed-by: Nicolas Pitre commit 39e6dd73502f64e2ae3236b304e160ae30de9384 Author: Arnaldo Carvalho de Melo Date: Fri Aug 14 15:26:32 2009 -0300 perf record: Fix typo in pid_synthesize_comm_event We were using 'fd' locally, but there was a global 'fd' too, so when converting from open to fopen the test made against fd should be made against 'fp', but since we have that global it didnt get discovered ... Reported-by: Ulrich Drepper Signed-off-by: Arnaldo Carvalho de Melo Cc: Peter Zijlstra LKML-Reference: <20090814182632.GF3490@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 3ef12c3c97603bad405d30c989718cc9405e2759 Author: Cliff Wickman Date: Fri Aug 14 13:56:37 2009 -0500 x86: Fix UV BAU destination subnode id The SGI UV Broadcast Assist Unit is used to send TLB shootdown messages to remote nodes of the system. The header of the message must contain the subnode id of the block in the receiving hub that handles such messages. It should always be 0x10, the id of the "LB" block. It had previously been documented as a "must be zero" field. Signed-off-by: Cliff Wickman Acked-by: Jack Steiner LKML-Reference: Signed-off-by: Ingo Molnar commit 237674e050ae8ea40a432412df6c15d60b7ae8a6 Author: Magnus Damm Date: Sat Aug 15 02:53:42 2009 +0000 sh: sh7724 ddr self-refresh changes This patch updates the SuperH Mobile sleep assembly code with support for DBSC memory controller found in the sh7724 processor. Without this fix the memory hooked up to the sh7724 processor will never enter self-refresh mode before suspending to ram. The effect of this is that the memory contents most likeley will be lost upon resume which may or may not be what you want. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit 9747e78b304b44d6fb73e2c8071406d55aa8bb75 Author: Magnus Damm Date: Sat Aug 15 02:53:34 2009 +0000 sh: use in-soc KEYSC on se7724 This patch updates the Solution Engine 7724 board code to use in-SoC KEYSC resources for the keyboard platform device. Using the in-SoC key scan controller fixes a crash-during-resume issue. Without this patch the KEYSC hardware block located in the board specific FPGA is used together with an external IRQ which is routed through the FPGA and handled by some board specific demux code. This board specific FPGA interrupt code does not implement desc->set_wake() so the enable_irq_wake() call in the sh_keysc driver will fail at suspend-to-ram time and the disable_irq_wake() will bomb out when resuming. Changing the platform data to use the in-SoC KEYSC hardware makes the se7724 board support code less special which is a good thing. Also, the board specific KEYSC pin setup code selects in-SoC pin functions already which makes the current FPGA platform device data look like a typo. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit f6431732f128a241b149c0aa85dfec852455ebf9 Author: Magnus Damm Date: Sat Aug 15 02:53:25 2009 +0000 sh: CMT suspend/resume This patch updates the SuperH CMT driver with suspend and resume callbacks for the suspend-to-ram case. This patch stops the CMT channel at suspend time to avoid unwanted wake up events. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit 21bc1f024d0d4ea43fc0f2a43504e759261c7b18 Author: Magnus Damm Date: Sat Aug 15 02:53:16 2009 +0000 sh: skip disabled LCDC channels This patch updates the SuperH Mobile LCDC driver to skip over disabled channels. Without this patch suspend-to-ram operation will crash if deferred io is enabled. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit ebb177d2afb8532a8a316489aed545ed0c170802 Author: Dave Airlie Date: Sat Aug 15 12:25:08 2009 +1000 drm/edid: fixup detailed timings like the X server. this syncs the versioning check with the code the X server uses. Reported-by: Anssi Hannula Signed-off-by: Dave Airlie commit 616b8434688aa08bd6f019cc60c8dfe121e9e5ae Author: Jerome Glisse Date: Thu Aug 6 17:47:24 2009 +0200 drm/radeon/kms: Add specific rs690 authorized register table rs690 is r3xx 3D engine with AVIVO modesetting so we need to allow AVIVO register for vline synchronization. This add a specific table to rs690 to handle that. Thanks to Marc (marvin24) for debugging this and kudos to Andre (taiu1) for spotting the origin of the bugs. Signed-off-by: Jerome Glisse Signed-off-by: Dave Airlie commit 8cdb045632e5ee22854538619ac6f150eb0a4894 Author: Tom Goff Date: Fri Aug 14 16:33:56 2009 -0700 gre: Fix MTU calculation for bound GRE tunnels The GRE header length should be subtracted when the tunnel MTU is calculated. This just corrects for the associativity change introduced by commit 42aa916265d740d66ac1f17290366e9494c884c2 ("gre: Move MTU setting out of ipgre_tunnel_bind_dev"). Signed-off-by: Tom Goff Signed-off-by: David S. Miller commit 7c1d15d736687057f4dc6e51fbf44b6f6e4320cb Author: Petko Manolov Date: Fri Aug 14 06:40:48 2009 +0000 pegasus: Add new device ID. Add new definition to 'pegasus.h' for support Japanese IO DATA "ETX-US2" USB Ethernet Adapter. PEGASUS_DEV( $B!H(BIO DATA USB ETX-US2$B!I(B, VENDOR_IODATA, 0x092a, DEFAULT_GPIO_RESET | PEGASUS_II ) Signed-off-by: David S. Miller commit 22580f894ac190c46beebb5c3172e450a2318f79 Author: Dongdong Deng Date: Thu Aug 13 19:12:31 2009 +0000 drivers/net: fixed drivers that support netpoll use ndo_start_xmit() The NETPOLL API requires that interrupts remain disabled in netpoll_send_skb(). The use of spin_lock_irq() and spin_unlock_irq() in the NETPOLL API callbacks causes the interrupts to get enabled and can lead to kernel instability. The solution is to use spin_lock_irqsave() and spin_unlock_restore() to prevent the irqs from getting enabled while in netpoll_send_skb(). Call trace: netpoll_send_skb() { -> local_irq_save(flags) ---> dev->ndo_start_xmit(skb, dev) ---> spin_lock_irq() ---> spin_unlock_irq() *******here would enable the interrupt. ... -> local_irq_restore(flags) } Signed-off-by: Dongdong Deng Signed-off-by: Jason Wessel Acked-by: Bruce Ashfield Acked-by: Matt Mackall Signed-off-by: David S. Miller commit 0527a1a8440a20b3d0fd1d0c9e75a6f38a9d5315 Author: roel kluin Date: Fri Aug 14 02:09:56 2009 +0000 via-velocity: Fix test of mii_status bit VELOCITY_DUPLEX_FULL Test whether VELOCITY_DUPLEX_FULL bit is set in mii_status. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit c9a2bfd1f08973115c2fc3da9372e0e81ac42a19 Author: Wolfram Sang Date: Fri Aug 14 13:09:32 2009 -0700 pcmcia: add CNF-CDROM-ID for ide Fixes this report: http://article.gmane.org/gmane.linux.kernel.pcmcia.devel/2228/ Reported-by: John McGrath Signed-off-by: Wolfram Sang Signed-off-by: David S. Miller commit 88512935a24305fea7aecc9ba4d675869e97fc2a Merge: 8a62bab 6b26dea Author: David S. Miller Date: Fri Aug 14 12:27:19 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit 5d12dc1fd6b0ba31d3166e42ed01996df6dad34e Merge: 3011c7f d7e623d Author: Linus Torvalds Date: Fri Aug 14 09:34:25 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes: GFS2: Fix permissions on "recover" file commit 3011c7f0d421ed85c75683addf3b31eaa1ab6cec Merge: 64f1607 08b3964 Author: Linus Torvalds Date: Fri Aug 14 08:25:19 2009 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (38 commits) V4L/DVB (12441): siano: read buffer overflow V4L/DVB (12440): Use kzalloc for frontend states to have struct dvb_frontend properly V4L/DVB (12438): Read buffer overflow V4L/DVB (12437): dvb: siano uses/depends on INPUT V4L/DVB (12436): stk-webcam: read buffer overflow V4L/DVB (12432): em28xx: fix regression in Empire DualTV digital tuning V4L/DVB (12429): v4l2-ioctl: fix G_STD and G_PARM default handlers V4L/DVB (12428): hdpvr: add missing initialization of current_norm V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue() V4L/DVB (12422): media/zr364xx: fix build errors V4L/DVB (12405): em28xx-cards: move register 0x13 setting to the proper place V4L/DVB (12411): em28xx: Fix artifacts with Silvercrest webcam V4L/DVB (12410): em28xx: Move the non-board dependent part to be outside em28xx_pre_card_setup() V4L/DVB (12407): em28xx: Adjust Silvercrest xtal frequency V4L/DVB (12406): em28xx: fix: don't do image interlacing on webcams V4L/DVB (12403): em28xx: properly reports some em2710 chips V4L/DVB (12402): em28xx: fix: some em2710 chips use a different vendor ID V4L/DVB (12401): m9v011: add vflip/hflip controls to control mirror/upside down V4L/DVB (12400): em28xx: Allow changing fps on webcams V4L/DVB (12399): mt9v011: Add support for controlling frame rates ... commit 388ce4beb7135722c584b0af18f215e3ec657adf Author: Kashyap, Desai Date: Fri Aug 14 15:01:35 2009 +0530 [SCSI] mpt2sas: fix config request and diag reset deadlock Moving the setting and clearing of the mutex's to _config_request. There was a mutex deadlock when diag reset is called from inside _config_request, so diag reset was moved to outside the mutexs. Signed-off-by: James Bottomley commit 6b26dead3ce97d016b57724b01974d5ca5c84bd5 Author: Pavel Roskin Date: Tue Aug 4 17:48:16 2009 -0400 rt2x00: fix memory corruption in rf cache, add a sanity check Change rt2x00_rf_read() and rt2x00_rf_write() to subtract 1 from the rf register number. This is needed because the rf registers are enumerated starting with one. The size of the rf register cache is just enough to hold all registers, so writing to the highest register was corrupting memory. Add a check to make sure that the rf register number is valid. Signed-off-by: Pavel Roskin Cc: stable@kernel.org Acked-by: Ivo van Doorn Signed-off-by: John W. Linville commit d7e623da1a757fbd8c117fa29190ca8bef14dab3 Author: Steven Whitehouse Date: Tue Aug 11 11:20:11 2009 +0100 GFS2: Fix permissions on "recover" file Although this file is only ever written and not read by userspace, it seems that the utils are opening this file O_RDWR, so we need to allow that. Also fixes the whitespace which seemed to be broken. Signed-off-by: Steven Whitehouse Cc: David Teigland commit 563abb4be1a79e7b64784d43beb9d0cacb1bad6f Author: Valentin Longchamp Date: Tue Aug 11 17:29:21 2009 +0200 mx31moboard: invert sdhc ro signal sense Small confusion with our hardware engineer, the WP signal (RO) is active low on our boards, the signal has to inverted. This is a pretty straightforward patch, it could even go to -rc, but if not, then push it for 2.6.32. Signed-off-by: Valentin Longchamp Signed-off-by: Sascha Hauer commit 142d44b0dd6741a64a7bdbe029110e7c1dcf1d23 Author: Amerigo Wang Date: Thu Aug 13 02:00:13 2009 -0400 percpu: use the right flag for get_vm_area() get_vm_area() only accepts VM_* flags, not GFP_*. And according to the doc of get_vm_area(), here should be VM_ALLOC. Signed-off-by: WANG Cong Acked-by: Tejun Heo Cc: Ingo Molnar commit 74d46d6b2d23d44d72c37df4c6a5d2e782f7b088 Author: Tejun Heo Date: Tue Jul 21 17:11:50 2009 +0900 percpu, sparc64: fix sparse possible cpu map handling percpu code has been assuming num_possible_cpus() == nr_cpu_ids which is incorrect if cpu_possible_map contains holes. This causes percpu code to access beyond allocated memories and vmalloc areas. On a sparc64 machine with cpus 0 and 2 (u60), this triggers the following warning or fails boot. WARNING: at /devel/tj/os/work/mm/vmalloc.c:106 vmap_page_range_noflush+0x1f0/0x240() Modules linked in: Call Trace: [00000000004b17d0] vmap_page_range_noflush+0x1f0/0x240 [00000000004b1840] map_vm_area+0x20/0x60 [00000000004b1950] __vmalloc_area_node+0xd0/0x160 [0000000000593434] deflate_init+0x14/0xe0 [0000000000583b94] __crypto_alloc_tfm+0xd4/0x1e0 [00000000005844f0] crypto_alloc_base+0x50/0xa0 [000000000058b898] alg_test_comp+0x18/0x80 [000000000058dad4] alg_test+0x54/0x180 [000000000058af00] cryptomgr_test+0x40/0x60 [0000000000473098] kthread+0x58/0x80 [000000000042b590] kernel_thread+0x30/0x60 [0000000000472fd0] kthreadd+0xf0/0x160 ---[ end trace 429b268a213317ba ]--- This patch fixes generic percpu functions and sparc64 setup_per_cpu_areas() so that they handle sparse cpu_possible_map properly. Please note that on x86, cpu_possible_map() doesn't contain holes and thus num_possible_cpus() == nr_cpu_ids and this patch doesn't cause any behavior difference. Signed-off-by: Tejun Heo Acked-by: David S. Miller Cc: Ingo Molnar commit d6647bdf98a0de19963de8d5d9698d469ed72097 Author: Tejun Heo Date: Tue Jul 21 17:11:50 2009 +0900 init: set nr_cpu_ids before setup_per_cpu_areas() nr_cpu_ids is dependent only on cpu_possible_map and setup_per_cpu_areas() already depends on cpu_possible_map and will use nr_cpu_ids. Initialize nr_cpu_ids before setting up percpu areas. Signed-off-by: Tejun Heo commit 8a62babfb87aa5911e87e0ce38381bdfdc4a2b83 Author: Lucy Liu Date: Thu Aug 13 14:09:38 2009 +0000 ixgbe: Fix receive on real device when VLANs are configured Traffic received with a priority tag (VID = 0) and non-zero priority value was incorrectly handled by the VLAN packet code path due to a check on zero for the whole VLAN tag instead of just the VID. This patch masked out the priority field when checking the vlan tag for received VLAN packets. Signed-off-by: Lucy Liu Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 17e78b0655da20f2fc2bbde3b8252dac07c82914 Author: Yi Zou Date: Thu Aug 13 14:09:58 2009 +0000 ixgbe: Do not return 0 in ixgbe_fcoe_ddp() upon FCP_RSP in DDP completion We return the ddp->len in ixgbe_fcoe_ddp() to indicate the length of data that have been DDPed. However, it is possible that the length is 0, e.g., for SCSI READ, the FCP_RSP may come back w/ SCSI status 0x28 as Task Set Full with no FCP data for DDP. In ixgbe_fcoe_ddp(), we return 0 to indicate not passing DDPed packets to upper layer. Therefore in the case of ddp->len being 0 upon FCP_RSP, we do not want to return the 0 ddp->len as we want FCP_RSP to be always delivered to the upper layer. This patch fixes this bug by setting rc only if ddp->len is non-zero. Signed-off-by: Yi Zou Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 48ec45e725aa385d72bced73b267dfaf13351876 Author: Davide Rizzo Date: Thu Aug 13 11:53:53 2009 +0200 ARM: S3C24XX: Fix clkout mpx error Bug correction: CLK Outputs cannot have XTAL as parent Signed-off-by: Davide Rizzo [ben-linux@fluff.org: updated patch subject] Signed-off-by: Ben Dooks commit a219dc4d4463809b1be473038e7d9f3437ca452d Author: Ramax Lo Date: Wed Aug 12 23:55:56 2009 +0800 ARM: S3C64XX: serial: Fix a typo in Kconfig The typo causes drivers/serial/s3c6400.c not being built for s3c6400 platform. Signed-off-by: Ramax Lo Signed-off-by: Ben Dooks commit 08b39642b1e375afd014c50f6013ec4a292ca3b2 Author: Roel Kluin Date: Mon Aug 10 22:59:33 2009 -0300 V4L/DVB (12441): siano: read buffer overflow With mode DEVICE_MODE_RAW_TUNER a read occurs past the end of smscore_fw_lkup[]. Subsequently an attempt is made to load the firmware from the resulting filename. Signed-off-by: Roel Kluin Signed-off-by: Andrew Morton Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 084e24acc906c162c92de7df807190856ae60928 Author: Matthias Schwarzott Date: Mon Aug 10 22:51:01 2009 -0300 V4L/DVB (12440): Use kzalloc for frontend states to have struct dvb_frontend properly This patch changes most frontend drivers to allocate their state structure via kzalloc and not kmalloc. This is done to properly initialize the embedded "struct dvb_frontend frontend" field, that they all have. The visible effect of this struct being uninitalized is, that the member "id" that is used to set the name of kernel thread is totally random. Some board drivers (for example cx88-dvb) set this "id" via videobuf_dvb_alloc_frontend but most do not. So I at least get random id values for saa7134, flexcop and ttpci based cards. It looks like this in dmesg: DVB: registering adapter 1 frontend -10551321 (ST STV0299 DVB-S) The related kernel thread then also gets a strange name like "kdvb-ad-1-fe--1". Cc: Michael Krufky Cc: Steven Toth Cc: Timothy Lee Cc: Igor M. Liplianin Signed-off-by: Matthias Schwarzott Acked-by: Andreas Oberritter Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit bb2b4542b6415044894cd7c147ff54840dd8ed3f Author: Roel Kluin Date: Mon Aug 10 22:07:54 2009 -0300 V4L/DVB (12438): Read buffer overflow parport[n] is checked before n < MAX_CAMS Signed-off-by: Roel Kluin Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 27059b35397fc7cf2cbf5b4b99d912bbc06aff4d Author: Randy Dunlap Date: Mon Aug 10 21:59:16 2009 -0300 V4L/DVB (12437): dvb: siano uses/depends on INPUT siano uses input_*() functions so it should depend on INPUT to prevent build errors: ERROR: "input_event" [drivers/media/dvb/siano/sms1xxx.ko] undefined! ERROR: "input_register_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined! ERROR: "input_free_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined! ERROR: "input_unregister_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined! ERROR: "input_allocate_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined! Cc: Michael Krufky Cc: Uri Shkolnik Signed-off-by: Randy Dunlap Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 77f2c2db1146154fb054e9ce955928a66d8c959f Author: Roel Kluin Date: Mon Aug 10 22:17:25 2009 -0300 V4L/DVB (12436): stk-webcam: read buffer overflow It tested the value of stk_sizes[i].m before checking whether i was in range. Cc: Hans Verkuil Cc: Trent Piepho Signed-off-by: Roel Kluin Signed-off-by: Andrew Morton Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 01a5fd6ff3fbae9a599d3334a8cca0f00865e360 Author: Devin Heitmueller Date: Fri Aug 7 09:25:06 2009 -0300 V4L/DVB (12432): em28xx: fix regression in Empire DualTV digital tuning Restore support for digital tuning caused by regression during introduction of disable_i2c_gate parameter to zl10353 driver. Thanks to user "Xwang" for reporting the problem and testing the fix Cc: Xwang Signed-off-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab commit 9bedc7f7fe803c17d26b5fcf5786b50a7cf40def Author: Hans Verkuil Date: Fri Aug 7 07:28:16 2009 -0300 V4L/DVB (12429): v4l2-ioctl: fix G_STD and G_PARM default handlers The v4l core supplies default handlers for G_STD and G_PARM. However, both default handlers are buggy. This patch fixes the following: 1) If no g_std is supplied and current_norm == 0, then this driver does not support TV video standards (e.g. a radio or webcam driver). Return -EINVAL. This ensures that there is no bogus VIDIOC_G_STD support for such drivers. 2) The default VIDIOC_G_PARM handler used current_norm instead of first checking if the driver supported g_std and calling that to get the norm. It also didn't check if current_norm was 0, since in that case the driver does not support TV standards (or no standard was set at all) and the default handler should return -EINVAL. Note that I am very unhappy with these default handlers: I think they basically behave like some very strange and unexpected side-effect. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 99362e1ece9f9651af1b849a01d91b9df1e0db2c Author: Hans Verkuil Date: Fri Aug 7 07:10:52 2009 -0300 V4L/DVB (12428): hdpvr: add missing initialization of current_norm Drivers should either set current_norm or supply a g_std callback. The hdpvr driver does neither. Since it initializes to a 60 Hz format I've initialized the current_norm to NTSC | PAL_M | PAL_60 which is the 60 Hz subset of tvnorms. Cc: Janne Grunau Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 2dd54a54c19d0e5b50f4e1c591653772ead9d4a1 Author: Guennadi Liakhovetski Date: Wed Aug 5 20:06:31 2009 -0300 V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue() The .buf_queue() V4L2 driver method is called under spinlock_irqsave(q->irqlock,...), don't take the lock again inside the function. Reported-by: Antonio Ospite Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 7d2e2e35fb50f381c9398e481aac1e1729765ae3 Author: Randy Dunlap Date: Wed Aug 5 12:58:47 2009 -0300 V4L/DVB (12422): media/zr364xx: fix build errors Fix build errors in zr364xx by adding selects: zr364xx.c:(.text+0x195ed7): undefined reference to `videobuf_streamon' zr364xx.c:(.text+0x196030): undefined reference to `videobuf_dqbuf' zr364xx.c:(.text+0x1960c4): undefined reference to `videobuf_qbuf' zr364xx.c:(.text+0x196123): undefined reference to `videobuf_querybuf' zr364xx.c:(.text+0x196182): undefined reference to `videobuf_reqbufs' zr364xx.c:(.text+0x196224): undefined reference to `videobuf_queue_is_busy' zr364xx.c:(.text+0x196390): undefined reference to `videobuf_vmalloc_free' zr364xx.c:(.text+0x196571): undefined reference to `videobuf_iolock' zr364xx.c:(.text+0x196678): undefined reference to `videobuf_mmap_mapper' zr364xx.c:(.text+0x196760): undefined reference to `videobuf_poll_stream' zr364xx.c:(.text+0x19689a): undefined reference to `videobuf_read_one' zr364xx.c:(.text+0x1969ec): undefined reference to `videobuf_mmap_free' zr364xx.c:(.text+0x197862): undefined reference to `videobuf_queue_vmalloc_init' zr364xx.c:(.text+0x197a28): undefined reference to `videobuf_streamoff' zr364xx.c:(.text+0x198203): undefined reference to `videobuf_to_vmalloc' zr364xx.c:(.text+0x198603): undefined reference to `videobuf_streamoff' drivers/built-in.o: In function `free_buffer': zr364xx.c:(.text+0x19930c): undefined reference to `videobuf_vmalloc_free' drivers/built-in.o: In function `zr364xx_open': zr364xx.c:(.text+0x19a7de): undefined reference to `videobuf_queue_vmalloc_init' drivers/built-in.o: In function `read_pipe_completion': zr364xx.c:(.text+0x19b17f): undefined reference to `videobuf_to_vmalloc' Signed-off-by: Randy Dunlap Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit d7612c86d099939503c2f849a523dbca753d1935 Author: Mauro Carvalho Chehab Date: Fri Aug 7 18:43:00 2009 -0300 V4L/DVB (12405): em28xx-cards: move register 0x13 setting to the proper place Register 0x13 seems to be a sort of image control, maybe gamma, white level or black level. Lower values produce better images, while higher values increases the contrast and shifts colors to green. 0xff produces a black image. This register is not Silvercrest-specific, so its code should be moved to a better place. If this register is left alone, a random value can be found at the register, producing weird results. While here, let's remove register 0x0d, as it had no noticed effect at the image. Signed-off-by: Mauro Carvalho Chehab commit 3d3215c4e4cfca74e5805a8506d50a6752172e81 Author: Mauro Carvalho Chehab Date: Mon Aug 10 10:29:27 2009 -0300 V4L/DVB (12411): em28xx: Fix artifacts with Silvercrest webcam Silvercrest mt9v011 sensor produces a 640x480 image. However, previously, the code were getting only half of the lines and merging two consecutive frames to "produce" a 640x480 image. With the addition of progressive mode, now em28xx is working with a full image. However, when the number of lines is bigger than 240, the beginning of some odd lines are filled with blank. After lots of testing, and physically checking the device for a Xtal, it was noticed experimentally that mt9v011 is using em28xx XCLK as its clock. Due to that, changing XCLK value changes the maximum speed of the stream. At the tests, it were possible to produce up to 32 fps, using a 30 MHz XCLK. However, at that rate, the artifacts happen even at 320x240. Lower values of XCLK produces artifacts only at 640x480. At some values of xclk (for example XCLKK = 6 MHz, 640x480), it is possible to see an invalid sucession of artifacts with this pattern: .xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ..xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ...xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ....xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx .xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ..xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ...xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx ....xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (where the dots represent the blanked pixels) So, it seems that a waveform in the format of a ramp is interferring at the image. The cause of this interference is currently unknown. Some possibilities are: - electrical interference (maybe this device is broken?); - some issue at mt9v011 programming; - some bug at em28xx chip. So, for now, let's be conservative and use a value of XCLK that we know for sure that it won't cause artifacts. As I'm waiting for more of such devices with different em28xx chipset revisions, I'll have the opportunity to double check the issue with other pieces of hardware. Later patches can vary XCLK depending on the vertical resolutions, if a proper fix is not discovered. Signed-off-by: Mauro Carvalho Chehab commit fcd20e3c369caf7a3fec300c9c183b25a06e21b2 Author: Mauro Carvalho Chehab Date: Mon Aug 10 02:57:57 2009 -0300 V4L/DVB (12410): em28xx: Move the non-board dependent part to be outside em28xx_pre_card_setup() em28xx_pre_card_setup() is meant to contain board-specific initialization. Also, as autodetection sometimes occur only after having i2c bus enabled, this function may need to be called later. Moving those setups to happen outside the function avoids calling it twice without need and without duplicating output lines at dmesg. Signed-off-by: Mauro Carvalho Chehab commit 970cff36c0850e8193ac1162e42c7c11001b872d Author: Mauro Carvalho Chehab Date: Sat Aug 8 03:28:41 2009 -0300 V4L/DVB (12407): em28xx: Adjust Silvercrest xtal frequency We don't know the xtal frequency of Silvercrest, but we need to have some value in order to allow controlling the frame rate frequency. The value is probably still wrong, since the manufacturer announces this device as being capable of 30fps, but the maximum we can get is 13.5 fps. Signed-off-by: Mauro Carvalho Chehab commit c2a6b54a9cf08d4ffeb75d70603c4a5d03ac97ad Author: Mauro Carvalho Chehab Date: Sat Aug 8 03:14:55 2009 -0300 V4L/DVB (12406): em28xx: fix: don't do image interlacing on webcams Due to historical reasons, em28xx driver gets two consecutive frames and fold them into an unique framing, doing interlacing. While this works fine for TV images, this produces two bad effects with webcams: 1) webcam images are progressive. Merging two consecutive images produce interlacing artifacts on the image; 2) since the driver needs to get two frames, it reduces the maximum frame rate by two. Signed-off-by: Mauro Carvalho Chehab commit d594317bdc716ccd8c8cf711e3827f9b6e0b766b Author: Mauro Carvalho Chehab Date: Fri Aug 7 12:13:31 2009 -0300 V4L/DVB (12403): em28xx: properly reports some em2710 chips As reported by hermann pitton , some devices has a different chip id for em2710 (likely the older ones): em28xx: New device @ 480 Mbps (eb1a:2710, interface 0, class 0) em28xx #0: Identified as EM2710/EM2750/EM2751 webcam grabber (card=22) em28xx #0: em28xx chip ID = 17 Signed-off-by: Mauro Carvalho Chehab commit 9b4e845c6cbca2bcbfdb87e4d005260604226f45 Author: Mauro Carvalho Chehab Date: Fri Aug 7 12:08:02 2009 -0300 V4L/DVB (12402): em28xx: fix: some em2710 chips use a different vendor ID Thanks to hermann pitton for pointing this new variation. Tested-by: hermann pitton Signed-off-by: Mauro Carvalho Chehab commit 2526ea6e46e41322eb98ac0e9c616273402bd661 Author: Mauro Carvalho Chehab Date: Fri Aug 7 01:09:54 2009 -0300 V4L/DVB (12401): m9v011: add vflip/hflip controls to control mirror/upside down Signed-off-by: Mauro Carvalho Chehab commit d96ecda63f41350dc93c17ccb72ea24511f207a9 Author: Mauro Carvalho Chehab Date: Thu Aug 6 21:53:59 2009 -0300 V4L/DVB (12400): em28xx: Allow changing fps on webcams em28xx doesn't have temporal scaling. However, on webcams, sensors are capable of changing the output rate. So, VIDIOC_[G|S]_PARM ioctls should be passed to the sensor for it to properly set frame rate. Signed-off-by: Mauro Carvalho Chehab commit 83053f7fe3eb0b6b1634d24ede87f1daa01ae60c Author: Mauro Carvalho Chehab Date: Thu Aug 6 21:03:35 2009 -0300 V4L/DVB (12399): mt9v011: Add support for controlling frame rates Implement g_parm/s_parm ioctls. Those are used to check the current frame rate (in fps) and to set it to a value. In practice, there are only 15 possible different speeds, due to chip limits. Signed-off-by: Mauro Carvalho Chehab commit 93b999239c418cf5c668fd966ac2c5c27b8180dd Author: Devin Heitmueller Date: Mon Aug 3 22:52:59 2009 -0300 V4L/DVB (12394): cx88: Disable xc3028 power management for Geniatech x8000 A user discovered that the Geniatech x8000 encountered a regression when the xc3028 power management was introduced. The xc3028 never recovers after setting the powerdown register, which is probably because the xc3028 reset GPIO is not properly configured. Since I do not have access to the hardware and thus cannot determine the correct GPIO configuration, just disable xc3028 power management on this board, which fixes the regression. Thanks to user "ritec" for reporting the issue and testing the fix. Cc: rictec Signed-off-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab commit 11db906983fc6e996fcd10073843bd6f1b9a96c3 Author: Devin Heitmueller Date: Mon Aug 3 22:40:16 2009 -0300 V4L/DVB (12393): cx88: fix regression in tuning for Geniatech X8000 MT The introduction of the zl10353 i2c gate control broke support for the Geniatech board (which is not behind an i2 gate). Add the needed parameter. Signed-off-by: Devin Heitmueller Signed-off-by: Mauro Carvalho Chehab commit 0e316ecfc851c8dd955d9fa6e0d3a46e451a46f4 Author: Michael Krufky Date: Mon Aug 3 16:51:33 2009 -0300 V4L/DVB (12391): saa7134: Use correct product name for Hauppauge WinTV-HVR1120 DVB-T/Hybrid Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit b5f05064b556da5183adc383e5f8d50af0392849 Author: Michael Krufky Date: Mon Aug 3 16:51:33 2009 -0300 V4L/DVB (12390): saa7134: Use correct product name for Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 79a6382551507ce196c3b4296e32b5386cdfbf15 Author: Michael Krufky Date: Sun Aug 2 12:37:34 2009 -0300 V4L/DVB (12386): sms1xxx: fix build warning: unused variable 'board' Remove the following build warning: sms-cards.c: In function 'sms_board_event': sms-cards.c:120: warning: unused variable 'board' Thanks to Hans Verkuil for pointing this out. The problem code has been #if 0'd for now, this will likely be used again in the future, once the event interface is complete. Cc: Hans Verkuil Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit bd0232c13419b7ce51e02942082ff6af231e0f84 Author: Laurent Pinchart Date: Sat Aug 1 18:14:24 2009 -0300 V4L/DVB (12380): uvcvideo: Avoid flooding the kernel log with "unknown event type" messages The iSight sends non-UVC status events through the interrupt endpoint. Those invalid events are reported to the kernel log, resulting in a log flood. Only log the events when the UVC_TRACE_STATUS flag is set. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit d79cd8393ae85ebaf53a8fc93491eea96522d68e Author: Laurent Pinchart Date: Sun Jul 19 19:16:05 2009 -0300 V4L/DVB (12328): uvcvideo: Don't apply the FIX_BANDWIDTH quirk to all ViMicro devices Commit 50144aeeb702ea105697ae5249f059ea3990b838 broke the Samsung NC10 netbook webcam. Instead of applying the FIX_BANDWIDTH quirk to all ViMicro devices, list the devices explicitly. Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit d1ae4e1d05cc982b6b480c1a3d69b8bb231e3493 Author: Michael Krufky Date: Sun Jul 12 18:25:45 2009 -0300 V4L/DVB (12374): sms1xxx: fix broken Hauppauge devices The current GPIO configuration breaks all Hauppauge devices. The code being removed affects Hauppauge devices only, and is the cause of the breakage. Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab commit 261982f17051d10a1054a77ec8ae13517e0acee2 Author: Brian Johnson Date: Sun Jul 19 15:58:56 2009 -0300 V4L/DVB (12373a): Add gspca sn9c20x subdriver entry to MAINTAINERS file MAINTAINERS | 8 ++++++++ Signed-off-by: Brian Johnson Acked-by: Jean-Francois Moine Signed-off-by: Mauro Carvalho Chehab commit ba1bc64272f0af668690ba2bf859b13172db7230 Author: Nils Kassube Date: Tue Jul 28 11:54:52 2009 -0300 V4L/DVB (12371): af9015: Fix for crash in dvb-usb-af9015 Moving BOOT fixes problem. Signed-off-by: Nils Kassube Acked-by: Antti Palosaari Signed-off-by: Douglas Schilling Landgraf Signed-off-by: Mauro Carvalho Chehab commit 6655be0f4f377d7e249219c6031c4be3533604a2 Author: Michael Krufky Date: Mon Jul 20 12:20:58 2009 -0300 V4L/DVB (12362): cx23885-417: fix manipulation of tvnorms Currently, the VIDIOC_S_STD ioctl just returns -EINVAL regardless of the norm passed. This patch sets cx23885_mpeg_template.tvnorms and cx23885_mpeg_template.current_norm so that the VIDIOC_S_STD will work. Thanks to Joseph Yasi for pointing this out, even though this particular fix was already pushed into a development repository, merge priority of this changeset has been escalated as a result of Joseph posting this identical patch. Signed-off-by: Michael Krufky Signed-off-by: Joseph A. Yasi Reviewed-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 337ab6d34f0be7cfbfb5ac8cb651276fc58aa20d Author: Sohail Syyed Date: Sun Jul 26 11:06:20 2009 -0300 V4L/DVB (12349): cx88: HVR1300 ensure switching from Encoder to DVB-T and back is reliable Current tip is broken and does not switch back to DVB-T correctly Signed-off-by: Sohail Syyed Signed-off-by: Steven Toth Signed-off-by: Mauro Carvalho Chehab commit 0a6e44d1beb30813f62ad376a31694e637858328 Author: Mauro Carvalho Chehab Date: Wed Jul 29 01:39:12 2009 -0300 V4L/DVB (12344): em28xx: fix support for Plextor ConvertX PX-TV100U This device uses msp34xx and uses 2.048 MHz frequency for I2S communication. Thanks to Angelo Cano for pointing the issues with this device and proposing an approach for fixing the issue. Tested-by: Angelo Cano Signed-off-by: Mauro Carvalho Chehab commit 458f9aa391efd34867f8cabac2e2f1af00cbc562 Author: Jan Nikitenko Date: Thu Jun 18 08:11:57 2009 -0300 V4L/DVB (12341): zl10353 and qt1010: fix stack corruption bug Fixes stack corruption bug present in dump_regs function of zl10353 and qt1010 drivers: the buffer buf was one byte smaller than required - there are 4 chars for address prefix, 16 * 3 chars for dump of 16 eeprom bytes per line and 1 byte for zero ending the string required, i.e. 53 bytes, but only 52 were provided. The one byte missing in stack based buffer buf can cause stack corruption possibly leading to kernel oops, as discovered originally with af9015 driver (af9015: fix stack corruption bug). Signed-off-by: Jan Nikitenko Signed-off-by: Mauro Carvalho Chehab commit 296544e15a7126373851abd40acc526b79b91432 Author: Mauro Carvalho Chehab Date: Mon Jul 27 08:24:29 2009 -0300 V4L/DVB (12340): mtv9v011: Add a missing chip version to the driver Some mt9v011 webcams report 0x8332 chip version, instead of 0x8243. From the revision history at the mt9v011 datasheet, it seems that the chip version has changed from the first release of the chip. Thanks-to hermann pitton for pointing this to me, on his tests with a Silvercrest webcam. Signed-off-by: Mauro Carvalho Chehab commit 225aeb1c5863bc92c6bb1f921e9a6cf4d15dbb2a Author: Andy Walls Date: Thu Jul 23 21:51:29 2009 -0300 V4L/DVB (12338): cx18: Read buffer overflow This mistakenly tested against sizeof(freqs) instead of the array size. Due to the mask the only illegal value possible was 3. Reported-by: Roel Kluin Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit ed18d0c87ee0ab6e0985d83c19cd135b1bd54998 Author: Roel Kluin Date: Thu Jul 23 21:46:57 2009 -0300 V4L/DVB (12337): ivtv: Read buffer overflow This mistakenly tests against sizeof(freqs) instead of the array size. Due to the mask the only illegal value possible was 3. Signed-off-by: Roel Kluin Signed-off-by: Andy Walls Signed-off-by: Mauro Carvalho Chehab commit 5b766182a110311fbf618f736bc8a8f2f7ce3f4c Author: Antonio Ospite Date: Wed Jul 22 17:20:50 2009 -0300 V4L/DVB (12330): pxa_camera: Fix Oops in pxa_camera_probe mclk_get_divisor uses pcdev->soc_host.dev, make sure it is initialized. Signed-off-by: Antonio Ospite Signed-off-by: Guennadi Liakhovetski Signed-off-by: Mauro Carvalho Chehab commit 232e7d68d50c9ac3a55d716e5ae215ecd1e043b9 Author: Dhananjay Phadke Date: Thu Aug 13 07:03:01 2009 +0000 netxen: free napi resources during detach o Defer napi resouce allocation to device attach. o Free napi resources and delete napi during detach. This ensures right behavior across firmware reset. Signed-off-by: Dhananjay Phadke Signed-off-by: David S. Miller commit e424fa9d6a0add1a9b812b07e3607daaa5b9e53d Author: Amit Kumar Salecha Date: Thu Aug 13 07:03:00 2009 +0000 netxen: remove netxen workqueue o Remove private workqueue in the driver, move all scheduled tasks to keventd workqueues. This makes ports (interfaces) of same / different NIC boards independent, in terms of their link watchdog and reset tasks. o Move quick checks for link status and temperature in timer callback, schedule watchdog task only if link status changed or temperature reached critical threshold. This also fixes deadlock when thermal panic occurs, watchdog work was flushing workqueue that it was sitting on. Signed-off-by: Amit Kumar Salecha Signed-off-by: Dhananjay Phadke Signed-off-by: David S. Miller commit 237057ad3fe5644fa471be474a160de2fc2e5870 Author: Don Skidmore Date: Tue Aug 11 13:18:14 2009 +0000 ixgbe: fix issues setting rx-usecs with legacy interrupts Currently setting rx-usecs when the interface is in legacy interrupt mode it is not immediate. We were only setting EITR for each MSIx vector and since this count would be zero for legacy mode it wasn't set until after a reset. This patch corrects that by checking what mode we are in and then setting EITR accordingly. Signed-off-by: Don Skidmore Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 993e6f2fd487e2acddd711f79cf48f3420731382 Author: Oliver Hartkopp Date: Tue Aug 11 02:41:24 2009 +0000 can: fix oops caused by wrong rtnl newlink usage For 'real' hardware CAN devices the netlink interface is used to set CAN specific communication parameters. Real CAN hardware can not be created with the ip tool ... The invocation of 'ip link add type can' lead to an oops as the standard rtnl newlink function was called: http://bugzilla.kernel.org/show_bug.cgi?id=13954 This patch adds a private newlink function for the CAN device driver interface that unconditionally returns -EOPNOTSUPP. Signed-off-by: Oliver Hartkopp Reported-by: Dmitry Eremin-Solenikov CC: Patrick McHardy CC: Wolfgang Grandegger Signed-off-by: David S. Miller commit 64f1607ffbbc772685733ea63e6f7f4183df1b16 Author: Linus Torvalds Date: Thu Aug 13 15:43:34 2009 -0700 Linux 2.6.31-rc6 commit f9b14c9183b250cf128c7d2341e6b9bdbbcd8f35 Author: Kashyap, Desai Date: Fri Aug 7 19:39:59 2009 +0530 [SCSI] mpt2sas: Bump driver version 01.100.04.00 Bump version to 01.100.04.00 Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit fcfe6392d18283df3c561b5ef59c330d485ff8ca Author: Kashyap, Desai Date: Fri Aug 7 19:38:48 2009 +0530 [SCSI] mpt2sas: fix oops because drv data points to NULL on resume from hibernate Fix another ocurring when the system resumes. This oops was due to driver setting the pci drvdata to NULL on the prior hibernation. Becuase it was set to NULL, upon resmume we assume the pci drvdata is non-zero, and we oops. To fix the ooops, we don't set pci drvdata to NULL at hibernation time. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit e4750c989f732555fca86dd73d488c79972362db Author: Kashyap, Desai Date: Fri Aug 7 19:37:59 2009 +0530 [SCSI] mpt2sas: fix crash due to Watchdog is active while OS in standby mode Fix oops ocurring at hibernation time. This oops was due to the firmware fault watchdog timer still running after we freed resources. To fix the issue we need to terminate the watchdog timer at hibernation time. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 6bd4e1e4d6023f4da069fd68729c502cc4e6dfd0 Author: Kashyap, Desai Date: Fri Aug 7 19:37:14 2009 +0530 [SCSI] mpt2sas: fix infinite loop inside config request This restriction is introduced just to avoid loop of config_request. Retry must be limited so we have restricted config request to maximum 2 times. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit be9e8cd75ce8d94ae4aab721fdcc337fa78a9090 Author: Kashyap, Desai Date: Fri Aug 7 19:36:43 2009 +0530 [SCSI] mpt2sas: Excessive log info causes sas iounit page time out Inhibit 0x3117 loginfos - during cable pull, there are too many printks going to the syslog, this is have impact on how fast the interrupt routine can handle keeping up with command completions; this was the root cause to the config pages timeouts. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 62727a7ba43c0abf2673e3877079c136a9721792 Author: Kashyap, Desai Date: Fri Aug 7 19:35:18 2009 +0530 [SCSI] mpt2sas: Raid 10 Value is showing as Raid 1E in /va/log/messages When a volume is activated, the driver will recieve a pair of ir config change events to remove the foreign volume, then add the native. In the process of the removal event, the hidden raid componet is removed from the parent.When the disks is added back, the adding of the port fails becuase there is no instance of the device in its parent. To fix this issue, the driver needs to call mpt2sas_transport_update_links() prior to calling _scsih_add_device. In addition, we added sanity checks on volume add and removal to ignore events for foreign volumes. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 20f5895d55d9281830bfb7819c5c5b70b05297a6 Author: Kashyap, Desai Date: Fri Aug 7 19:34:26 2009 +0530 [SCSI] mpt2sas: Expander fix oops saying "Already part of another port" Kernel panic is seen because driver did not tear down the port which should be dnoe using mpt2sas_transport_port_remove(). without this fix When expander is added back we would oops inside sas_port_add_phy. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 15052c9e85bf0cdadcb69eb89623bf12bad8b4f8 Author: Kashyap, Desai Date: Fri Aug 7 19:33:17 2009 +0530 [SCSI] mpt2sas: Introduced check for enclosure_handle to avoid crash Kernel panic is seen because of enclosure_handle received from FW is zero. Check is introduced before calling mpt2sas_config_get_enclosure_pg0. Signed-off-by: Kashyap Desai Signed-off-by: James Bottomley commit 2d860ad76f4ee4d2eba0fe3797c8d7cdce432cc0 Author: Linus Torvalds Date: Thu Aug 13 13:05:10 2009 -0700 genirq: prevent wakeup of freed irq thread free_irq() can remove an irqaction while the corresponding interrupt is in progress, but free_irq() sets action->thread to NULL unconditionally, which might lead to a NULL pointer dereference in handle_IRQ_event() when the hard interrupt context tries to wake up the handler thread. Prevent this by moving the thread stop after synchronize_irq(). No need to set action->thread to NULL either as action is going to be freed anyway. This fixes a boot crash reported against preempt-rt which uses the mainline irq threads code to implement full irq threading. [ tglx: removed local irqthread variable ] Signed-off-by: Linus Torvalds Signed-off-by: Thomas Gleixner commit 3493e84de60590d3012139187f631f2dfbf0887f Merge: 919aa96 94d5d1b Author: Linus Torvalds Date: Thu Aug 13 12:24:33 2009 -0700 Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf_counter: Report the cloning task as parent on perf_counter_fork() perf_counter: Fix an ipi-deadlock perf: Rework/fix the whole read vs group stuff perf_counter: Fix swcounter context invariance perf report: Don't show unresolved DSOs and symbols when -S/-d is used perf tools: Add a general option to enable raw sample records perf tools: Add a per tracepoint counter attribute to get raw sample perf_counter: Provide hw_perf_counter_setup_online() APIs perf list: Fix large list output by using the pager perf_counter, x86: Fix/improve apic fallback perf record: Add missing -C option support for specifying profile cpu perf tools: Fix dso__new handle() to handle deleted DSOs perf tools: Fix fallback to cplus_demangle() when bfd_demangle() is not available perf report: Show the tid too in -D perf record: Fix .tid and .pid fill-in when synthesizing events perf_counter, x86: Fix generic cache events on P6-mobile CPUs perf_counter, x86: Fix lapic printk message commit 919aa96a9cfc5071f037bf58718e05335562a6ac Merge: 1c2ffff 392741e Author: Linus Torvalds Date: Thu Aug 13 12:09:16 2009 -0700 Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: futex: Fix handling of bad requeue syscall pairing futex: Fix compat_futex to be same as futex for REQUEUE_PI locking, sched: Give waitqueue spinlocks their own lockdep classes futex: Update futex_q lock_ptr on requeue proxy lock commit 1c2ffff407140adf75bb72ae375688480793a228 Merge: bc7af9b e805513 Author: Linus Torvalds Date: Thu Aug 13 12:08:44 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Fix oops in identify_cpu() on CPUs without CPUID x86: Clear incorrectly forced X86_FEATURE_LAHF_LM flag x86, mce: therm_throt - change when we print messages x86: Add reboot quirk for every 5 series MacBook/Pro commit 416fbdff2137e8d8cc8f23f517bee3a26b11526f Author: Luis R. Rodriguez Date: Tue Aug 11 13:10:33 2009 -0700 mac80211: fix panic when splicing unprepared TIDs We splice skbs from the pending queue for a TID onto the local pending queue when tearing down a block ack request. This is not necessary unless we actually have received a request to start a block ack request (rate control, for example). If we never received that request we should not be splicing the tid pending queue as it would be null, causing a panic. Not sure yet how exactly we allowed through a call when the tid state does not have at least HT_ADDBA_REQUESTED_MSK set, that will require some further review as it is not quite obvious. For more information see the bug report: http://bugzilla.kernel.org/show_bug.cgi?id=13922 This fixes this oops: BUG: unable to handle kernel NULL pointer dereference at 00000030 IP: [] ieee80211_agg_splice_packets+0x40/0xc0 [mac80211] *pdpt = 0000000002d1e001 *pde = 0000000000000000 Thread overran stack, or stack corrupted Oops: 0000 [#1] SMP last sysfs file: /sys/module/aes_generic/initstate Modules linked in: Pid: 0, comm: swapper Not tainted (2.6.31-rc5-wl #2) Dell DV051 EIP: 0060:[] EFLAGS: 00010292 CPU: 0 EIP is at ieee80211_agg_splice_packets+0x40/0xc0 [mac80211] EAX: 00000030 EBX: 0000004c ECX: 00000003 EDX: 00000000 ESI: c1c98000 EDI: f745a1c0 EBP: c076be58 ESP: c076be38 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process swapper (pid: 0, ti=c076a000 task=c0709160 task.ti=c076a000) Stack: Call Trace: [] ? ieee80211_stop_tx_ba_cb+0xab/0x150 [mac80211] [] ? ieee80211_tasklet_handler+0xce/0x110 [mac80211] [] ? net_rx_action+0xef/0x1d0 [] ? tasklet_action+0x58/0xc0 [] ? __do_softirq+0xc2/0x190 [] ? handle_IRQ_event+0x58/0x140 [] ? ack_apic_level+0x7e/0x270 [] ? do_softirq+0x3d/0x40 [] ? irq_exit+0x65/0x90 [] ? do_IRQ+0x4f/0xc0 [] ? irq_exit+0x7d/0x90 [] ? smp_apic_timer_interrupt+0x57/0x90 [] ? common_interrupt+0x29/0x30 [] ? mwait_idle+0xbe/0x100 [] ? cpu_idle+0x52/0x90 [] ? rest_init+0x55/0x60 [] ? start_kernel+0x315/0x37d [] ? unknown_bootoption+0x0/0x1f9 [] ? i386_start_kernel+0x79/0x81 Code: EIP: [] ieee80211_agg_splice_packets+0x40/0xc0 [mac80211] SS:ESP 0068:c076be38 CR2: 0000000000000030 Cc: stable@kernel.org Testedy-by: Jack Lau Signed-off-by: Luis R. Rodriguez Signed-off-by: John W. Linville commit bc7af9ba154f648598bf92b391e446e31b09330a Merge: d58d2d1 b409d7a Author: Linus Torvalds Date: Thu Aug 13 11:17:40 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2 * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: (22 commits) ocfs2: Fix possible deadlock when extending quota file ocfs2: keep index within status_map[] ocfs2: Initialize the cluster we're writing to in a non-sparse extend ocfs2: Remove redundant BUG_ON in __dlm_queue_ast() ocfs2/quota: Release lock for error in ocfs2_quota_write. ocfs2: Define credit counts for quota operations ocfs2: Remove syncjiff field from quota info ocfs2: Fix initialization of blockcheck stats ocfs2: Zero out padding of on disk dquot structure ocfs2: Initialize blocks allocated to local quota file ocfs2: Mark buffer uptodate before calling ocfs2_journal_access_dq() ocfs2: Make global quota files blocksize aligned ocfs2: Use ocfs2_rec_clusters in ocfs2_adjust_adjacent_records. ocfs2: Fix deadlock on umount ocfs2: Add extra credits and access the modified bh in update_edge_lengths. ocfs2: Fail ocfs2_get_block() immediately when a block needs allocation ocfs2: Fix error return in ocfs2_write_cluster() ocfs2: Fix compilation warning for fs/ocfs2/xattr.c ocfs2: Initialize count in aio_write before generic_write_checks ocfs2: log the actual return value of ocfs2_file_aio_write() ... commit d58d2d1adec90e7bc0c56e09b3ac0e9a5a471e68 Merge: 7334219 4d484a4 Author: Linus Torvalds Date: Thu Aug 13 10:59:29 2009 -0700 Merge branch 'for-linus' of git://neil.brown.name/md * 'for-linus' of git://neil.brown.name/md: md: allow upper limit for resync/reshape to be set when array is read-only md/raid5: Properly remove excess drives after shrinking a raid5/6 md/raid5: make sure a reshape restarts at the correct address. md/raid5: allow new reshape modes to be restarted in the middle. md: never advance 'events' counter by more than 1. Remove deadlock potential in md_open commit 7334219c44826ae0ebe6f07555c6b97f978ce266 Merge: e694958 dbefd60 Author: Linus Torvalds Date: Thu Aug 13 10:57:53 2009 -0700 Merge branch 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 * 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: fix i2c init order on ap325rxa V2 sh: fix i2c init order on Migo-R V2 sh: convert processor device setup functions to arch_initcall() commit e694958388c50148389b0e9b9e9e8945cf0f1b98 Author: Linus Torvalds Date: Thu Aug 13 08:28:36 2009 -0700 Make sock_sendpage() use kernel_sendpage() kernel_sendpage() does the proper default case handling for when the socket doesn't have a native sendpage implementation. Now, arguably this might be something that we could instead solve by just specifying that all protocols should do it themselves at the protocol level, but we really only care about the common protocols. Does anybody really care about sendpage on something like Appletalk? Not likely. Acked-by: David S. Miller Acked-by: Julien TINNES Acked-by: Tavis Ormandy Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 94d5d1b2d891f1fd5205f978246b7864d998b25c Author: Peter Zijlstra Date: Thu Aug 13 16:14:42 2009 +0200 perf_counter: Report the cloning task as parent on perf_counter_fork() A bug in (9f498cc: perf_counter: Full task tracing) makes profiling multi-threaded apps it go belly up. [ output as: (PID:TID):(PPID:PTID) ] # ./perf report -D | grep FORK 0x4b0 [0x18]: PERF_EVENT_FORK: (3237:3237):(3236:3236) 0xa10 [0x18]: PERF_EVENT_FORK: (3237:3238):(3236:3236) 0xa70 [0x18]: PERF_EVENT_FORK: (3237:3239):(3236:3236) 0xad0 [0x18]: PERF_EVENT_FORK: (3237:3240):(3236:3236) 0xb18 [0x18]: PERF_EVENT_FORK: (3237:3241):(3236:3236) Shows us that the test (27d028d perf report: Update for the new FORK/EXIT events) in builtin-report.c: /* * A thread clone will have the same PID for both * parent and child. */ if (thread == parent) return 0; Will clearly fail. The problem is that perf_counter_fork() reports the actual parent, instead of the cloning thread. Fixing that (with the below patch), yields: # ./perf report -D | grep FORK 0x4c8 [0x18]: PERF_EVENT_FORK: (1590:1590):(1589:1589) 0xbd8 [0x18]: PERF_EVENT_FORK: (1590:1591):(1590:1590) 0xc80 [0x18]: PERF_EVENT_FORK: (1590:1592):(1590:1590) 0x3338 [0x18]: PERF_EVENT_FORK: (1590:1593):(1590:1590) 0x66b0 [0x18]: PERF_EVENT_FORK: (1590:1594):(1590:1590) Which both makes more sense and doesn't confuse perf report anymore. Reported-by: Pekka Enberg Signed-off-by: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: paulus@samba.org Cc: Anton Blanchard Cc: Arjan van de Ven LKML-Reference: <1250172882.5241.62.camel@twins> Signed-off-by: Ingo Molnar commit 970892a9031a5dc7217bd394fb9d89fa75a4a7bc Author: Peter Zijlstra Date: Thu Aug 13 11:47:54 2009 +0200 perf_counter: Fix an ipi-deadlock perf_pending_counter() is called from IRQ context and will call perf_counter_disable(), however perf_counter_disable() uses smp_call_function_single() which doesn't fancy being used with IRQs disabled due to IPI deadlocks. Fix this by making it use the local __perf_counter_disable() call and teaching the counter_sched_out() code about pending disables as well. This should cover the case where a counter migrates before the pending queue gets processed. Signed-off-by: Peter Zijlstra Cc: Corey J Ashford Cc: Paul Mackerras Cc: stephane eranian LKML-Reference: <20090813103655.244097721@chello.nl> Signed-off-by: Ingo Molnar commit 3dab77fb1bf89664bb1c9544607159dcab6f7d57 Author: Peter Zijlstra Date: Thu Aug 13 11:47:53 2009 +0200 perf: Rework/fix the whole read vs group stuff Replace PERF_SAMPLE_GROUP with PERF_SAMPLE_READ and introduce PERF_FORMAT_GROUP to deal with group reads in a more generic way. This allows you to get group reads out of read() as well. Signed-off-by: Peter Zijlstra Cc: Corey J Ashford Cc: Paul Mackerras Cc: stephane eranian LKML-Reference: <20090813103655.117411814@chello.nl> Signed-off-by: Ingo Molnar commit bcfc2602e8541ac13b1def38e2591dca072cff7a Author: Peter Zijlstra Date: Thu Aug 13 09:51:55 2009 +0200 perf_counter: Fix swcounter context invariance perf_swcounter_is_counting() uses a lock, which means we cannot use swcounters from NMI or when holding that particular lock, this is unintended. The below removes the lock, this opens up race window, but not worse than the swcounters already experience due to RCU traversal of the context in perf_swcounter_ctx_event(). This also fixes the hard lockups while opening a lockdep tracepoint counter. Signed-off-by: Peter Zijlstra Acked-by: Frederic Weisbecker Cc: Paul Mackerras Cc: stephane eranian Cc: Corey J Ashford LKML-Reference: <1250149915.10001.66.camel@twins> Signed-off-by: Ingo Molnar commit 8fd101f20bdf771949a8f3a5a779877d09b2fb56 Author: Arnaldo Carvalho de Melo Date: Wed Aug 12 18:19:57 2009 -0300 perf report: Don't show unresolved DSOs and symbols when -S/-d is used We're interested in just those symbols/DSOs, so filter out the unresolved ones. Signed-off-by: Arnaldo Carvalho de Melo Cc: Peter Zijlstra LKML-Reference: <20090812211957.GE3495@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 3b3119fc549c93df60316d28bdd77c2de3986588 Merge: 96a4d1e dee2b90 Author: Russell King Date: Thu Aug 13 09:55:38 2009 +0100 Merge branch 'ixp4xx-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/chris/linux-2.6 commit daac07b2e6b77f1bd44104aa2f0593e5505f27d4 Author: Frederic Weisbecker Date: Thu Aug 13 10:27:19 2009 +0200 perf tools: Add a general option to enable raw sample records While we can enable the perf sample records per tracepoint counter, we may also want to enable this option for every tracepoint counters to open, so that we don't need to add a :record flag for all of them. Add the -R, --raw-samples options for this purpose. Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1250152039-7284-2-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit 3a9f131fb00b8ac5950a11ad1599e45edfb5ae44 Author: Frederic Weisbecker Date: Thu Aug 13 10:27:18 2009 +0200 perf tools: Add a per tracepoint counter attribute to get raw sample Add a new flag field while opening a tracepoint perf counter: -e tracepoint_subsystem:tracepoint_name:flags This is intended to be generic although for now it only supports the r[e[c[o[r[d]]]]] flag: ./perf record -e workqueue:workqueue_insertion:record ./perf record -e workqueue:workqueue_insertion:r will have the same effect: enabling the raw samples record for the given tracepoint counter. In the future, we may want to support further flags, separated by commas. Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1250152039-7284-1-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit 28402971d869e26271b25301011f667d3a5640c3 Author: Ingo Molnar Date: Thu Aug 13 10:13:22 2009 +0200 perf_counter: Provide hw_perf_counter_setup_online() APIs Provide weak aliases for hw_perf_counter_setup_online(). This is used by the BTS patches (for v2.6.32), but it interacts with fixes so propagate this upstream. (it has no effect as of yet) Also export perf_counter_output() to architecture code. Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit 8f7a0dc51674ad0dd06155291b0aed60d655943c Author: Arnaldo Carvalho de Melo Date: Wed Aug 12 14:44:59 2009 -0300 perf list: Fix large list output by using the pager When /sys/kernel/debug is mounted the list can be imense, so use the pager like the other tools. Signed-off-by: Arnaldo Carvalho de Melo Acked-by: Frederic Weisbecker Cc: Peter Zijlstra LKML-Reference: <20090812174459.GB3495@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 839d1624b9dcf31fdc02e47359043bb7bd71d6ca Author: Francois Romieu Date: Wed Aug 12 22:18:14 2009 -0700 8139cp: balance dma_map_single vs dma_unmap_single pair The driver always: 1. allocate cp->rx_buf_sz + NET_IP_ALIGN 2. map cp->rx_buf_sz Signed-off-by: Francois Romieu Signed-off-by: David S. Miller commit dbefd606a3b3634799b625f4900336e61c89e868 Author: Magnus Damm Date: Fri Aug 7 03:52:18 2009 +0000 sh: fix i2c init order on ap325rxa V2 Convert the AP325RXA board code to register devices at arch_initcall() time instead of device_initcall(). This fix unbreaks pcf8563 RTC driver support. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit ba3a17019181af5d6ab898760620c4e9916396c2 Author: Magnus Damm Date: Thu Aug 13 11:39:02 2009 +0900 sh: fix i2c init order on Migo-R V2 Convert the Migo-R board code to register devices at arch_initcall() time instead of __initcall(). This fix unbreaks migor_ts touch screen driver support. Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit ba9a633787eed1e90d587282642580ad3d44f7fd Author: Magnus Damm Date: Wed Jul 22 15:14:29 2009 +0000 sh: convert processor device setup functions to arch_initcall() Convert the processor platform device setup functions from __initcall() and sometimes device_initcall() to arch_initcall(). This makes sure that the platform devices are registered a bit earlier so the devices are available when drivers register using initcall levels earlier than device_initcall(). A good example is platform devices needed by i2c-sh_mobile.c which registers a bit earlier using subsys_initcall(). Signed-off-by: Magnus Damm Signed-off-by: Paul Mundt commit 4d484a4a7a5126410eed5f8dd329a33f6eeed068 Author: NeilBrown Date: Thu Aug 13 10:41:50 2009 +1000 md: allow upper limit for resync/reshape to be set when array is read-only Normally we only allow the upper limit for a reshape to be decreased when the array not performing a sync/recovery/reshape, otherwise there could be races. But if an array is part-way through a reshape when it is assembled the reshape is started immediately leaving no window to set an upper bound. If the array is started read-only, the reshape will be suspended until the array becomes writable, so that provides a window during which it is perfectly safe to reduce the upper limit of a reshape. So: allow the upper limit (sync_max) to be reduced even if the reshape thread is running, as long as the array is still read-only. Signed-off-by: NeilBrown commit 1a67dde0abba36421a1257d01ba9de2f6d1c160a Author: NeilBrown Date: Thu Aug 13 10:41:49 2009 +1000 md/raid5: Properly remove excess drives after shrinking a raid5/6 We were removing the drives, from the array, but not removing symlinks from /sys/.... and not marking the device as having been removed. Signed-off-by: NeilBrown commit 9799218ae36910af50f002a5db1802d576fffb43 Author: David S. Miller Date: Wed Aug 12 17:37:52 2009 -0700 Revert "libertas: Read buffer overflow" This reverts commit 57921c312e8cef72ba35a4cfe870b376da0b1b87. On request from John Linville: It has been shown to create a new problem. There is work towards a solution to that one, but it isn't a simple clean-up. Signed-off-by: David S. Miller commit a639755cf885e437b2fe4168d35157fa90d530ab Author: NeilBrown Date: Thu Aug 13 10:13:00 2009 +1000 md/raid5: make sure a reshape restarts at the correct address. This "if" don't allow for the possibility that the number of devices doesn't change, and so sector_nr isn't set correctly in that case. So change '>' to '>='. Signed-off-by: NeilBrown commit 67ac6011db5d2b0c853d573ff474b25c85dfb644 Author: NeilBrown Date: Thu Aug 13 10:06:24 2009 +1000 md/raid5: allow new reshape modes to be restarted in the middle. md/raid5 doesn't allow a reshape to restart if it involves writing over the same part of disk that it would be reading from. This happens at the beginning of a reshape that increases the number of devices, at the end of a reshape that decreases the number of devices, and continuously for a reshape that does not change the number of devices. The current code is correct for the "increase number of devices" case as the critical section at the start is handled by userspace performing a backup. It does not work for reducing the number of devices, or the no-change case. For 'reducing', we need to invert the test. For no-change we cannot really be sure things will be safe, so simply require the array to be read-only, which is how the user-space code which carefully starts such arrays works. Signed-off-by: NeilBrown commit 51d5668cb2e3fd1827a55184e48606fff054c5be Author: NeilBrown Date: Thu Aug 13 09:54:02 2009 +1000 md: never advance 'events' counter by more than 1. When assembling arrays, md allows two devices to have different event counts as long as the difference is only '1'. This is to cope with a system failure between updating the metadata on two difference devices. However there are currently times when we update the event count by 2. This was done to keep the event count even when the array is clean and odd when it is dirty, which allows us to avoid writing common update to spare devices and so allow those spares to go to sleep. This is bad for the above reason. So change it to never increase by two. This means that the alignment between 'odd/even' and 'clean/dirty' might take a little longer to attain, but that is only a small cost. The spares will get a few more updates but that will still be spared (;-) most updates and can still go to sleep. Prior to this patch there was a small chance that after a crash an array would fail to assemble due to the overly large event count mismatch. Signed-off-by: NeilBrown commit a3620f7545344f932873bf98fbdf416b49409c8e Merge: 78efd1d 39cbb60 Author: Linus Torvalds Date: Wed Aug 12 09:55:46 2009 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block * 'for-linus' of git://git.kernel.dk/linux-2.6-block: Remove double removal of blktrace directory commit 39cbb602b543e477df71dca84b5b2e36f8bd29fc Author: Alan D. Brunelle Date: Fri Aug 7 12:01:08 2009 -0400 Remove double removal of blktrace directory commit fd51d251e4cdb21f68e9dbc4336514d64a105a79 Author: Stefan Raspl Date: Tue May 19 09:59:08 2009 +0200 blktrace: remove debugfs entries on bad path added in an explicit invocation of debugfs_remove for bt->dir, in blk_remove_buf_file_callback we are also getting the directory removed. On occasion I am seeing memory corruption that I have bisected down to this commit. [The testing involves a (long) series of I/O benchmarks with blktrace invoked around the actual runs.] I believe that this committed patch is correct, but the problem actually lies in the code in blk_remove_buf_file_callback. With this patch I am able to consistently get complete runs whereas previously I could not get a single run to complete. The first part of the patch simply moves the debugfs_remove below the relay_close: the relay_close call will remove files under bt->dir, and so we should not remove the directory until all the files we created have been removed. (Note: This is not sufficient to fix the problem - the file system code has ref counts on the directoy, so our invocation does not cause the directory to actually be removed. Nonetheless, we should not rely upon that feature.) Signed-off-by: Alan D. Brunelle Signed-off-by: Jens Axboe commit 78efd1ddd95d2fac1ed8d5fadd9dab885ea70e55 Merge: b637dc0 a8914f3 Author: Linus Torvalds Date: Wed Aug 12 08:49:35 2009 -0700 Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs * 'for-linus' of git://oss.sgi.com/xfs/xfs: xfs: fix spin_is_locked assert on uni-processor builds xfs: check for dinode realtime flag corruption use XFS_CORRUPTION_ERROR in xfs_btree_check_sblock xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_get xfs: switch to NOFS allocation under i_lock in xfs_readlink_bmap xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_set xfs: switch to NOFS allocation under i_lock in xfs_buf_associate_memory xfs: switch to NOFS allocation under i_lock in xfs_dir_cilookup_result xfs: switch to NOFS allocation under i_lock in xfs_da_buf_make xfs: switch to NOFS allocation under i_lock in xfs_da_state_alloc xfs: switch to NOFS allocation under i_lock in xfs_getbmap xfs: avoid memory allocation under m_peraglock in growfs code commit b637dc0dba6a243da2c74f5d02b42ba5eeb9425e Merge: 42c5c84 8884be9 Author: Linus Torvalds Date: Wed Aug 12 08:32:47 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: ALSA: hda - Don't override ADC definitions for ALC codecs ALSA: hda - Add missing vmaster initialization for ALC269 ASoC: Add missing DRV_NAME definitions for fsl/* drivers commit 42c5c8435e8b7da4684607587d2c882d464cfc7d Merge: 9256a2d 67fe068 Author: Linus Torvalds Date: Wed Aug 12 08:29:32 2009 -0700 Merge branch 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6 * 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6: Remove zero-length file drivers/mtd/maps/sbc8240.c commit 9256a2d0b1a36906656405adf564f03ab2d2f3e9 Merge: 1ae88b2 5594639 Author: Linus Torvalds Date: Wed Aug 12 08:24:17 2009 -0700 Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev: ahci: add workaround for on-board 5723s on some gigabyte boards ahci: Soften up the dmesg on SB600 PMP softreset failure recovery Documentation/kernel-parameters.txt: document libata's ignore_hpa option sata_nv: MSI support, disabled by default libata: OCZ Vertex can't do HPA pata_atiixp: fix second channel support pata_at91: fix resource release commit 1ae88b2e446261c038f2c0c3150ffae142b227a2 Author: Trond Myklebust Date: Wed Aug 12 09:12:30 2009 -0400 NFS: Fix an O_DIRECT Oops... We can't call nfs_readdata_release()/nfs_writedata_release() without first initialising and referencing args.context. Doing so inside nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment() causes an Oops. We should rather be calling nfs_readdata_free()/nfs_writedata_free() in those cases. Looking at the O_DIRECT code, the "struct nfs_direct_req" is already referencing the nfs_open_context for us. Since the readdata and writedata structures carry a reference to that, we can simplify things by getting rid of the extra nfs_open_context references, so that we can replace all instances of nfs_readdata_release()/nfs_writedata_release(). Reported-by: Catalin Marinas Signed-off-by: Trond Myklebust Tested-by: Catalin Marinas Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit 04da8a43da804723a550f00dd158fd5b5e25ae35 Author: Ingo Molnar Date: Tue Aug 11 10:40:08 2009 +0200 perf_counter, x86: Fix/improve apic fallback Johannes Stezenbach reported that his Pentium-M based laptop does not have the local APIC enabled by default, and hence perfcounters do not get initialized. Add a fallback for this case: allow non-sampled counters and return with an error on sampled counters. This allows 'perf stat' to work out of box - and allows 'perf top' and 'perf record' to fall back on a hrtimer based sampling method. ( Passing 'lapic' on the boot line will allow hardware sampling to occur - but if the APIC is disabled permanently by the hardware then this fallback still allows more systems to use perfcounters. ) Also decouple perfcounter support from X86_LOCAL_APIC. -v2: fix typo breaking counters on all other systems ... Reported-by: Johannes Stezenbach Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit 0a5ac84650fb7a7f226814103d95724e34b012ae Author: Jens Axboe Date: Wed Aug 12 11:18:01 2009 +0200 perf record: Add missing -C option support for specifying profile cpu perf top supports a -C for setting the profile CPU, but perf record does not. This adds the same option for perf record, allowing the user to specify a specific target profile CPU. Signed-off-by: Jens Axboe Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: <20090812091801.GC12579@kernel.dk> Signed-off-by: Ingo Molnar commit 1340e6bbaff7ff7f6f75eb4a5c34933efce84a84 Author: Arnaldo Carvalho de Melo Date: Tue Aug 11 17:04:36 2009 -0300 perf tools: Fix dso__new handle() to handle deleted DSOs It is better than showing the map addr, this way at least we know that we can't get the symtabs because the DSO was deleted (system update) while an app still used such DSO. Yeah, don't do that, but if you do, you'll figure it out quicker this way. [acme@doppio linux-2.6-tip]$ perf report | head -15 # Samples: 3796 # # Overhead Command Shared Object Symbol # ........ ....... ................................................................... ...... # 23.55% pidgin /lib64/libglib-2.0.so.0.2000.4.#prelink#.Pd98lu (deleted) [.] 0x00000000038844 21.55% pidgin /lib64/libpthread-2.10.1.so.#prelink#.AFwK8Q (deleted) [.] 0x0000000000a42d 10.85% pidgin [kernel] [.] vread_hpet 7.85% pidgin /lib64/libgobject-2.0.so.0.2000.4.#prelink#.o1vpU7 (deleted) [.] 0x00000000014de8 3.35% pidgin /lib64/libc-2.10.1.so (deleted) [.] 0x0000000007a875 3.19% pidgin /lib64/libdbus-1.so.3.4.0.#prelink#.6mwgZP (deleted) [.] 0x0000000001d254 3.06% pidgin /usr/lib64/libgtk-x11-2.0.so.0.1600.5.#prelink#.511hAl (deleted) [.] 0x000000002334e7 2.90% pidgin /usr/lib64/libgdk-x11-2.0.so.0.1600.5.#prelink#.5qlMo1 (deleted) [.] 0x00000000037b2d 1.84% pidgin [kernel] [k] do_sys_poll 1.45% pidgin /usr/lib64/libX11.so.6.2.0.#prelink#.iR59Rx (deleted) [.] 0x0000000004c751 [acme@doppio linux-2.6-tip]$ Signed-off-by: Arnaldo Carvalho de Melo Cc: Luis Claudio R. Gonçalves Cc: Clark Williams Cc: H. Peter Anvin Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Frédéric Weisbecker LKML-Reference: <20090811200436.GA3478@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 247648e3742ded01e42a4b14c2da330b13cbb47f Author: Arnaldo Carvalho de Melo Date: Tue Aug 11 16:22:11 2009 -0300 perf tools: Fix fallback to cplus_demangle() when bfd_demangle() is not available In old binutils we can't access bfd_demangle(), use cplus_demangle() just like oprofile. Signed-off-by: Arnaldo Carvalho de Melo Cc: Luis Claudio R. Gonçalves Cc: H. Peter Anvin Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Frédéric Weisbecker LKML-Reference: <20090811192211.GG18061@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 94a24752fe95ca1e7f98b197052d44e6a207740d Author: Arnaldo Carvalho de Melo Date: Tue Aug 11 16:21:38 2009 -0300 perf report: Show the tid too in -D This made it easier to find the firefox threading related bug. Signed-off-by: Arnaldo Carvalho de Melo Cc: "H. Peter Anvin" Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Frédéric Weisbecker LKML-Reference: <20090811192138.GE18061@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 2a8083f063472f27c253545dd64e1a7bbbb1ab61 Author: Arnaldo Carvalho de Melo Date: Tue Aug 11 16:22:00 2009 -0300 perf record: Fix .tid and .pid fill-in when synthesizing events Noticed when trying to record events for a firefox thread. We were synthesizing both .tid and .pid with the pid passed via --pid. Fix it by reading /proc/PID/status and getting the tgid to use in .pid, .tid gets the specified "pid". Signed-off-by: Arnaldo Carvalho de Melo Cc: "H. Peter Anvin" Cc: Frédéric Weisbecker Cc: Peter Zijlstra Cc: Mike Galbraith LKML-Reference: <20090811192200.GF18061@ghostprotocols.net> Signed-off-by: Ingo Molnar commit 67fe0688082509c52bd451d10a61b3565169c23e Author: Jeff Garzik Date: Wed Aug 12 06:29:57 2009 -0400 Remove zero-length file drivers/mtd/maps/sbc8240.c It was "deleted" in commit 2bf961b7ccd69e108ac435c67e2b0522b403c578 Signed-off-by: Jeff Garzik commit 5594639aab8b5614cb27a3e5b2b627505cbcd137 Author: Tejun Heo Date: Tue Aug 4 14:30:08 2009 +0900 ahci: add workaround for on-board 5723s on some gigabyte boards Some gigabytes have on-board SIMG5723s connected to JMB ahcis. These are used to implement hardware raid. Unfortunately some firmware revisions on these 5723s don't bring the link down when all the downstream ports are unoccupied while not responding to reset protocol which makes libata think that there's device attached to the port but is not responding and retry. This results in painfully wrong boot detection time for these ports when they're empty. This patch quirks those boards such that ahci gives up after the initial timeout. Combined with parallel probing, this gives quick enough probing and also is safe because SIMG5723 will respond to the first try if any of the downstream ports is occupied. Signed-off-by: Tejun Heo Reported-by: Marc Bowes Reported-by: Nicolas Mailhot Signed-off-by: Jeff Garzik commit b6931c1fbaf7fda9ea7f120228a96600d7090049 Author: Shane Huang Date: Wed Aug 5 10:10:41 2009 +0800 ahci: Soften up the dmesg on SB600 PMP softreset failure recovery Too strong words led to spurious bug reports: Novell bugzilla #527748, RedHat bugzilla #468800. This patch is used to soften up the dmesg on SB600 PMP softreset failure recovery, so as to remove the scariness and concern from community. Reported-by: pgnet Dev Signed-off-by: Shane Huang Cc: Tejun Heo Signed-off-by: Jeff Garzik commit 20308871588518b5e209c403de2a3ad9a2eba9af Author: Michael Prokop Date: Thu Aug 6 00:14:10 2009 +0200 Documentation/kernel-parameters.txt: document libata's ignore_hpa option By default the kernel honors the HPA (host protected area) of hard drives. Using libata's ignore_hpa module option it's possible to change this behaviour. Document usage and options of libata.ignore_hpa in Documentation/kernel-parameters.txt. Signed-off-by: Michael Prokop Signed-off-by: Jeff Garzik commit 51c8949950647afeeb897e08dd75ad99078adb50 Author: Tony Vroon Date: Thu Aug 6 00:50:09 2009 +0100 sata_nv: MSI support, disabled by default At least the nVidia MCP55 controller quite happily supports MSI. This adds an option to use it. It is disabled by default. As per feedback by Robert Hancock, it will honour the user request as the kernel will not enable MSI where the controller or the specific system configuration do not support it. Signed-off-by: Tony Vroon Cc: Robert Hancock Signed-off-by: Jeff Garzik commit 7831387bda72af3059be48d39846d3eb6d8ce2f6 Author: Tejun Heo Date: Fri Aug 7 01:59:15 2009 +0900 libata: OCZ Vertex can't do HPA OCZ Vertex SSD can't do HPA and not in a usual way. It reports HPA, allows unlocking but then fails all IOs which fall in the unlocked area. Quirk it so that HPA unlocking is not used for the device. Reported by Daniel Perup in bnc#522414. https://bugzilla.novell.com/show_bug.cgi?id=522414 Signed-off-by: Tejun Heo Reported-by: Daniel Perup Signed-off-by: Jeff Garzik commit 1fd4bbec8c0d6db96b02141f324066afa2e77e89 Author: Bartlomiej Zolnierkiewicz Date: Thu Aug 6 17:47:05 2009 +0200 pata_atiixp: fix second channel support PIO and MWDMA timings are never programmed for the second channel because timing registers are treated as 16-bit long ones. The bug is an attixp -> pata_atiixp regression and goes back to: commit 669a5db411d85a14f86cd92bc16bf7ab5b8aa235 Author: Jeff Garzik Date: Tue Aug 29 18:12:40 2006 -0400 [libata] Add a bunch of PATA drivers. Cc: Krystian Juskowiak Cc: Andrew Morton Cc: Borislav Petkov Cc: Robert Hancock Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Jeff Garzik commit df9eba8c9febf53782ef896518e7177999d98188 Author: Tejun Heo Date: Fri Aug 7 11:15:20 2009 +0900 pata_at91: fix resource release Julias Lawall discovered that pata_at91 wasn't freeing a memory region allocated with kzalloc() on init failure paths. Upon review, pata_at91 also seems to be doing unnecessary explicit resource releases for managed resources too. Convert memory allocation to managed one and drop unnecessary explicit resource releases. Signed-off-by: Tejun Heo Cc: Julia Lawall Cc: Sergey Matyukevich Signed-off-by: Jeff Garzik commit e8055139d996e85722984968472868d6dccb1490 Author: Ondrej Zary Date: Tue Aug 11 20:00:11 2009 +0200 x86: Fix oops in identify_cpu() on CPUs without CPUID Kernel is broken for x86 CPUs without CPUID since 2.6.28. It crashes with NULL pointer dereference in identify_cpu(): 766 generic_identify(c); 767 768--> if (this_cpu->c_identify) 769 this_cpu->c_identify(c); this_cpu is NULL. This is because it's only initialized in get_cpu_vendor() function, which is not called if the CPU has no CPUID instruction. Signed-off-by: Ondrej Zary LKML-Reference: <200908112000.15993.linux@rainbow-software.org> Signed-off-by: Ingo Molnar commit ec8b4b7085605e801a7740a2c3c33256aebe249c Author: Stephen Kitt Date: Wed Aug 12 01:12:08 2009 -0700 Input: joydev - decouple axis and button map ioctls from input constants The KEY_MAX change in 2.6.28 changed the values of the JSIOCSBTNMAP and JSIOCGBTNMAP constants; software compiled with the old values no longer works with kernels following 2.6.28, because the ioctl switch statement no longer matches the values given by the software. This patch handles these ioctls independently of the length of data specified, and applies the same treatment to JSIOCSAXMAP and JSIOCGAXMAP which currently depend on ABS_MAX. Signed-off-by: Stephen Kitt Signed-off-by: Dmitry Torokhov commit a8914f3a6d72c97328597a556a99daaf5cc288ae Author: Christoph Hellwig Date: Mon Aug 10 11:32:44 2009 -0300 xfs: fix spin_is_locked assert on uni-processor builds Without SMP or preemption spin_is_locked always returns false, so we can't do an assert with it. Instead use assert_spin_locked, which does the right thing on all builds. Signed-off-by: Christoph Hellwig Reviewed-by: Eric Sandeen Reported-by: Johannes Engel Tested-by: Johannes Engel Signed-off-by: Felix Blyakher commit b89d4208de3de442c9025919c4261be0b38e79a4 Author: Christoph Hellwig Date: Mon Aug 10 11:32:18 2009 -0300 xfs: check for dinode realtime flag corruption Ramon tested XFS with a modified version of fsfuzzer and hit a NULL pointer dereference in __xfs_get_blocks due to the RT device target pointer being NULL. To fix this reject inode with the realtime bit set on a a filesystem without an RT subvolume during inode read. Signed-off-by: Christoph Hellwig Reviewed-by: Eric Sandeen Reviewed-by: Felix Blyakher Reported-by: Ramon de Carvalho Valle Tested-by: Ramon de Carvalho Valle Signed-off-by: Felix Blyakher commit e0c222c411e22f086e929cd69fdcc89336164ec1 Author: Eric Sandeen Date: Mon Jul 20 10:52:15 2009 -0500 use XFS_CORRUPTION_ERROR in xfs_btree_check_sblock In Red Hat Bug 512552 - Can't write to XFS mount during raid5 resync a user ran into corruption while resyncing a raid, and we failed a consistency test, but didn't get much more info; it'd be nice to call XFS_CORRUPTION_ERROR here so we can see the buffer contents. Signed-off-by: Eric Sandeen Reviewed-by: Christoph Hellwig Signed-off-by: Felix Blyakher commit ddd3a14e0f030f0f7b900621f67532285b8657ef Author: Christoph Hellwig Date: Sat Jul 18 18:15:01 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_get xfs_attr_rmtval_get is always called with i_lock held, but i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 7b02ecb3031b192823bc732ae717febc0a59aa92 Author: Christoph Hellwig Date: Sat Jul 18 18:15:00 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_readlink_bmap xfs_readlink_bmap is called with i_lock held, but i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 10746e47e722b5688fcd6eba9fbf9b2e64a248a7 Author: Christoph Hellwig Date: Sat Jul 18 18:14:59 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_set xfs_attr_rmtval_set is always called with i_lock held, and i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 36fae17a648e0aee5d9560514d08477ef48dc87f Author: Christoph Hellwig Date: Sat Jul 18 18:14:58 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_buf_associate_memory xfs_buf_associate_memory is used for setting up the spare buffer for the log wrap case in xlog_sync which can happen under i_lock when called from xfs_fsync. The i_lock mutex is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. There are a couple more uses of xfs_buf_associate_memory in the log recovery code that are also affected by this, but I'd rather keep the code simple than passing on a gfp_mask argument. Longer term we should just stop requiring the memoery allocation in xlog_sync by some smaller rework of the buffer layer. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 3f52c2f0a07c23771909cc53f2e9451a7f1bf253 Author: Christoph Hellwig Date: Sat Jul 18 18:14:57 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_dir_cilookup_result xfs_dir_cilookup_result is always called with i_lock held, but i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 73195ed7864ae4a1fb0bea2ed9df59d19b4fde90 Author: Christoph Hellwig Date: Sat Jul 18 18:14:56 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_da_buf_make i_lock is taken in the reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit f41d7fb9da05b604f8a69fb6cac2a0563c8ede4e Author: Christoph Hellwig Date: Sat Jul 18 18:14:55 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_da_state_alloc xfs_da_state_alloc is always called with i_lock held, but i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit ca35dcd6cae7d4a780c484c53f45548c4719f82c Author: Christoph Hellwig Date: Sat Jul 18 18:14:54 2009 -0400 xfs: switch to NOFS allocation under i_lock in xfs_getbmap xfs_getbmap allocates memory with i_lock held, but i_lock is taken in reclaim context so all allocations under it must avoid recursions into the filesystem. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 0cc6eee130b0c062feec8446d9cecdb17d2cfad3 Author: Christoph Hellwig Date: Sat Jul 18 18:14:53 2009 -0400 xfs: avoid memory allocation under m_peraglock in growfs code Allocate the memory for the larger m_perag array before taking the per-AG lock as the per-AG lock can be taken under the i_lock which can be taken from reclaim context. Reported by the new reclaim context tracing in lockdep. Signed-off-by: Christoph Hellwig Reviewed-by: Felix Blyakher Signed-off-by: Felix Blyakher commit 8884be98bcfa656febd24bd18fe8bececbf81251 Merge: 909a260 dd70469 Author: Takashi Iwai Date: Wed Aug 12 08:05:20 2009 +0200 Merge branch 'fix/hda' into for-linus * fix/hda: ALSA: hda - Don't override ADC definitions for ALC codecs ALSA: hda - Add missing vmaster initialization for ALC269 commit 909a2607a5c923bf40a07ab0bfaa78bee775bf55 Merge: 90bc1a6 afc5e65 Author: Takashi Iwai Date: Wed Aug 12 08:05:19 2009 +0200 Merge branch 'fix/asoc' into for-linus * fix/asoc: ASoC: Add missing DRV_NAME definitions for fsl/* drivers commit 7cb7beb31aa3d941833b6a6e553687422c31e4b6 Merge: 4d9c73f e7369e0 Author: Linus Torvalds Date: Tue Aug 11 17:06:16 2009 -0700 Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/fyu/linux-2.6 * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/fyu/linux-2.6: arch/ia64/kernel/iosapic: missing test after ioremap() ia64/topology.c: exit cache_add_dev when kobject_init_and_add fails arch/ia64/Makefile: Remove -mtune=merced in IA64 kernel build IA64: includecheck fix: ia64, pgtable.h IA64: includecheck fix: ia64, ia64_ksyms.c ia64: boolean __test_and_clear_bit Bug Fix arch/ia64/kernel/pci-dma.c: fix recursive dma_supported() call in iommu_dma_supported() commit e7369e01eb85550ed60dd1b0e120b69dfb03dc23 Author: Roel Kluin <[roel.kluin@gmail.com]> Date: Tue Aug 11 14:52:11 2009 -0700 arch/ia64/kernel/iosapic: missing test after ioremap() Missing test after ioremap() Signed-off-by: Roel Kluin Acked-by: Fenghua Yu commit 5359dffd4396f281c5b77de1acbee6fb1b333b23 Author: Fenghua Yu Date: Tue Aug 11 14:52:11 2009 -0700 ia64/topology.c: exit cache_add_dev when kobject_init_and_add fails Make cache_add_dev exit sysfs when kobject_init_and_add returns an error. Signed-off-by: Xiaotian Feng Signed-off-by: Fenghua Yu commit bf2a4c7270b9a22243a91ab5efcc47aaf997c66b Author: Fenghua Yu <[fenghua.yu@intel.com]> Date: Tue Aug 11 14:52:11 2009 -0700 arch/ia64/Makefile: Remove -mtune=merced in IA64 kernel build Between GCC version 3.4.0 and 4.3.3 (including 3.4.0 and 4.3.3), -mtune=merced is implemented in GCC. Starting from 4.4.0, -mtune=merced is deprecated. Even implemented in versions between 3.4.0 and 4.3.3, the -mtune=merced feature has been broken in some of the versions. For example, GCC 4.1.2 reports interanl tuning function errors during kernel building with -mtune=merced. Or GCC Bugzilla 16130 reports another -mtune=merced issue on GCC 3.4.1. So I would remove the -mtune=merced from IA64 kernel build. Without this option, kernel on Merced will remain the same except losing an unstable and out-of-date performance tunning feature. Since GCC version 3.4.0, -mtune=mckinley has been implemented. The -mtune=mckinley option functions the same as mtune=itanium2. And mtune=itanium2 is the default option. So we don't need to add mtune=mckinley either since its been the default option in any GCC version which implements this option. Signed-off-by: Fenghua Yu commit b5a8879347bbe68bd24c8870503bf6a0362da26b Author: Jaswinder Singh Rajput <[jaswinder@kernel.org]> Date: Tue Aug 11 14:52:11 2009 -0700 IA64: includecheck fix: ia64, pgtable.h fix the following 'make includecheck' warning: arch/ia64/include/asm/pgtable.h: asm/processor.h is included more than once. Signed-off-by: Jaswinder Singh Rajput Acked-by: Fenghua Yu commit cfa5f809e399c699974ba6018eefa022bbc2e16e Author: Jaswinder Singh Rajput <[jaswinder@kernel.org]> Date: Tue Aug 11 14:52:10 2009 -0700 IA64: includecheck fix: ia64, ia64_ksyms.c fix the following 'make includecheck' warning: arch/ia64/kernel/ia64_ksyms.c: asm/page.h is included more than once. Signed-off-by: Jaswinder Singh Rajput Acked-by: Fenghua Yu commit 8d6f9af91959256244878cd801c1c969e66cd093 Author: Johannes Weiner <[hannes@cmpxchg.org]> Date: Tue Aug 11 14:52:10 2009 -0700 ia64: boolean __test_and_clear_bit __test_and_clear_bit() returns a bitfield with the tested-for bit set. Make it consistent with the other bitops - of ia64 but also every other architecture - and return a boolean value. Signed-off-by: Johannes Weiner Acked-by: Fenghua Yu commit 51b89f7a6615eca184aa0b85db5781d931e9c8d1 Author: Fenghua Yu <[fenghua.yu@intel.com]> Date: Tue Aug 11 14:52:10 2009 -0700 Bug Fix arch/ia64/kernel/pci-dma.c: fix recursive dma_supported() call in iommu_dma_supported() In commit 160c1d8e40866edfeae7d68816b7005d70acf391, dma_ops->dma_supported = iommu_dma_supported; This dma_ops->dma_supported is first called in platform_dma_init() during kernel boot. Then dma_ops->dma_supported will be called recursively in iommu_dma_supported. Kernel can not boot because kernel can not get out of iommu_dma_supported until it runs out of stack memory. Signed-off-by: Fenghua Yu commit dee2b904a1f93c275a015b67cd693038d74b18e8 Author: Mikael Pettersson Date: Sun Aug 9 21:21:57 2009 +0200 IXP4xx: Fix IO_SPACE_LIMIT for 2.6.31-rc core PCI changes 2.6.31-rc kernels don't boot on my ixp4xx box (ds101), because the libata driver doesn't find the PCI IDE controller any more. 2.6.30 was fine. I traced this to a PCI update (1f82de10d6b1d845155363c895c552e61b36b51a) in 2.6.30-git19. Diffing the kernel boot logs from 2.6.30-git18 and 2.6.30-git19 illustrates the breakage: > --- dmesg-2.6.30-git18 2009-08-04 01:45:22.000000000 +0200 > +++ dmesg-2.6.30-git19 2009-08-04 01:45:46.000000000 +0200 > @@ -26,6 +26,13 @@ > pci 0000:00:02.2: PME# supported from D0 D1 D2 D3hot > pci 0000:00:02.2: PME# disabled > PCI: bus0: Fast back to back transfers disabled > +pci 0000:00:01.0: BAR 0: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:01.0: BAR 1: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:01.0: BAR 2: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:01.0: BAR 3: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:01.0: BAR 4: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:02.0: BAR 4: can't allocate I/O resource [0x10000-0xffff] > +pci 0000:00:02.1: BAR 4: can't allocate I/O resource [0x10000-0xffff] > bio: create slab at 0 > SCSI subsystem initialized > NET: Registered protocol family 2 > @@ -44,11 +51,7 @@ > console [ttyS0] enabled > serial8250.0: ttyS1 at MMIO 0xc8001000 (irq = 13) is a XScale > Driver 'sd' needs updating - please use bus_type methods > -PCI: enabling device 0000:00:01.0 (0140 -> 0141) > -scsi0 : pata_artop > -scsi1 : pata_artop > -ata1: PATA max UDMA/100 cmd 0x1050 ctl 0x1060 bmdma 0x1040 irq 28 > -ata2: PATA max UDMA/100 cmd 0x1058 ctl 0x1064 bmdma 0x1048 irq 28 > +pata_artop 0000:00:01.0: no available native port > Using configured DiskOnChip probe address 0x50000000 > DiskOnChip found at 0x50000000 > NAND device: Manufacturer ID: 0x98, Chip ID: 0x73 (Toshiba NAND 16MiB 3,3V 8-bit) The specific change in 1f82de10d6b1d845155363c895c552e61b36b51a responsible for this failure turned out to be the following: > --- a/drivers/pci/probe.c > +++ b/drivers/pci/probe.c > @@ -193,7 +193,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, > res->flags |= pci_calc_resource_flags(l) | IORESOURCE_SIZEALIGN; > if (type == pci_bar_io) { > l &= PCI_BASE_ADDRESS_IO_MASK; > - mask = PCI_BASE_ADDRESS_IO_MASK & 0xffff; > + mask = PCI_BASE_ADDRESS_IO_MASK & IO_SPACE_LIMIT; > } else { > l &= PCI_BASE_ADDRESS_MEM_MASK; > mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; Every arch except arm's ixp4xx defines IO_SPACE_LIMIT as an all-bits-one bitmask, typically -1UL but sometimes only a 16-bit 0x0000ffff. But ixp4xx defines it as 0xffff0000, which is now causing the PCI failures. Russell King noted that ixp4xx has 64KB PCI IO space, so IO_SPACE_LIMIT should be 0x0000ffff. This patch makes that change, which fixes the PCI failures on my ixp4xx box. Signed-off-by: Mikael Pettersson Signed-off-by: Krzysztof Hałasa commit fbd8b1819e80ac5a176d085fdddc3a34d1499318 Author: Kevin Winchester Date: Mon Aug 10 19:56:45 2009 -0300 x86: Clear incorrectly forced X86_FEATURE_LAHF_LM flag Due to an erratum with certain AMD Athlon 64 processors, the BIOS may need to force enable the LAHF_LM capability. Unfortunately, in at least one case, the BIOS does this even for processors that do not support the functionality. Add a specific check that will clear the feature bit for processors known not to support the LAHF/SAHF instructions. Signed-off-by: Kevin Winchester Acked-by: Borislav Petkov LKML-Reference: <4A80A5AD.2000209@gmail.com> Signed-off-by: Ingo Molnar commit f64ccccb8afa43abdd63fcbd230f818d6ea0883f Author: Ingo Molnar Date: Tue Aug 11 10:26:33 2009 +0200 perf_counter, x86: Fix generic cache events on P6-mobile CPUs Johannes Stezenbach reported that 'perf stat' does not count cache-miss and cache-references events on his Pentium-M based laptop. This is because we left them blank in p6_perfmon_event_map[], fill them in. Reported-by: Johannes Stezenbach Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit 3c581a7f94542341bf0da496a226b44ac63521a8 Author: Ingo Molnar Date: Tue Aug 11 10:47:36 2009 +0200 perf_counter, x86: Fix lapic printk message Instead of this garbled bootup on UP Pentium-M systems: [ 0.015048] Performance Counters: [ 0.016004] no Local APIC, try rebooting with lapicno PMU driver, software counters only. Print: [ 0.015050] Performance Counters: [ 0.016004] no APIC, boot with the "lapic" boot parameter to force-enable it. [ 0.017003] no PMU driver, software counters only. Cf: Frederic Weisbecker Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker LKML-Reference: Signed-off-by: Ingo Molnar commit 0d01f31439c1e4d602bf9fdc924ab66f407f5e38 Author: Dmitry Torokhov Date: Sun Aug 9 21:44:49 2009 -0700 x86, mce: therm_throt - change when we print messages My Latitude d630 seems to be handling thermal events in SMI by lowering the max frequency of the CPU till it cools down but still leaks the "everything is normal" events. This spams the console and with high priority printks. Adjust therm_throt driver to only print messages about the fact that temperatire returned back to normal when leaving the throttling state. Also lower the severity of "back to normal" message from KERN_CRIT to KERN_INFO. Signed-off-by: Dmitry Torokhov Acked-by: H. Peter Anvin LKML-Reference: <20090810051513.0558F526EC9@mailhub.coreip.homeip.net> Signed-off-by: Ingo Molnar commit dd704698f56c1451fc9c5daadcd6e3a089de2c40 Author: Takashi Iwai Date: Tue Aug 11 08:45:11 2009 +0200 ALSA: hda - Don't override ADC definitions for ALC codecs ALC269 and ALC861-VD parsers override the ADC definitions unconditionally without checking the spec definition. This causes the problem when any inconsistent ADC is set up in the device quirk (like ALC272 with digital-mic). This patch avoids the overriding by adding the proper checks. Reference: Novell bnc#529467 https://bugzilla.novell.com/show_bug.cgi?id=529467 Signed-off-by: Takashi Iwai commit 4d9c73f60efe7a76f086bc93f7ef22be9d78bed6 Merge: 651b1f1 314dabb Author: Linus Torvalds Date: Mon Aug 10 19:25:00 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: SELinux: fix memory leakage in /security/selinux/hooks.c commit 314dabb83a547ec4da819e8cbc78fac9cec605cd Author: James Morris Date: Mon Aug 10 22:00:13 2009 +1000 SELinux: fix memory leakage in /security/selinux/hooks.c Fix memory leakage in /security/selinux/hooks.c The buffer always needs to be freed here; we either error out or allocate more memory. Reported-by: iceberg Signed-off-by: James Morris Acked-by: Stephen Smalley commit 651b1f125c7e3806bbd635739d009433dc07372d Author: Magnus Damm Date: Mon Aug 10 23:41:18 2009 +0200 PM / Driver Core: Kill dev_pm_ops platform warning for now Commit 783ea7d4eeefe895f2731fe73ac951e94418927b (Driver Core: Rework platform suspend/resume, print warning) added a warning message printed for platform drivers that use the legacy PM callbacks rather than struct dev_pm_ops. Unfortunately, this resulted in some confusion and made some people try to convert drivers by replacing the old callbacks with struct dev_pm_ops in automatic way, which generally is not a good idea. Remove the platform device runtime dev_pm_ops warning for now, because it's annoying to users and it's not really necessary right now. [rjw: Modified the changelog to be more informative.] Signed-off-by: Magnus Damm Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki commit e9d126cdfa60b575f1b5b02024c4faee27dccf07 Author: Dan Carpenter Date: Sun Aug 9 14:24:09 2009 +0200 ar9170: fix read & write outside array bounds queue == __AR9170_NUM_TXQ would cause a bug on the next line. found by Smatch ( http://repo.or.cz/w/smatch.git ). Cc: stable@kernel.org Reported-by: Dan Carpenter Signed-off-by: Dan Carpenter Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 363ec5614f86110c6a6bdd72ac2147ebafd3ff5e Author: Christian Lamparter Date: Sat Aug 8 17:09:48 2009 +0200 ar9170usb: fix spurious firmware related message When ar9170-2.fw was missing, the driver erroneously complained about missing the initialization values file ar9170-1.fw... Signed-off-by: Christian Lamparter Signed-off-by: John W. Linville commit 85dfd81dc57e8183a277ddd7a56aa65c96f3f487 Author: Linus Torvalds Date: Mon Aug 10 13:21:19 2009 -0700 pty: fix data loss when stopped (^S/^Q) Commit d945cb9cc ("pty: Rework the pty layer to use the normal buffering logic") dropped the test for 'tty->stopped' in pty_write_room(), which then causes the n_tty line discipline thing to not throttle the data properly when the tty is stopped. So instead of pausing the write due to the tty being stopped, the ldisc layer would go ahead and push it down to the pty. The pty write() routine would then refuse to take the data (because it _did_ check 'stopped'), and the data wouldn't actually be written. This whole stopped test should eventually be moved into the tty ldisc layer rather than have low-level tty drivers care about these things, but right now the fix is to just re-instate the missing pty 'stopped' handling. Reported-and-tested-by: Artur Skawina Cc: Alan Cox Signed-off-by: Linus Torvalds commit b409d7a0ab46fe530efe52734984b4ed5d46c3eb Author: Jan Kara Date: Thu Aug 6 23:29:34 2009 +0200 ocfs2: Fix possible deadlock when extending quota file In OCFS2, allocator locks rank above transaction start. Thus we cannot extend quota file from inside a transaction less we could deadlock. We solve the problem by starting transaction not already in ocfs2_acquire_dquot() but only in ocfs2_local_read_dquot() and ocfs2_global_read_dquot() and we allocate blocks to quota files before starting the transaction. In case we crash, quota files will just have a few blocks more but that's no problem since we just use them next time we extend the quota file. Signed-off-by: Jan Kara Signed-off-by: Joel Becker commit 3e03bbeac541856aaaf1ce1ab0250b6a490e4099 Author: Shunichi Fuji Date: Tue Aug 11 03:34:40 2009 +0900 x86: Add reboot quirk for every 5 series MacBook/Pro Reboot does not work on my MacBook Pro 13 inch (MacBookPro5,5) too. It seems all unibody MacBook and MacBookPro require PCI reboot handling, i guess. Following model/machine ID list shows unibody MacBook/Pro have the 5 series of model number: http://www.everymac.com/systems/by_capability/macs-by-machine-model-machine-id.html Signed-off-by: Shunichi Fuji Cc: Ozan Çağlayan LKML-Reference: <30046e3b0908101134p6487ddbftd8776e4ddef204be@mail.gmail.com> Signed-off-by: Ingo Molnar commit d00aa6695b67a31be2ce5f7464da32c20cb50699 Merge: cec3691 1853db0 Author: Linus Torvalds Date: Mon Aug 10 11:48:51 2009 -0700 Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (27 commits) perf_counter: Zero dead bytes from ftrace raw samples size alignment perf_counter: Subtract the buffer size field from the event record size perf_counter: Require CAP_SYS_ADMIN for raw tracepoint data perf_counter: Correct PERF_SAMPLE_RAW output perf tools: callchain: Fix bad rounding of minimum rate perf_counter tools: Fix libbfd detection for systems with libz dependency perf: "Longum est iter per praecepta, breve et efficax per exempla" perf_counter: Fix a race on perf_counter_ctx perf_counter: Fix tracepoint sampling to be part of generic sampling perf_counter: Work around gcc warning by initializing tracepoint record unconditionally perf tools: callchain: Fix sum of percentages to be 100% by displaying amount of ignored chains in fractal mode perf tools: callchain: Fix 'perf report' display to be callchain by default perf tools: callchain: Fix spurious 'perf report' warnings: ignore empty callchains perf record: Fix the -A UI for empty or non-existent perf.data perf util: Fix do_read() to fail on EOF instead of busy-looping perf list: Fix the output to not include tracepoints without an id perf_counter/powerpc: Fix oops on cpus without perf_counter hardware support perf stat: Fix tool option consistency: rename -S/--scale to -c/--scale perf report: Add debug help for the finding of symbol bugs - show the symtab origin (DSO, build-id, kernel, etc) perf report: Fix per task mult-counter stat reporting ... commit 392741e0a4e17c82e3978b7fcbf04291294dc0a1 Author: Darren Hart Date: Fri Aug 7 15:20:48 2009 -0700 futex: Fix handling of bad requeue syscall pairing If futex_requeue(requeue_pi=1) finds a futex_q that was created by a call other the futex_wait_requeue_pi(), the q.rt_waiter may be null. If so, this will result in an oops from the following call graph: futex_requeue() rt_mutex_start_proxy_lock() task_blocks_on_rt_mutex() waiter->task dereference OOPS We currently WARN_ON() if this is detected, clearly this is inadequate. If we detect a mispairing in futex_requeue(), bail out, seding -EINVAL to user-space. V2: Fix parenthesis warnings. Signed-off-by: Darren Hart Acked-by: Peter Zijlstra Cc: Steven Rostedt Cc: John Kacur Cc: Eric Dumazet Cc: Dinakar Guniguntala Cc: John Stultz LKML-Reference: <4A7CA8C0.7010809@us.ibm.com> Signed-off-by: Ingo Molnar commit cec36911b5fa4ac342f6de856b12a9f71f84e6e5 Merge: a326396 ad7d6c7 Author: Linus Torvalds Date: Mon Aug 10 11:21:13 2009 -0700 Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86/irq: Fix move_irq_desc() for nodes without ram commit a3263969b02260f8733940f580c7af1c716d38ad Merge: 9b8f013 b6e61ee Author: Linus Torvalds Date: Mon Aug 10 11:11:40 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: Fix serialization in pit_expect_msb() commit 9b8f013a8361b05edf511f04fe93b36310b73806 Merge: 9bcf73f 94f81a4 Author: Linus Torvalds Date: Mon Aug 10 11:00:37 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6: PCI hotplug: SGI hotplug: do not use hotplug_slot_attr PCI hotplug: SGI hotplug: fix build failure commit b6e61eef4f9f94714ac3ee4a5c96862d9bcd1836 Author: Linus Torvalds Date: Fri Jul 31 12:45:41 2009 -0700 x86: Fix serialization in pit_expect_msb() Wei Chong Tan reported a fast-PIT-calibration corner-case: | pit_expect_msb() is vulnerable to SMI disturbance corner case | in some platforms which causes /proc/cpuinfo to show wrong | CPU MHz value when quick_pit_calibrate() jumps to success | section. I think that the real issue isn't even an SMI - but the fact that in the very last iteration of the loop, there's no serializing instruction _after_ the last 'rdtsc'. So even in the absense of SMI's, we do have a situation where the cycle counter was read without proper serialization. The last check should be done outside the outer loop, since _inside_ the outer loop, we'll be testing that the PIT has the right MSB value has the right value in the next iteration. So only the _last_ iteration is special, because that's the one that will not check the PIT MSB value any more, and because the final 'get_cycles()' isn't serialized. In other words: - I'd like to move the PIT MSB check to after the last iteration, rather than in every iteration - I think we should comment on the fact that it's also a serializing instruction and so 'fences in' the TSC read. Here's a suggested replacement. Signed-off-by: Linus Torvalds Reported-by: "Tan, Wei Chong" Tested-by: "Tan, Wei Chong" LKML-Reference: Signed-off-by: Ingo Molnar commit 9bcf73f48280ef8cd7f2e38e674da47c409b9906 Merge: 2c661a6 704b836 Author: Linus Torvalds Date: Mon Aug 10 09:00:47 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6 * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6: mm_for_maps: take ->cred_guard_mutex to fix the race with exec mm_for_maps: shift down_read(mmap_sem) to the caller mm_for_maps: simplify, use ptrace_may_access() commit 2c661a669b3e2e34311d7965271a628671191e45 Merge: 04e3535 b2f2e8f Author: Linus Torvalds Date: Mon Aug 10 08:59:56 2009 -0700 Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: powerpc/dma: pci_set_dma_mask() shouldn't fail if mask fits in RAM commit 04e35357e2e3ff4e0cabd6468354cf3dbfeb4f27 Author: Jaswinder Singh Rajput Date: Mon Aug 10 16:45:42 2009 +0100 MN10300: includecheck fix: mn10300, pci.h Fix the following 'make includecheck' warning: arch/mn10300/include/asm/pci.h: linux/mm.h is included more than once. Signed-off-by: Jaswinder Singh Rajput Signed-off-by: David Howells Signed-off-by: Linus Torvalds commit 5e2f89b5d5d87a7c3ba19fc85ba0c29adb65f639 Author: Figo.zhang Date: Sat Aug 8 21:01:22 2009 +0800 mempool.c: clean up type-casting clean up type-casting twice. "size_t" is typedef as "unsigned long" in 64-bit system, and "unsigned int" in 32-bit system, and the intermediate cast to 'long' is pointless. Signed-off-by: Figo.zhang Signed-off-by: Linus Torvalds commit 1392e3b33319fd1a2527bebfc56631c2f2d3c7c5 Author: Ryusuke Konishi Date: Sat Aug 8 17:52:50 2009 +0900 documentation: register ioctl entry of nilfs2 This will register the ioctl range used by nilfs2 file system to the table listed in Documentation/ioctl/ioctl-number.txt. Signed-off-by: Ryusuke Konishi Signed-off-by: Linus Torvalds commit 1853db0e02ae4088f102b0d8e59e83dc98f93f03 Author: Frederic Weisbecker Date: Mon Aug 10 16:38:36 2009 +0200 perf_counter: Zero dead bytes from ftrace raw samples size alignment After aligning the ftrace raw samples, there are dead bytes storing random data from the stack. We don't want to leak these to userspace, then zero these out. Before: 0x2de88 [0x50]: event: 9 . . ... raw event: size 80 bytes . 0000: 09 00 00 00 01 00 50 00 d0 c7 00 81 ff ff ff ff ......P........ . 0010: 68 01 00 00 68 01 00 00 2c 00 00 00 00 00 00 00 h...h...,...... . 0020: 2c 00 00 00 2b 00 01 02 68 01 00 00 68 01 00 00 ,...+...h...h.. . 0030: 6b 6f 6e 64 65 6d 61 6e 64 2f 30 00 00 00 00 00 kondemand/0.... . 0040: 68 01 00 00 40 7f 46 81 ff ff ff ff 00 10 1b 7f h...@.F........ ^ ^ ^ ^ Leak After: 0x2d318 [0x50]: event: 9 . . ... raw event: size 80 bytes . 0000: 09 00 00 00 01 00 50 00 d0 c7 00 81 ff ff ff ff ......P........ . 0010: 68 01 00 00 68 01 00 00 68 14 00 00 00 00 00 00 h...h...h...... . 0020: 2c 00 00 00 2b 00 01 02 68 01 00 00 68 01 00 00 ,...+...h...h.. . 0030: 6b 6f 6e 64 65 6d 61 6e 64 2f 30 00 00 00 00 00 kondemand/0.... . 0040: 68 01 00 00 a0 80 46 81 ff ff ff ff 00 00 00 00 h.....F........ ^ ^ ^ ^ Fixed Reported-by: Peter Zijlstra Signed-off-by: Frederic Weisbecker Cc: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1249915116-5210-1-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith commit 96a4d1e23439e2356a105791bda95cc08d375b97 Merge: f40aac9 6fd210a Author: Russell King Date: Mon Aug 10 15:50:27 2009 +0100 Merge branch 'pm-upstream/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap-pm commit 304703aba31a87903b8c0db8f5e6890cac2d596d Author: Frederic Weisbecker Date: Mon Aug 10 16:11:32 2009 +0200 perf_counter: Subtract the buffer size field from the event record size We compute the perf raw sample size by aligning the raw ftrace event size plus the buffer size field itself. We do that instead of aligning only the perf raw sample size, so that we might economize some in some cases. But this buffer size field is not stored in the perf raw sample, we must then substract its size from the buffer once we computed the alignment unless we may get a useless u32 field in the buffer. Signed-off-by: Frederic Weisbecker Acked-by: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Paul Mackerras LKML-Reference: <20090810141129.GA5124@nowhere> Signed-off-by: Ingo Molnar commit 4dc88029fd916b860ef063c40180aa604ce93494 Author: Dinakar Guniguntala Date: Mon Aug 10 18:31:42 2009 +0530 futex: Fix compat_futex to be same as futex for REQUEUE_PI Need to add the REQUEUE_PI checks to the compat_sys_futex API as well to ensure 32 bit requeue's work fine on a 64 bit system. Patch is against latest tip Signed-off-by: Dinakar Guniguntala Cc: Darren Hart LKML-Reference: <20090810130142.GA23619@in.ibm.com> Signed-off-by: Ingo Molnar commit f40aac940aa83645ec2218ccce90cc1c6881b74c Merge: 7063c88 3c82e22 Author: Russell King Date: Mon Aug 10 14:24:18 2009 +0100 Merge branch 'omap_fixes_31' of git://git.pwsan.com/linux-2.6 commit 7063c88c726a704e648ba36ca78baa630f8b7b0a Merge: f4b9a98 4177662 Author: Russell King Date: Mon Aug 10 14:23:29 2009 +0100 Merge branch 'omap-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6 commit 2fc391112fb6f3424435a3aa2fda887497b5f807 Author: Peter Zijlstra Date: Mon Aug 10 12:33:05 2009 +0100 locking, sched: Give waitqueue spinlocks their own lockdep classes Give waitqueue spinlocks their own lockdep classes when they are initialised from init_waitqueue_head(). This means that struct wait_queue::func functions can operate other waitqueues. This is used by CacheFiles to catch the page from a backing fs being unlocked and to wake up another thread to take a copy of it. Signed-off-by: Peter Zijlstra Signed-off-by: David Howells Tested-by: Takashi Iwai Cc: linux-cachefs@redhat.com Cc: torvalds@osdl.org Cc: akpm@linux-foundation.org LKML-Reference: <20090810113305.17284.81508.stgit@warthog.procyon.org.uk> Signed-off-by: Ingo Molnar commit 4177662ec9f5e50b69ef074369fdb429dd48d97e Author: Roger Quadros Date: Mon Aug 10 14:49:52 2009 +0300 OMAP3: RX51: Updated rx51_defconfig Added REGULATOR, MMC and updated default CMDLINE so RX51 now boots. Note that the regulator code should be moved from mmc-twl4030.c to omap_hsmmc.c so it can be a module. Signed-off-by: Roger Quadros Signed-off-by: Tony Lindgren commit 22833044fbe2764d44ae03f58508e671652ca186 Author: Roger Quadros Date: Mon Aug 10 14:49:51 2009 +0300 OMAP2/3: mmc-twl4030: Free up MMC regulators while cleaning up twl_mmc_cleanup() must free up the regulators that were allocated by twl_mmc_late_init(). This eliminates the below error when 'omap_hsmmc' module is repeatedly loaded and unloaded. "sysfs: cannot create duplicate filename '/devices/platform /mmci-omap-hs.0/microamps_requested_vmmc'" Signed-off-by: Roger Quadros Signed-off-by: Tony Lindgren commit dfc27b34496923b5f552eb9cdf20468045114ada Author: Roger Quadros Date: Mon Aug 10 14:49:51 2009 +0300 OMAP3: RX51: Define TWL4030 USB transceiver in board file Add OTG transceiver to RX51 platform data to prevent kernel NULL pointer dereference during MUSB initialisation. Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi Signed-off-by: Tony Lindgren commit 5032902c331acc71956e47abd90d090181c5ef4a Author: Sergio Aguirre Date: Mon Aug 10 14:49:50 2009 +0300 OMAP3: Overo: Fix smsc911x platform device resource value Fixes a wrong setting of resource parameter list in SMSC911x platform driver data structure for Overo case. This fixes folowing warning when compiling for Overo board: warning: initialization from incompatible pointer type Introduced since commit id: commit 172ef275444efa12d834fb9d1b1acdac92db47f7 Author: Steve Sakoman Date: Mon Feb 2 06:27:49 2009 +0000 ARM: Add SMSC911X support to Overo platform (V2) Signed-off-by: Sergio Aguirre Signed-off-by: Tony Lindgren commit 370bc1fdefb8a30018d98aca2fdfd6b6701082e7 Author: Janboe Ye Date: Mon Aug 10 14:49:50 2009 +0300 OMAP3: Fix omap3 sram virtual addres overlap vmalloc space after increasing vmalloc size commit e85c205ac1427f2405021a36f083280ff0d0a35e increase vmalloc size. vmalloc space will overlap with OMAP3 sram virtual address. Signed-off-by: Li Hong Mei Signed-off-by: Janboe Ye Reviewed-by: Paul Walmsley commit 284119c48f4a0c469b3e0237b500e536b4bc7b6f Author: Vikram Pandita Date: Mon Aug 10 14:49:50 2009 +0300 OMAP2/3: DMA errata correction This errata is valid for: OMAP2420 Errata 1.85 Impacts all 2420 ES rev OMAP2430 Errata 1.10 Impacts only ES1.0 Description: DMA may hang when several channels are used in parallel OMAP3430: Not impacted, so remove the errata fix for omap3 Fixed issue reported on cpu_is_omap24xx check reported by Nishant Kamat Signed-off-by: Vikram Pandita Reviewed-by: Nishant Kamat Signed-off-by: Tony Lindgren commit cd92204924fafbd5c7241dfd12ca3176d542e0c5 Author: Tony Lindgren Date: Mon Aug 10 14:49:50 2009 +0300 OMAP: Fix testing of cpu defines for mach-omap1 There's no need to keep these defines limited in the ifdef block for mach-omap2. It will just cause problems testing for the CPU revision in the common code, like the next patch does for the DMA errata. Signed-off-by: Tony Lindgren commit 704b836cbf19e885f8366bccb2e4b0474346c02d Author: Oleg Nesterov Date: Fri Jul 10 03:27:40 2009 +0200 mm_for_maps: take ->cred_guard_mutex to fix the race with exec The problem is minor, but without ->cred_guard_mutex held we can race with exec() and get the new ->mm but check old creds. Now we do not need to re-check task->mm after ptrace_may_access(), it can't be changed to the new mm under us. Strictly speaking, this also fixes another very minor problem. Unless security check fails or the task exits mm_for_maps() should never return NULL, the caller should get either old or new ->mm. Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Signed-off-by: James Morris commit 00f89d218523b9bf6b522349c039d5ac80aa536d Author: Oleg Nesterov Date: Fri Jul 10 03:27:38 2009 +0200 mm_for_maps: shift down_read(mmap_sem) to the caller mm_for_maps() takes ->mmap_sem after security checks, this looks strange and obfuscates the locking rules. Move this lock to its single caller, m_start(). Signed-off-by: Oleg Nesterov Acked-by: Serge Hallyn Signed-off-by: James Morris commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286 Author: Oleg Nesterov Date: Tue Jun 23 21:25:32 2009 +0200 mm_for_maps: simplify, use ptrace_may_access() It would be nice to kill __ptrace_may_access(). It requires task_lock(), but this lock is only needed to read mm->flags in the middle. Convert mm_for_maps() to use ptrace_may_access(), this also simplifies the code a little bit. Also, we do not need to take ->mmap_sem in advance. In fact I think mm_for_maps() should not play with ->mmap_sem at all, the caller should take this lock. With or without this patch, without ->cred_guard_mutex held we can race with exec() and get the new ->mm but check old creds. Signed-off-by: Oleg Nesterov Reviewed-by: Serge Hallyn Signed-off-by: James Morris commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1 Author: Takashi Iwai Date: Mon Aug 10 11:55:51 2009 +0200 ALSA: hda - Add missing vmaster initialization for ALC269 Without the initialization of vmaster NID, the dB information got confused for ALC269 codec. Reference: Novell bnc#527361 https://bugzilla.novell.com/show_bug.cgi?id=527361 Signed-off-by: Takashi Iwai Cc: commit a4e95fc2cbb31d70a65beffeaf8773f881328c34 Author: Peter Zijlstra Date: Mon Aug 10 11:20:12 2009 +0200 perf_counter: Require CAP_SYS_ADMIN for raw tracepoint data Raw tracepoint data contains various kernel internals and data from other users, so restrict this to CAP_SYS_ADMIN. Signed-off-by: Peter Zijlstra Acked-by: Frederic Weisbecker Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Paul Mackerras LKML-Reference: <1249896452.17467.75.camel@twins> Signed-off-by: Ingo Molnar commit a044560c3a1f0ad75ce685c1ed7604820b9ed319 Author: Peter Zijlstra Date: Mon Aug 10 11:16:52 2009 +0200 perf_counter: Correct PERF_SAMPLE_RAW output PERF_SAMPLE_* output switches should unconditionally output the correct format, as they are the only way to unambiguously parse the PERF_EVENT_SAMPLE data. Signed-off-by: Peter Zijlstra Acked-by: Frederic Weisbecker Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Paul Mackerras LKML-Reference: <1249896447.17467.74.camel@twins> Signed-off-by: Ingo Molnar commit beda2c7ea2c15ed01eef00a997d2b0496c3a502d Author: Darren Hart Date: Sun Aug 9 15:34:39 2009 -0700 futex: Update futex_q lock_ptr on requeue proxy lock futex_requeue() can acquire the lock on behalf of a waiter early on or during the requeue loop if it is uncontended or in the event of a lock steal or owner died. On wakeup, the waiter (in futex_wait_requeue_pi()) cleans up the pi_state owner using the lock_ptr to protect against concurrent access to the pi_state. The pi_state is hung off futex_q's on the requeue target futex hash bucket so the lock_ptr needs to be updated accordingly. The problem manifested by triggering the WARN_ON in lookup_pi_state() about the pid != pi_state->owner->pid. With this patch, the pi_state is properly guarded against concurrent access via the requeue target hb lock. The astute reviewer may notice that there is a window of time between when futex_requeue() unlocks the hb locks and when futex_wait_requeue_pi() will acquire hb2->lock. During this time the pi_state and uval are not in sync with the underlying rtmutex owner (but the uval does indicate there are waiters, so no atomic changes will occur in userspace). However, this is not a problem. Should a contending thread enter lookup_pi_state() and acquire hb2->lock before the ownership is fixed up, it will find the pi_state hung off a waiter's (possibly the pending owner's) futex_q and block on the rtmutex. Once futex_wait_requeue_pi() fixes up the owner, it will also move the pi_state from the old owner's task->pi_state_list to its own. v3: Fix plist lock name for application to mainline (rather than -rt) Compile tested against tip/v2.6.31-rc5. Signed-off-by: Darren Hart Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Eric Dumazet Cc: Dinakar Guniguntala Cc: John Stultz LKML-Reference: <4A7F4EFF.6090903@us.ibm.com> Signed-off-by: Ingo Molnar commit b2f2e8fee3d62f621e795f25b2fc0f51bbdb4af9 Author: Benjamin Herrenschmidt Date: Mon Aug 10 16:36:38 2009 +1000 powerpc/dma: pci_set_dma_mask() shouldn't fail if mask fits in RAM On an iMac G5, the b43 driver is failing to initialise because trying to set the dma mask to 30-bit fails. Even though there's only 512MiB of RAM in the machine anyway: https://bugzilla.redhat.com/show_bug.cgi?id=514787 We should probably let it succeed if the available RAM in the system doesn't exceed the requested limit. Signed-off-by: David Woodhouse Signed-off-by: Benjamin Herrenschmidt commit 973507cb8610d4c84f090d5f1f0ca54fa0559d27 Author: roel kluin Date: Sat Aug 8 23:54:21 2009 +0000 mlx4_en: Fix read buffer overflow in mlx4_en_complete_rx_desc() If the length is less or equal to frag_prefix_size in the first iteration we write skb_frags_rx[-1] and read from priv->frag_info[-1] Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit be12159b24c532b4b48bdec5a543336438faa132 Author: roel kluin Date: Sun Aug 9 04:00:25 2009 +0000 zorro8390: Fix read buffer overflow in zorro8390_init_one() Prevent read from cards[-1] when no card was found. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit 5e33b719c8fcccfedc1d25167826a0f93fe6c5a1 Author: roel kluin Date: Fri Aug 7 03:24:27 2009 +0000 pcnet32: Read buffer overflow An `options[cards_found]' that equals `sizeof(options_mapping)' is already beyond the array. Signed-off-by: Roel Kluin Signed-off-by: David S. Miller commit 418372b0ab7a3bbcc59d71e8e4d322ef18263dab Author: Rafael Laufer Date: Fri Aug 7 05:17:17 2009 +0000 sctp: fix missing destroy of percpu counter variable in sctp_proc_exit() Commit 1748376b6626acf59c24e9592ac67b3fe2a0e026, net: Use a percpu_counter for sockets_allocated added percpu_counter function calls to sctp_proc_init code path, but forgot to add them to sctp_proc_exit(). This resulted in a following Ooops when performing this test # modprobe sctp # rmmod -f sctp # modprobe sctp [ 573.862512] BUG: unable to handle kernel paging request at f8214a24 [ 573.862518] IP: [] __percpu_counter_init+0x3f/0x70 [ 573.862530] *pde = 37010067 *pte = 00000000 [ 573.862534] Oops: 0002 [#1] SMP [ 573.862537] last sysfs file: /sys/module/libcrc32c/initstate [ 573.862540] Modules linked in: sctp(+) crc32c libcrc32c binfmt_misc bridge stp bnep lp snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss arc4 joydev snd_pcm ecb pcmcia snd_seq_dummy snd_seq_oss iwlagn iwlcore snd_seq_midi snd_rawmidi snd_seq_midi_event yenta_socket rsrc_nonstatic thinkpad_acpi snd_seq snd_timer snd_seq_device mac80211 psmouse sdhci_pci sdhci nvidia(P) ppdev video snd soundcore serio_raw pcspkr iTCO_wdt iTCO_vendor_support led_class ricoh_mmc pcmcia_core intel_agp nvram agpgart usbhid parport_pc parport output snd_page_alloc cfg80211 btusb ohci1394 ieee1394 e1000e [last unloaded: sctp] [ 573.862589] [ 573.862593] Pid: 5373, comm: modprobe Tainted: P R (2.6.31-rc3 #6) 7663B15 [ 573.862596] EIP: 0060:[] EFLAGS: 00010286 CPU: 1 [ 573.862599] EIP is at __percpu_counter_init+0x3f/0x70 [ 573.862602] EAX: f8214a20 EBX: f80faa14 ECX: c48c0000 EDX: f80faa20 [ 573.862604] ESI: f80a7000 EDI: 00000000 EBP: f69d5ef0 ESP: f69d5eec [ 573.862606] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 [ 573.862610] Process modprobe (pid: 5373, ti=f69d4000 task=c2130c70 task.ti=f69d4000) [ 573.862612] Stack: [ 573.862613] 00000000 f69d5f18 f80a70a8 f80fa9fc 00000000 fffffffc f69d5f30 c018e2d4 [ 573.862619] <0> 00000000 f80a7000 00000000 f69d5f88 c010112b 00000000 c07029c0 fffffffb [ 573.862626] <0> 00000000 f69d5f38 c018f83f f69d5f54 c0557cad f80fa860 00000001 c07010c0 [ 573.862634] Call Trace: [ 573.862644] [] ? sctp_init+0xa8/0x7d4 [sctp] [ 573.862650] [] ? marker_update_probe_range+0x184/0x260 [ 573.862659] [] ? sctp_init+0x0/0x7d4 [sctp] [ 573.862662] [] ? do_one_initcall+0x2b/0x160 [ 573.862666] [] ? tracepoint_module_notify+0x2f/0x40 [ 573.862671] [] ? notifier_call_chain+0x2d/0x70 [ 573.862678] [] ? __blocking_notifier_call_chain+0x4d/0x60 [ 573.862682] [] ? sys_init_module+0xb1/0x1f0 [ 573.862686] [] ? sysenter_do_call+0x12/0x28 [ 573.862688] Code: 89 48 08 b8 04 00 00 00 e8 df aa ec ff ba f4 ff ff ff 85 c0 89 43 14 74 31 b8 b0 18 71 c0 e8 19 b9 24 00 a1 c4 18 71 c0 8d 53 0c <89> 50 04 89 43 0c b8 b0 18 71 c0 c7 43 10 c4 18 71 c0 89 15 c4 [ 573.862725] EIP: [] __percpu_counter_init+0x3f/0x70 SS:ESP 0068:f69d5eec [ 573.862730] CR2: 00000000f8214a24 [ 573.862734] ---[ end trace 39c4e0b55e7cf54d ]--- Signed-off-by: Rafael Laufer Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller commit 018d21ed80736eab21fabf45edbd74600a1f8330 Author: Joe Perches Date: Fri Aug 7 06:43:01 2009 +0000 MAINTAINERS: additional NETWORKING [GENERAL] and NETWORKING DRIVERS patterns Signed-off-by: Joe Perches Signed-off-by: David S. Miller commit 75c4885924f01aed1f887886a49dfa89960de240 Author: Yong Zhang Date: Fri Aug 7 16:36:52 2009 +0000 gianfar: keep vlan related state when restart If vlan has been enabled. ifdown followed by ifup will lost hardware related state. Also remove duplicated operation in gfar_vlan_rx_register(). Signed-off-by: Yong Zhang Acked-by: Dai Haruki Signed-off-by: David S. Miller commit 148675a7b2061b5a5eb194530b7c4d8de1f2887e Author: Bruce Allan Date: Fri Aug 7 07:41:56 2009 +0000 e1000e: fix potential NVM corruption on ICH9 with 8K bank size The bank offset was being incorrectly calculated on ICH9 parts with a bank size of 8K (instead of the more common 4K bank) which would cause any NVM writes to be done on the wrong address after switching from bank 1 to bank 0. Additionally, assume we are meant to use bank 0 if a valid bank is not detected, and remove the unnecessary acquisition of the SW/FW/HW semaphore when writing to the shadow ram version of the NVM image. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 373a88d78be540c1331ea5adcb76610dddcb008b Author: Bruce Allan Date: Fri Aug 7 07:41:37 2009 +0000 e1000e: fix acquisition of SW/FW/HW semaphore for ICHx parts For ICHx parts, write the EXTCNF_CTRL.SWFLAG bit once when trying to acquire the SW/FW/HW semaphore instead of multiple times to prevent the hardware from having problems (especially for systems with manageability enabled), and extend the timeout for the hardware to set the SWFLAG bit. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 6e455b897bb6be3a4c0c6578f679e83d399e5b92 Author: Yi Zou Date: Thu Aug 6 13:05:44 2009 +0000 ixgbe: Disable packet split only on FCoE queues in 82599 For 82599, packet split has to be disabled for FCoE direct data placement. However, this is only required on received queues allocated for FCoE. This patch adds a per ring flags to indicate if packet split is disabled on a per queue basis, particularly for FCoE, as packet split must be disabled for large receive using direct data placement (DDP). Signed-off-by: Yi Zou Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit a6616b42fbc39c1ccc2373996f1441ce7707ea93 Author: Yi Zou Date: Thu Aug 6 13:05:23 2009 +0000 ixgbe: Pass rx_ring directly in ixgbe_configure_srrctl() Instead of passing the register index of the corresponding rx_ring and find the way back to get to corresponding rx_ring in ixgbe_configure_srrctl(), simplify the function ixgbe_configure_srrctl() by passing the rx_ring into it. Then the register index for that rx_ring is already available from rx_ring->reg_idx. Signed-off-by: Yi Zou Acked-by: Peter P Waskiewicz Jr Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller commit 876bfd4d0f18cd1f698249870c7e7fb944de1c26 Author: Herbert Xu Date: Thu Aug 6 14:22:44 2009 +0000 tun: Extend RTNL lock coverage over whole ioctl As it is, parts of the ioctl runs under the RTNL and parts of it do not. The unlocked section is still protected by the BKL, but there can be subtle races. For example, Eric Biederman and Paul Moore observed that if two threads tried to create two tun devices on the same file descriptor, then unexpected results may occur. As there isn't anything in the ioctl that is expected to sleep indefinitely, we can prevent this from occurring by extending the RTNL lock coverage. This also allows to get rid of the BKL. Finally, I changed tun_get_iff to take a tun device in order to avoid calling tun_put which would dead-lock as it also tries to take the RTNL lock. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 9555b31e8c29d2000e1e1f569f6f242ebd596e47 Author: Greg Ungerer Date: Thu Aug 6 17:58:18 2009 +0000 fec: fix FEC driver packet transmission breakage Commit f0b3fbeae11a526c3d308b691684589ee37c359b ("FEC Buffer rework") breaks transmission of packets where the skb data buffer is not memory aligned according to FEC_ALIGNMENT. It incorrectly passes to dma_sync_single() the buffer address directly from the skb, instead of the address calculated for use (which may be the skb address or one of the bounce buffers). It seems there is no use converting the cpu address of the buffer to a physical either, since dma_map_single() expects the cpu address and will return the dma address to use in the descriptor. So remove the use of __pa() on the buffer address as well. This patch is against 2.6.30-rc5. This breakage is a regression over 2.6.30, which does not have this problem. Signed-off-by: Greg Ungerer Signed-off-by: David S. Miller commit e84b90ae5eb3c112d1f208964df1d8156a538289 Author: Eric Dumazet Date: Thu Aug 6 20:27:04 2009 +0000 can: Fix raw_getname() leak raw_getname() can leak 10 bytes of kernel memory to user (two bytes hole between can_family and can_ifindex, 8 bytes at the end of sockaddr_can structure) Signed-off-by: Eric Dumazet Acked-by: Oliver Hartkopp Signed-off-by: David S. Miller commit b79a79471bd31d737c939a6ddc347417047b4320 Author: Jussi Mäki Date: Thu Aug 6 21:38:14 2009 +0000 Fix xfrm hash collisions by changing __xfrm4_daddr_saddr_hash to hash addresses with addition This patch fixes hash collisions in cases where number of entries have incrementing IP source and destination addresses from single respective subnets (i.e. 192.168.0.1-172.16.0.1, 192.168.0.2-172.16.0.2, and so on.). Signed-off-by: Jussi Maki Signed-off-by: David S. Miller commit 082ba88a5e6b1425abed3fae4ad65e0e985ed081 Author: Roel Kluin Date: Thu Aug 6 13:06:56 2009 +0000 atlx: strncpy does not null terminate string strlcpy() will always null terminate the string. Signed-off-by: Roel Kluin Cc: Jay Cliburn Cc: Chris Snook Cc: Jie Yang Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit 5d5ceb8bdde403529ad9849f300dc80b1884550f Author: Roel Kluin Date: Thu Aug 6 13:06:03 2009 +0000 irda: fix read buffer overflow io[i] is read before the bounds check on i, order should be reversed. Signed-off-by: Roel Kluin Cc: Samuel Ortiz Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit cb2f33e9596632979c140c243ac1e8e994f62180 Author: Chris Snook Date: Thu Aug 6 12:19:31 2009 +0000 MAINTAINERS: update atlx contact info Update MAINTAINERS to reflect my current (non-)affiliation. Anyone hiring? Signed-off-by: Chris Snook Cc: Jay Cliburn Cc: Jie Yang Cc: "David S. Miller" Signed-off-by: Andrew Morton Signed-off-by: David S. Miller commit f222e8b40f2177b1c4cac015b117744c1d3fa3e9 Merge: 819ae6a f4b9a98 Author: David S. Miller Date: Sun Aug 9 21:29:47 2009 -0700 Merge branch 'master' of /home/davem/src/GIT/linux-2.6/ commit 819ae6a389d4acfab9a7bb874fa1977aa464d14b Merge: 0d502d8 dd1f57e Author: David S. Miller Date: Sun Aug 9 20:47:39 2009 -0700 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 commit c8c00a6915a2e3d10416e8bdd3138429beb96210 Author: NeilBrown Date: Mon Aug 10 12:50:52 2009 +1000 Remove deadlock potential in md_open A recent commit: commit 449aad3e25358812c43afc60918c5ad3819488e7 introduced the possibility of an A-B/B-A deadlock between bd_mutex and reconfig_mutex. __blkdev_get holds bd_mutex while calling md_open which takes reconfig_mutex, do_md_run is always called with reconfig_mutex held, and it now takes bd_mutex in the call the revalidate_disk. This potential deadlock was not caught by lockdep due to the use of mutex_lock_interruptible_nexted which was introduced by commit d63a5a74dee87883fda6b7d170244acaac5b05e8 do avoid a warning of an impossible deadlock. It is quite possible to split reconfig_mutex in to two locks. One protects the array data structures while it is being reconfigured, the other ensures that an array is never even partially open while it is being deactivated. In particular, the second lock prevents an open from completing between the time when do_md_stop checks if there are any active opens, and the time when the array is either set read-only, or when ->pers is set to NULL. So we can be certain that no IO is in flight as the array is being destroyed. So create a new lock, open_mutex, just to ensure exclusion between 'open' and 'stop'. This avoids the deadlock and also avoids the lockdep warning mentioned in commit d63a5a74d Reported-by: "Mike Snitzer" Reported-by: "H. Peter Anvin" Signed-off-by: NeilBrown commit f4b9a988685da6386d7f9a72df3098bcc3270526 Merge: 17d11ba 32bc482 Author: Linus Torvalds Date: Sun Aug 9 14:58:34 2009 -0700 Merge branch 'for-linus' of git://git.infradead.org/ubi-2.6 * 'for-linus' of git://git.infradead.org/ubi-2.6: UBI: compatible fallback in absense of sequence numbers UBI: fix double free on error path commit 17d11ba14990d2bbaaec9c09a200b803679a968e Merge: fb1ee45 b4a2f5e Author: Linus Torvalds Date: Sun Aug 9 14:58:21 2009 -0700 Merge branch 'kvm-updates/2.6.31' of git://git.kernel.org/pub/scm/virt/kvm/kvm * 'kvm-updates/2.6.31' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: Avoid redelivery of edge interrupt before next edge KVM: MMU: limit rmap chain length KVM: ia64: fix build failures due to ia64/unsigned long mismatches KVM: Make KVM_HPAGES_PER_HPAGE unsigned long to avoid build error on powerpc KVM: fix ack not being delivered when msi present KVM: s390: fix wait_queue handling KVM: VMX: Fix locking imbalance on emulation failure KVM: VMX: Fix locking order in handle_invalid_guest_state KVM: MMU: handle n_free_mmu_pages > n_alloc_mmu_pages in kvm_mmu_change_mmu_pages KVM: SVM: force new asid on vcpu migration KVM: x86: verify MTRR/PAT validity KVM: PIT: fix kpit_elapsed division by zero KVM: Fix KVM_GET_MSR_INDEX_LIST commit fb1ee451e64a1c963a149aeccd9ef6a718f545e7 Merge: 2e9b11a 6cb504c Author: Linus Torvalds Date: Sun Aug 9 14:58:09 2009 -0700 Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: silence vblank warnings drm: silence pointless vblank warning. drm: When adding probed modes, preserve duplicate mode types commit 2e9b11afdbfe17a9cc6356076179b7ea11972607 Merge: 95d0ad0 17d42c1 Author: Linus Torvalds Date: Sun Aug 9 14:57:41 2009 -0700 Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: posix_cpu_timers_exit_group(): Do not use thread_group_cputimer() commit 95d0ad049cd6937634c0a75f9518f5166daabfce Merge: 413dd87 f413cdb Author: Linus Torvalds Date: Sun Aug 9 14:57:26 2009 -0700 Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: perf_counter: Fix/complete ftrace event records sampling perf_counter, ftrace: Fix perf_counter integration tracing/filters: Always free pred on filter_add_subsystem_pred() failure tracing/filters: Don't use pred on alloc failure ring-buffer: Fix memleak in ring_buffer_free() tracing: Fix recordmcount.pl to handle sections with only weak functions ring-buffer: Fix advance of reader in rb_buffer_peek() tracing: do not use functions starting with .L in recordmcount.pl ring-buffer: do not disable ring buffer on oops_in_progress ring-buffer: fix check of try_to_discard result commit 413dd8768ada25adbf53284696b71de7e7844969 Merge: 713e3e1 fdb8a42 Author: Linus Torvalds Date: Sun Aug 9 14:57:09 2009 -0700 Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: x86: fix buffer overflow in efi_init() x86: Add quirk to make Apple MacBookPro5,1 use reboot=pci x86: Fix MSI-X initialization by using online_mask for x2apic target_cpus x86: Fix VMI && stack protector commit 713e3e1875749f341247a0c922e6ddd38fbd991c Merge: 7b2aa03 0e692a9 Author: Linus Torvalds Date: Sun Aug 9 14:56:51 2009 -0700 Merge branch 'core-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip * 'core-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: lockdep: Fix typos in documentation lockdep: Fix file mode of lock_stat rtmutex: Avoid deadlock in rt_mutex_start_proxy_lock() commit c0a8865e32c8d1a562db38e06ef31ef23282f646 Author: Frederic Weisbecker Date: Sun Aug 9 04:19:15 2009 +0200 perf tools: callchain: Fix bad rounding of minimum rate Sometimes we get callchain branches that have a rate under the limit given by the user. Say you launched: perf record -f -g -a ./hackbench 10 perf report -g fractal,10.0 And you got: 2.33% hackbench [kernel] [k] _spin_lock_irqsave | |--78.57%-- remove_wait_queue | poll_freewait | do_sys_poll | sys_poll | sysenter_dispatch | 0xf7ffa430 | 0x1ffadea3c | |--7.14%-- __up_read | up_read | do_page_fault | page_fault | 0xf7ffa430 | 0xa0df710000000a ... It is abnormal to get a 7.14% branch whereas we passed a 10% filter. The problem is that we round down the minimum threshold. This happens mostly when we have very low number of events. If the total amount of your branch is 4 and you have a subranch of 3 events, filtering to 90% will be computed like follows: limit = 4 * 0.9; The result is about 3.6, but the cast to integer will round down to 3. It means that our filter is actually of 75% We must then explicitly round up the minimum threshold. Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: acme@redhat.com Cc: peterz@infradead.org Cc: efault@gmx.de LKML-Reference: <20090809024235.GA10146@nowhere> Signed-off-by: Ingo Molnar commit 183f3b0887083d36c8a25cd5e3518906415d1889 Author: Mike Galbraith Date: Sat Aug 8 14:14:15 2009 +0200 perf_counter tools: Fix libbfd detection for systems with libz dependency Due to a libz dependency in some distro's binutils package, C++ demangle support isn't compiled in despite the necessary libraries being available. Fix this by adding a -lz link test to the dependency detection rules. Signed-off-by: Mike Galbraith Acked-by: Peter Zijlstra LKML-Reference: <1249733655.6929.5.camel@marge.simson.net> Signed-off-by: Ingo Molnar commit c24b513337f06712b8c81eb4f1413d44591dfee7 Author: Carlos R. Mafra Date: Wed Aug 5 20:53:34 2009 +0200 perf: "Longum est iter per praecepta, breve et efficax per exempla" A few examples of how 'perf' can be used, from an e-mail by Ingo Molnar http://lkml.org/lkml/2009/8/4/346. Signed-off-by: Carlos R. Mafra Cc: Peter Zijlstra Cc: Valdis.Kletnieks@vt.edu LKML-Reference: <20090805185334.GA4535@Pilar.aei.mpg.de> Signed-off-by: Ingo Molnar commit 3a80b4a3539696f4b0574876326860323035a302 Author: Peter Zijlstra Date: Fri Aug 7 19:49:01 2009 +0200 perf_counter: Fix a race on perf_counter_ctx While extending perfcounters with BTS hw-tracing, Markus Metzger managed to trigger this warning: [ 995.557128] WARNING: at kernel/perf_counter.c:1191 __perf_counter_task_sched_out+0x48/0x6b() triggers because commit 9f498cc5be7e013d8d6e4c616980ed0ffc8680d2 (perf_counter: Full task tracing) removed clearing of tsk->perf_counter_ctxp out from under ctx->lock which introduced a race (against perf_lock_task_context). Move it back and deal with the exit notification by explicitly passing along the former task context. Reported-by: Markus T Metzger Signed-off-by: Peter Zijlstra Cc: Paul Mackerras LKML-Reference: <1249667341.17467.5.camel@twins> Signed-off-by: Ingo Molnar commit 3a43ce68ae1758fa6a839386025ef45acb6baa22 Author: Frederic Weisbecker Date: Sat Aug 8 04:26:37 2009 +0200 perf_counter: Fix tracepoint sampling to be part of generic sampling Based on Peter's comments, make tracepoint sampling generic just like all the other sampling bits are. This is a rename with no code changes: - PERF_SAMPLE_TP_RECORD to PERF_SAMPLE_RAW - struct perf_tracepoint_record to perf_raw_record We want the system in place that transport tracepoints raw samples events into the perf ring buffer to be generalized and usable by any type of counter. Reported-by; Peter Zijlstra Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Paul Mackerras LKML-Reference: <1249698400-5441-4-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit 10b8e3066066708f304e0fc5cfe658e05abf943d Author: Frederic Weisbecker Date: Sat Aug 8 04:26:35 2009 +0200 perf_counter: Work around gcc warning by initializing tracepoint record unconditionally Despite that the tracepoint record is always present when the PERF_SAMPLE_TP_RECORD flag is set, gcc raises a warning, thinking it might not be initialized: kernel/perf_counter.c: In function ‘perf_counter_output’: kernel/perf_counter.c:2650: warning: ‘tp’ may be used uninitialized in this function Then, initialize it to NULL and always check if it's not NULL before dereference it. Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Paul Mackerras LKML-Reference: <1249698400-5441-2-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit 25446036cbfc2c89faacdb4fb4603943d2197dc6 Author: Frederic Weisbecker Date: Sat Aug 8 02:16:25 2009 +0200 perf tools: callchain: Fix sum of percentages to be 100% by displaying amount of ignored chains in fractal mode When we filter the callchains below a given percentage, we ignore them and the end result only shows entries that have an upper percentage than the filter threshold. It seems to users then that we have an imbalance in the percentage, as if the sum inside a profiled branch doesn't reach 100%. Since in the past there have been real perf report bugs that showed the same sypmtom, it would be nice to assure the user that the data is perfect and trustable and it all sums up to 100.00%. So fix this by displaying the remaining hits that have been filtered but without more detail than their amount in each branches. Example while filtering below 50%: 7.73% [k] delay_tsc | |--98.22%-- __const_udelay | | | |--86.37%-- ath5k_hw_register_timeout | | ath5k_hw_noise_floor_calibration | | ath5k_hw_reset | | ath5k_reset | | ath5k_config | | ieee80211_hw_config | | | | | |--88.53%-- ieee80211_scan_work | | | worker_thread | | | kthread | | | child_rip | | --11.47%-- [...] | --13.63%-- [...] --1.78%-- [...] Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1249690585-9145-4-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit b1a88349c37624755b28ac3b3152b48f52c1f487 Author: Frederic Weisbecker Date: Sat Aug 8 02:16:24 2009 +0200 perf tools: callchain: Fix 'perf report' display to be callchain by default If we recorded with -g option to record the callchain, right now we require a -g option to perf report as well - and people reported this as unnecessary complication: the user already specified -g once, no need to require it a second time. So if the recording includes call-chains, display the callchain by default from perf report. ( The user can override this default using "-g none" option from perf report. ) Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1249690585-9145-3-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit b0efe213f84f7fd5ccfe07053e3d9fb827b7c188 Author: Frederic Weisbecker Date: Sat Aug 8 02:16:23 2009 +0200 perf tools: callchain: Fix spurious 'perf report' warnings: ignore empty callchains When the callchain tree comes to insert an empty backtrace, it raises a spurious warning about the fact we are inserting an empty. This is spurious because the radix tree assumes it did something wrong to reach this state. But it didn't, we just met an empty callchain that has to be ignored. This happens occasionally with certain types of call-chain recordings. If it happens it's a big nuisance as perf report output starts with thousands of warning lines. Reported-by: Ingo Molnar Signed-off-by: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith LKML-Reference: <1249690585-9145-2-git-send-email-fweisbec@gmail.com> Signed-off-by: Ingo Molnar commit 266e0e219888420a1a7cafc82e82891cf7b5a979 Author: Pierre Habouzit Date: Fri Aug 7 14:16:01 2009 +0200 perf record: Fix the -A UI for empty or non-existent perf.data 1. Ignore the -A argument if there is no perf.data file 2. Treat an empty file like a non existent file. Else, perf will try to read the perf.data header, and fail with an error. Treating an empty file like a non-existent file makes sense, since an interupted (as in SIGKILLed) perf could leave such files around, and you don't want to annoy the user with errors for files with no data in it. Signed-off-by: Pierre Habouzit Acked-by: Peter Zijlstra Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit 7eac7e9e726c1b136bd7e0ad6671ce315f48bb18 Author: Pierre Habouzit Date: Fri Aug 7 14:16:00 2009 +0200 perf util: Fix do_read() to fail on EOF instead of busy-looping While toying with perf, I've noticed that perf record can easily enter a busy loop when doing something as silly as: $ perf record -A ls Yeah, do_read here really wants to read a known size, not being able to should die(), not busy-loop ;) That was the cause for the bug. Signed-off-by: Pierre Habouzit Acked-by: Peter Zijlstra Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit ae07b63f4b6728e1f98aa5c5416cfc1280f59f51 Author: Peter Zijlstra Date: Thu Aug 6 16:48:54 2009 +0200 perf list: Fix the output to not include tracepoints without an id Stop perf list from displaying tracepoints without an id file, those are special tracepoints that are not interfaced to perfcounters so listing them is erroneous and passing them as events will produce no output. Signed-off-by: Peter Zijlstra Acked-by: Jason Baron Cc: Steven Rostedt Cc: Chris Mason Signed-off-by: Ingo Molnar commit f36a1a133a947973efb8e6a1fbdcc23e4a011437 Author: Paul Mackerras Date: Fri Aug 7 16:59:45 2009 +1000 perf_counter/powerpc: Fix oops on cpus without perf_counter hardware support If we have the powerpc perf_counter backend compiled in, but the cpu we are running on is one where we don't support the PMU, we currently oops in hw_perf_group_sched_in if we try to use any counters, because ppmu is NULL in that case, and we unconditionally dereference ppmu. This fixes the problem by adding a check if ppmu is NULL at the beginning of hw_perf_group_sched_in, and also at the beginning of the other functions that get called from the perf_counter core, i.e. hw_perf_disable, hw_perf_enable, and hw_perf_counter_setup. Signed-off-by: Paul Mackerras Cc: Peter Zijlstra Cc: benh@kernel.crashing.org Signed-off-by: Ingo Molnar commit b26bc5a7f81474937e427b0c855eabee5ad56f89 Author: Brice Goglin Date: Fri Aug 7 10:18:39 2009 +0200 perf stat: Fix tool option consistency: rename -S/--scale to -c/--scale We want to use a coherent flag for -S/--stat across all tools, so free up -S in perf stat. Signed-off-by: Brice Goglin Cc: Peter Zijlstra Cc: paulus@samba.org Signed-off-by: Ingo Molnar commit 94cb9e385d5b4d55a5ae389baa10ad2835ea39bb Author: Arnaldo Carvalho de Melo Date: Thu Aug 6 14:43:17 2009 -0300 perf report: Add debug help for the finding of symbol bugs - show the symtab origin (DSO, build-id, kernel, etc) Used with perf report --verbose: [acme@doppio linux-2.6-tip]$ perf report -v | head -16 5.17% firefox /usr/lib64/xulrunner-1.9.1/libxul.so 0x00000000005d8eee f [.] imgContainer::DrawFrameTo(gfxIImageFrame*, gfxIImageFrame*, nsRect&) 2.56% firefox /lib64/libpthread-2.10.1.so 0x0000000000008e02 d [.] __pthread_mutex_lock_internal 1.94% firefox /usr/lib64/xulrunner-1.9.1/libxul.so 0x0000000000d0af8f f [.] SearchTable 1.75% firefox [kernel] 0xffffffffff60013b k [.] vread_hpet 1.63% firefox /lib64/libpthread-2.10.1.so 0x000000000000a404 d [.] __pthread_mutex_unlock 1.47% firefox /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x00000000000482ea f [.] js_Interpret 1.42% firefox /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x000000000003eda3 f [.] JS_CallTracer 1.24% firefox [kernel] 0xffffffff8102ca4a k [k] read_hpet 1.16% firefox [kernel] 0xffffffff810f3dd4 k [k] fget_light 1.11% firefox /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x00000000000567ff f [.] js_TraceObject 0.98% firefox /usr/lib64/firefox-3.5.2/firefox 0x000000000000dd23 b [.] arena_ralloc [acme@doppio linux-2.6-tip]$ The new field is just after the symbol address. To help in figuring out symbol resolution bugs. Signed-off-by: Arnaldo Carvalho de Melo Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar commit 8f18aec535b5ca513dd13b531730177d35175ffa Author: Peter Zijlstra Date: Thu Aug 6 19:40:28 2009 +0200 perf report: Fix per task mult-counter stat reporting Brice Goglin reported: > I can easily sort them by thread id, but I don't know how to match > my 4 events with each group of 4 lines. Also report the counter id and the time running/enabled stats (in case the counter got time-shared). Reported-by: Brice Goglin Signed-off-by: Peter Zijlstra Tested-by: Brice Goglin Signed-off-by: Ingo Molnar commit 1c222bce7dd0cb9578b4c5cd3874a74f1db497c3 Author: Peter Zijlstra Date: Thu Aug 6 20:57:41 2009 +0200 perf tools: Fix multi-counter stat bug caused by incorrect reading of perf.data file header Brice Goglin reported that only the first result from a multi-counter perf record --stat run is accurate, the rest looks bogus. A silly mistake made us re-read the first attribute for every recorded attribute. Reported-by: Brice Goglin Signed-off-by: Peter Zijlstra Tested-by: Brice Goglin Cc: paulus@samba.org Signed-off-by: Ingo Molnar commit 1953287bfe8afcbbd235bd6c42c9df06d52438dc Author: Frederic Weisbecker Date: Fri Aug 7 07:11:05 2009 +0200 perf tools: Fix call-chain cumul hit based sub-total (fractal mode) The callchain fractal mode builds each new total hits in a new branch of profiling by using the parent's hits of the current branch plus the hits of the children. This is wrong, the total hits of a branch should be made of the sum of every children hits, we must ignore the parent hits in this scope. This patch also fixes another mistake with the hit counting. Now the rates are correct. Signed-off-by: Frederic Weisbecker Cc: Frederic Weisbecker Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Mike Galbraith Cc: Pekka Enberg Signed-off-by: Ingo Molnar commit 836179834833272f89098c6d1e1b89e8e69797c2 Author: Mike Galbraith Date: Tue Aug 4 10:24:41 2009 +0200 perf top: Update man page perf_counter tools: update perf top manual page to reflect current implementation. Signed-off-by: Mike Galbraith Cc: Peter Zijlstra Signed-off-by: Ingo Molnar commit 091bd2e993fcb1094a23e36157285b62bc87afdf Author: Mike Galbraith Date: Tue Aug 4 10:21:23 2009 +0200 perf top: Improve interactive key handling Pressing any key which is not currently mapped to functionality, based on startup command line options, displays currently mapped keys, and prompts for input. Pressing any unmapped key at the prompt returns the user to display mode with variables unchanged. eg, pressing ? etc displays currently available keys, the value of the variable associated with that key, and prompts. Pressing same again aborts input. Signed-off-by: Mike Galbraith Cc: Peter Zijlstra Signed-off-by: Ingo Molnar commit 7b4b6658e152ed4568cfff48175d93645df081d1 Author: Peter Zijlstra Date: Wed Jul 22 09:29:32 2009 +0200 perf_counter: Fix software counters for fast moving event sources Reimplement the software counters to deal with fast moving event sources (such as tracepoints). This means being able to generate multiple overflows from a single 'event' as well as support throttling. Signed-off-by: Peter Zijlstra Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit 46ab976443c6c566c8fe6fc72a6733a55ba9fbea Author: Mike Galbraith Date: Fri Jul 24 10:09:50 2009 +0200 perf_counter tools: Allow perf top top users to switch between weighted and individual counter display Add [w]eighted hotkey. Pressing [w] toggles between displaying weighted total of all counters, and the counter selected via [E]vent select key. ------------------------------------------------------------------------------ PerfTop: 90395 irqs/sec kernel:16.1% [cache-misses/cache-references/instructions], (all, 4 CPUs) ------------------------------------------------------------------------------ weight samples pcnt RIP kernel function ______ _______ _____ ________________ _______________ 1275408.6 10881 - 5.3% - ffffffff81146f70 : copy_page_c 553683.4 43569 - 21.3% - ffffffff81146f20 : clear_page_c 74075.0 6768 - 3.3% - ffffffff81147190 : copy_user_generic_string 40602.9 7538 - 3.7% - ffffffff81284ba2 : _spin_lock 26882.1 965 - 0.5% - ffffffff8109d280 : file_ra_state_init [w] ------------------------------------------------------------------------------ PerfTop: 91221 irqs/sec kernel:14.5% [10000Hz cache-misses], (all, 4 CPUs) ------------------------------------------------------------------------------ weight samples pcnt RIP kernel function ______ _______ _____ ________________ _______________ 47320.00 - 22.3% - ffffffff81146f20 : clear_page_c 14261.00 - 6.7% - ffffffff810992f5 : __rmqueue 11046.00 - 5.2% - ffffffff81146f70 : copy_page_c 7842.00 - 3.7% - ffffffff81284ba2 : _spin_lock 7234.00 - 3.4% - ffffffff810aa1d6 : unmap_vmas Signed-off-by: Mike Galbraith Signed-off-by: Peter Zijlstra Signed-off-by: Ingo Molnar commit 923c42c19944da214d697e312a040384a0e33e78 Author: Mike Galbraith Date: Wed Jul 22 20:36:03 2009 +0200 perf_counter tools: Fix/resurrect perf top annotation in a simple interactive form perf top used to have annotation support, but it has bitrotted and removed. This patch restores that: it allows the user to select any symbol in kernel space for source level annotation on the fly, switch between event counters and alter display variables. When symbol details are being displayed, stopping annotation reverts to normal. known keys: [d] select display delay. [e] select display entries (lines). [E] select annotation event counter. [f] select normal display count filter. [F] select annotation display count filter (percentage). [qQ] quit. [s] select annotation symbol and start annotation. [S] stop annotation, revert to normal display. [z] toggle event count zeroing. Sample: ------------------------------------------------------------------------------ PerfTop: 16719 irqs/sec kernel:78.7% [cache-misses/cache-references/instructions/cycles], (all, 4 CPUs) ------------------------------------------------------------------------------ Showing cache-misses for e1000_clean_rx_irq Events Pcnt (>=3%) 0 0.0% /* adjust length to remove Ethernet CRC */ 0 0.0% if (!(adapter->flags2 & FLAG2_CRC_STRIPPING)) 0 0.0% length -= 4; 436 5.0% f039: 41 f6 84 24 5c 29 00 testb $0x1,0x295c(%r12) 0 0.0% f089: 8b 4d 84 mov -0x7c(%rbp),%ecx 0 0.0% f08c: 48 83 ef 02 sub $0x2,%rdi 0 0.0% f090: 48 83 ee 02 sub $0x2,%rsi 811 9.3% f094: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) 0 0.0% 0 0.0% while (rx_desc->status & E1000_RXD_STAT_DD) { 0 0.0% f114: 41 f6 47 0c 01 testb $0x1,0xc(%r15) 7226 82.6% f119: 0f 85 24 fe ff ff jne ef43 Available events: 0 cache-misses 1 cache-references 2 instructions 3 cycles Enter details event counter: 2 ------------------------------------------------------------------------------ PerfTop: 15035 irqs/sec kernel:79.0% [cache-misses/cache-references/instructions/cycles], (all, 4 CPUs) ------------------------------------------------------------------------------ Showing instructions for e1000_clean_rx_irq Events Pcnt (>=3%) 0 0.0% int *work_done, int work_to_do) 0 0.0% { 175 0.9% eebf: 55 push %rbp 1898 9.8% eec0: 48 89 e5 mov %rsp,%rbp 0 0.0% 0 0.0% i = rx_ring->next_to_clean; 140 0.7% ef0a: 0f b7 41 1a movzwl 0x1a(%rcx),%eax 670 3.4% ef0e: 89 45 ac mov %eax,-0x54(%rbp) 0 0.0% { 0 0.0% memcpy(skb->data + offset, from, len); 91 0.5% f07b: 49 8b b6 e8 00 00 00 mov 0xe8(%r14),%rsi 1153 5.9% f082: 48 8b b8 e8 00 00 00 mov 0xe8(%rax),%rdi 42 0.2% f089: 8b 4d 84 mov -0x7c(%rbp),%ecx 14 0.1% f08c: 48 83 ef 02 sub $0x2,%rdi 0 0.0% f090: 48 83 ee 02 sub $0x2,%rsi 1618 8.3% f094: f3 a4 rep movsb %ds:(%rsi),%es:(%rdi) 0 0.0% 0 0.0% /* return some buffers to hardware, one at a time is too slow */ 0 0.0% if (cleaned_count >= E1000_RX_BUFFER_WRITE) { 867 4.5% f0e7: 83 7d b0 0f cmpl $0xf,-0x50(%rbp) 0 0.0% 0 0.0% while (rx_desc->status & E1000_RXD_STAT_DD) { 37 0.2% f114: 41 f6 47 0c 01 testb $0x1,0xc(%r15) 4047 20.8% f119: 0f 85 24 fe ff ff jne ef43 Signed-off-by: Mike Galbraith Signed-off-by: Peter Zijlstra Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit f413cdb80ce00ec1a4d0ab949b5d96c81cae7f75 Author: Frederic Weisbecker Date: Fri Aug 7 01:25:54 2009 +0200 perf_counter: Fix/complete ftrace event records sampling This patch implements the kernel side support for ftrace event record sampling. A new counter sampling attribute is added: PERF_SAMPLE_TP_RECORD which requests ftrace events record sampling. In this case if a PERF_TYPE_TRACEPOINT counter is active and a tracepoint fires, we emit the tracepoint binary record to the perfcounter event buffer, as a sample. Result, after setting PERF_SAMPLE_TP_RECORD attribute from perf record: perf record -f -F 1 -a -e workqueue:workqueue_execution perf report -D 0x21e18 [0x48]: event: 9 . . ... raw event: size 72 bytes . 0000: 09 00 00 00 01 00 48 00 d0 c7 00 81 ff ff ff ff ......H........ . 0010: 0a 00 00 00 0a 00 00 00 21 00 00 00 00 00 00 00 ........!...... . 0020: 2b 00 01 02 0a 00 00 00 0a 00 00 00 65 76 65 6e +...........eve . 0030: 74 73 2f 31 00 00 00 00 00 00 00 00 0a 00 00 00 ts/1........... . 0040: e0 b1 31 81 ff ff ff ff ....... . 0x21e18 [0x48]: PERF_EVENT_SAMPLE (IP, 1): 10: 0xffffffff8100c7d0 period: 33 The raw ftrace binary record starts at offset 0020. Translation: struct trace_entry { type = 0x2b = 43; flags = 1; preempt_count = 2; pid = 0xa = 10; tgid = 0xa = 10; } thread_comm = "events/1" thread_pid = 0xa = 10; func = 0xffffffff8131b1e0 = flush_to_ldisc() What will come next? - Userspace support ('perf trace'), 'flight data recorder' mode for perf trace, etc. - The unconditional copy from the profiling callback brings some costs however if someone wants no such sampling to occur, and needs to be fixed in the future. For that we need to have an instant access to the perf counter attribute. This is a matter of a flag to add in the struct ftrace_event. - Take care of the events recursivity! Don't ever try to record a lock event for example, it seems some locking is used in the profiling fast path and lead to a tracing recursivity. That will be fixed using raw spinlock or recursivity protection. - [...] - Profit! :-) Signed-off-by: Frederic Weisbecker Cc: Li Zefan Cc: Tom Zanussi Cc: Arnaldo Carvalho de Melo Cc: Peter Zijlstra Cc: Mike Galbraith Cc: Steven Rostedt Cc: Paul Mackerras Cc: Pekka Enberg Cc: Gabriel Munteanu Cc: Lai Jiangshan Signed-off-by: Ingo Molnar commit 3a6593050fbd8bbcaed3a44d01c31d907315c86c Author: Peter Zijlstra Date: Tue Jul 21 17:34:57 2009 +0200 perf_counter, ftrace: Fix perf_counter integration Adds possible second part to the assign argument of TP_EVENT(). TP_perf_assign( __perf_count(foo); __perf_addr(bar); ) Which, when specified make the swcounter increment with @foo instead of the usual 1, and report @bar for PERF_SAMPLE_ADDR (data address associated with the event) when this triggers a counter overflow. Signed-off-by: Peter Zijlstra Acked-by: Steven Rostedt Cc: Frederic Weisbecker Cc: Jason Baron Cc: Paul Mackerras Signed-off-by: Ingo Molnar commit e3560336be655c6791316482fe288b119f34c427 Merge: 26528e7 7b2aa03 Author: Ingo Molnar Date: Sun Aug 9 12:46:45 2009 +0200 Merge branch 'linus' into tracing/urgent Merge reason: Merge up to almost-rc6 to pick up latest perfcounters (on which we'll queue up a dependent fix) Signed-off-by: Ingo Molnar commit b4a2f5e723e4f7df46731106faf9e2405673c073 Author: Gleb Natapov Date: Sun Jul 5 18:48:11 2009 +0300 KVM: Avoid redelivery of edge interrupt before next edge The check for an edge is broken in current ioapic code. ioapic->irr is cleared on each edge interrupt by ioapic_service() and this makes old_irr != ioapic->irr condition in kvm_ioapic_set_irq() to be always true. The patch fixes the code to properly recognise edge. Some HW emulation calls set_irq() without level change. If each such call is propagated to an OS it may confuse a device driver. This is the case with keyboard device emulation and Windows XP x64 installer on SMP VM. Each keystroke produce two interrupts (down/up) one interrupt is submitted to CPU0 and another to CPU1. This confuses Windows somehow and it ignores keystrokes. Signed-off-by: Gleb Natapov Signed-off-by: Avi Kivity commit fdb8a42742ac95606668f73481dfb2f760658fdd Author: Roel Kluin Date: Thu Aug 6 15:58:13 2009 -0700 x86: fix buffer overflow in efi_init() If the vendor name (from c16) can be longer than 100 bytes (or missing a terminating null), then the null is written past the end of vendor[]. Found with Parfait, http://research.sun.com/projects/parfait/ Signed-off-by: Roel Kluin Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: H. Peter Anvin Cc: Huang Ying commit 6cb504c29b1338925c83e4430e42a51eaa43781e Author: Frans Pop Date: Sun Aug 9 12:25:29 2009 +1000 drm/i915: silence vblank warnings these errors are pretty pointless Reviewed-by: Jesse Barnes Signed-off-by: Dave Airlie commit 8d3457ec3198a569dd14dc9e3ae8b6163bcaa0b5 Author: Paul Rolland Date: Sun Aug 9 12:24:01 2009 +1000 drm: silence pointless vblank warning. Some applications/hardware combinations are triggering the message "failed to acquire vblank counter" to be issued up to 20 times a second, which makes it both useless and dangerous, as this may hide other important messages. This changes makes it only appear when people are debugging. Signed-off-by: Paul Rolland Reviewed-by: Jesse Barnes Lost-twice-by: Dave Airlie Signed-off-by: Dave Airlie commit 38d5487db7f289be1d56ac7df704ee49ed3213b9 Author: Keith Packard Date: Mon Jul 20 14:49:17 2009 -0700 drm: When adding probed modes, preserve duplicate mode types The code which takes probed modes and adds them to a connector eliminates duplicate modes by comparing them using drm_mode_equal. That function doesn't consider the type bits, which means that any modes which differ only in the type field will be lost. One of the bits in the mode->type field is the DRM_MODE_TYPE_PREFERRED bit. If the mode with that bit is lost, then higher level code will not know which mode to select, causing a random mode to be used instead. This patch simply merges the two mode type bits together; that seems reasonable to me, but perhaps only a subset of the bits should be used? None of these can be user defined as they all come from looking at just the hardware. Signed-off-by: Keith Packard Signed-off-by: Dave Airlie commit 17d42c1c497aa54952b9e58c1502a46f0df40315 Author: Stanislaw Gruszka Date: Thu Aug 6 16:03:30 2009 -0700 posix_cpu_timers_exit_group(): Do not use thread_group_cputimer() When the process exits we don't have to run new cputimer nor use running one (as it not accounts when tsk->exit_state != 0) to get process CPU times. As there is only one thread we can just use CPU times fields from task and signal structs. Signed-off-by: Stanislaw Gruszka Cc: Peter Zijlstra Cc: Roland McGrath Cc: Vitaly Mayatskikh Signed-off-by: Andrew Morton Signed-off-by: Ingo Molnar commit 26528e773ecc74fb1b61b7275f86f761cbb340ec Author: Tom Zanussi Date: Sat Aug 8 10:49:53 2009 -0500 tracing/filters: Always free pred on filter_add_subsystem_pred() failure If filter_add_subsystem_pred() fails due to ENOSPC or ENOMEM, the pred doesn't get freed, while as a side effect it does for other errors. Make it so the caller always frees the pred for any error. Signed-off-by: Tom Zanussi Cc: Steven Rostedt Cc: Frederic Weisbecker Cc: Li Zefan LKML-Reference: <1249746593.6453.32.camel@tropicana> Signed-off-by: Ingo Molnar commit 96b2de313b1e0e02aea80ee47df6a2b5cbdf8e13 Author: Tom Zanussi Date: Sat Aug 8 10:49:09 2009 -0500 tracing/filters: Don't use pred on alloc failure Dan Carpenter sent me a fix to prevent pred from being used if it couldn't be allocated. I noticed the same problem also existed for the create_pred() case and added a fix for that. Reported-by: Dan Carpenter Signed-off-by: Tom Zanussi Cc: Steven Rostedt Cc: Frederic Weisbecker Cc: Li Zefan LKML-Reference: <1249746549.6453.29.camel@tropicana> Signed-off-by: Ingo Molnar commit 498cdbfbcf98e0d2c90a26e6a02a82f043876e48 Author: Ozan Çağlayan Date: Tue Aug 4 19:39:31 2009 +0300 x86: Add quirk to make Apple MacBookPro5,1 use reboot=pci MacBookPro5,1 is not able to reboot unless reboot=pci is set. This patch forces it through a DMI quirk specific to this device. Signed-off-by: Ozan Çağlayan LKML-Reference: <1249403971-6543-1-git-send-email-ozan@pardus.org.tr> Signed-off-by: Ingo Molnar commit ad7d6c7a0654a4bbda3e109f56af713267e96274 Author: Yinghai Lu Date: Tue Aug 4 09:01:33 2009 -0700 x86/irq: Fix move_irq_desc() for nodes without ram Don't move it if target node is -1. Signed-off-by: Yinghai Lu LKML-Reference: <4A785B5D.4070702@kernel.org> Signed-off-by: Ingo Molnar commit 087d7e56deffb611a098e7e257388a41edbeef1f Author: Yinghai Lu Date: Tue Aug 4 08:59:59 2009 -0700 x86: Fix MSI-X initialization by using online_mask for x2apic target_cpus found a system where x2apic reports an MSI-X irq initialization failure: [ 302.859446] igbvf 0000:81:10.4: enabling device (0000 -> 0002) [ 302.874369] igbvf 0000:81:10.4: using 64bit DMA mask [ 302.879023] igbvf 0000:81:10.4: using 64bit consistent DMA mask [ 302.894386] igbvf 0000:81:10.4: enabling bus mastering [ 302.898171] igbvf 0000:81:10.4: setting latency timer to 64 [ 302.914050] reserve_memtype added 0xefb08000-0xefb0c000, track uncached-minus, req uncached-minus, ret uncached-minus [ 302.933839] reserve_memtype added 0xefb28000-0xefb29000, track uncached-minus, req uncached-minus, ret uncached-minus [ 302.940367] alloc irq_desc for 265 on node 4 [ 302.956874] alloc kstat_irqs on node 4 [ 302.959452] alloc irq_2_iommu on node 0 [ 302.974328] igbvf 0000:81:10.4: irq 265 for MSI/MSI-X [ 302.977778] alloc irq_desc for 266 on node 4 [ 302.980347] alloc kstat_irqs on node 4 [ 302.995312] free_memtype request 0xefb28000-0xefb29000 [ 302.998816] igbvf 0000:81:10.4: Failed to initialize MSI-X interrupts. ... it turns out that when trying to enable MSI-X, __assign_irq_vector(new, cfg_new, apic->target_cpus()) can not get vector because for x2apic target-cpus returns cpumask_of(0) Update that to online_mask like xapic. Signed-off-by: Yinghai Lu Acked-by: Suresh Siddha LKML-Reference: <4A785AFF.3050902@kernel.org> Signed-off-by: Ingo Molnar commit 7b2aa037e878c939676675969983284a02958ae3 Merge: 710ad84 cf7fdd5 Author: Linus Torvalds Date: Fri Aug 7 19:06:36 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: fix oops on disconnect in cdc-acm USB: storage: include Prolific Technology USB drive in unusual_devs list USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable USB: EHCI: fix counting of transaction error retries USB: EHCI: fix two new bugs related to Clear-TT-Buffer USB: usbfs: fix -ENOENT error code to be -ENODEV USB: musb: fix the nop registration for OMAP3EVM USB: devio: Properly do access_ok() checks USB: pl2303: New vendor and product id commit 710ad849ae76bc2f938a885e928b90cdbbe61a6e Merge: b32b8e6 749d00d Author: Linus Torvalds Date: Fri Aug 7 19:06:13 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6 * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: Staging: rspiusb: Fix buffer overflow staging: add dependencies on PCI for drivers that require it Staging: rtl8192su: fix build error Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API Staging: rt2870: Add USB ID for Linksys, Planex Communications, Belkin commit b32b8e645ea764620ececc0c9a66a7fc08536d4d Merge: d6a0967 819e006 Author: Linus Torvalds Date: Fri Aug 7 19:03:59 2009 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: (22 commits) drm/i915: Fix read outside array bounds in restoring the SWF10 range. drm/i915: Use our own workqueue to avoid wedging the system along with the GPU. drm/i915: Add support for dual-channel LVDS on 8xx. drm/i915: Return disconnected for SDVO DVI when there's no digital EDID. drm/i915: Choose real sdvo output according to result from detection drm/i915: Set preferred mode for integrated TV according to TV format drm/i915: fix 845G FIFO size & burst length drm/i915: fix VGA detect on IGDNG drm/i915: Add eDP support on IGDNG mobile chip drm/i915: enable DisplayPort support on IGDNG drm/i915: Fix channel ending action for DP aux transaction drm/i915: fix issue in display pipe setup on IGDNG drm/i915: disable VGA plane reliably drm/I915: Fix offset to DVO timings in LVDS data drm/i915: hdmi detection according by reading edid drm/i915: correct self-refresh calculation in "everything off" case drm/i915: handle FIFO oversubsription correctly drm/i915: FIFO watermark calculation fixes drm/i915: ignore lvds on AOpen Mini PC MP-915 drm/i915: Allow frame buffers up to 4096x4096 on 915/945 class hardware ... commit d6a0967c90dced0a8baf502e6f3d5862fd5a5805 Merge: fb38500 ceab36e Author: Linus Torvalds Date: Fri Aug 7 19:03:09 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable: Btrfs: fix balancing oops when invalidate_inode_pages2 returns EBUSY Btrfs: correct error-handling zlib error handling Btrfs: remove superfluous NULL pointer check in btrfs_rename() Btrfs: make sure the async caching thread advances the key Btrfs: fix btrfs_remove_from_free_space corner case commit fb385003c4ac9634cf2448f6ded81e5fd1190c1f Merge: 36b8659 b36ec04 Author: Linus Torvalds Date: Fri Aug 7 18:53:44 2009 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/hch/xfs-icache-races * git://git.kernel.org/pub/scm/linux/kernel/git/hch/xfs-icache-races: xfs: fix freeing of inodes not yet added to the inode cache vfs: add __destroy_inode vfs: fix inode_init_always calling convention commit 749d00dbf154fc2f9ac59df669205039de0d5b45 Author: Roel Kluin Date: Fri Aug 7 21:00:10 2009 +0200 Staging: rspiusb: Fix buffer overflow usb_buffer_map_sg() may return -1. This will result in a read from pdx->PixelUrb[frameInfo][-1] Signed-off-by: Roel Kluin Signed-off-by: Greg Kroah-Hartman commit 5fb4d2525b6dcffbb8bc26a7dfc7ed17ad323a06 Author: Jeff Mahoney Date: Fri Aug 7 16:12:03 2009 -0700 staging: add dependencies on PCI for drivers that require it This patch adds PCI dependencies to staging drivers that require it. Signed-off-by: Jeff Mahoney Signed-off-by: Greg Kroah-Hartman commit ce9c010c5c39df05ed81a06aba492c45ee0c6f19 Author: Greg Kroah-Hartman Date: Tue Aug 4 16:53:36 2009 -0700 Staging: rtl8192su: fix build error This fixes a build error when selecting the rtl8192su driver as a module. This has been reported by me, and the opensuse kernel developer team, and I finally tracked it down. Signed-off-by: Greg Kroah-Hartman commit 2c63abf9e8a51dec886da482dfd8ae752581a61c Author: Mike Galbraith Date: Fri Jul 31 07:14:04 2009 +0200 Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API The sanity check this patch introduced triggers on shutdown, apparently due to threads having already exited by the time BUG_ON() is reached. Signed-off-by: Mike Galbraith Cc: Peter Teoh Cc: stable Signed-off-by: Greg Kroah-Hartman commit 4d2da07bc876fc5bc455e0721df388a3db7e4ba5 Author: Jakob Gruber Date: Thu Jul 30 20:37:36 2009 +0200 Staging: rt2870: Add USB ID for Linksys, Planex Communications, Belkin Linksys WUSB100, Belkin F5D8053 N, Planex Communications unknown model. Signed-off-by: Jakob Gruber Signed-off-by: Greg Kroah-Hartman commit cf7fdd57f978d40ceb9a0f58a25f5cf9c84d6f33 Author: Oliver Neukum Date: Tue Aug 4 23:52:09 2009 +0200 USB: fix oops on disconnect in cdc-acm This patch fixes an oops caused when during an unplug a device's table of endpoints is zeroed before the driver is notified. A pointer to the endpoint must be cached. this fixes a regression caused by commit 5186ffee2320942c3dc9745f7930e0eb15329ca6 Therefore it should go into 2.6.31 Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e Author: Rogerio Brito Date: Thu Aug 6 15:20:19 2009 -0700 USB: storage: include Prolific Technology USB drive in unusual_devs list Add a quirk entry for the Leading Driver UD-11 usb flash drive. As Alan Stern told me, the device doesn't deal correctly with the locking media feature of the device, and this patch incorporates it. Compiled, tested, working. Signed-off-by: Rogerio Brito Cc: Phil Dibowitz Cc: Alan Stern Cc: Robert Hancock Cc: stable Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 50d0678e2026c18e4147f0b16b5853113659b82d Author: Dhaval Vasa Date: Fri Aug 7 17:26:49 2009 +0530 USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client reference: http://www.open-rd.org Signed-off-by: Dhaval Vasa Cc: stable Signed-off-by: Greg Kroah-Hartman commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30 Author: Marko Hänninen Date: Fri Jul 31 22:32:39 2009 +0300 USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable Attached patch adds USB vendor and product IDs for Bayer's USB to serial converter cable used by Bayer blood glucose meters. It seems to be a FT232RL based device and works without any problem with ftdi_sio driver when this patch is applied. See: http://winglucofacts.com/cables/ Signed-off-by: Marko Hänninen Cc: stable Signed-off-by: Greg Kroah-Hartman commit ef4638f955f2c4a667c8af20769d03f5ed3781ca Author: Alan Stern Date: Fri Jul 31 10:41:40 2009 -0400 USB: EHCI: fix counting of transaction error retries This patch (as1274) simplifies the counting of transaction-error retries. Now we will count up from 0 to QH_XACTERR_MAX instead of down from QH_XACTERR_MAX to 0. The patch also fixes a small bug: qh->xacterr was not getting initialized for interrupt endpoints. Signed-off-by: Alan Stern Tested-by: Matthijs Kooijman Signed-off-by: Greg Kroah-Hartman commit 7a0f0d951273eee889c2441846842348ebc00a2a Author: Alan Stern Date: Fri Jul 31 10:40:22 2009 -0400 USB: EHCI: fix two new bugs related to Clear-TT-Buffer This patch (as1273) fixes two(!) bugs introduced by the new Clear-TT-Buffer implementation in ehci-hcd. It is now possible for an idle QH to have some URBs on its queue -- this will happen if a Clear-TT-Buffer is pending for the QH's endpoint. Consequently we should not issue a warning when someone tries to unlink an URB from an idle QH; instead we should process the request immediately. The refcounts for QHs could get messed up, because submit_async() would increment the refcount when calling qh_link_async() and qh_link_async() would then refuse to link the QH into the schedule if a Clear-TT-Buffer was pending. Instead we should increment the refcount only when the QH actually is added to the schedule. The current code tries to be clever by leaving the refcount alone if an unlink is immediately followed by a relink; the patch changes this to an unconditional decrement and increment (although they occur in the opposite order). Signed-off-by: Alan Stern CC: David Brownell Tested-by: Manuel Lauss Tested-by: Matthijs Kooijman Signed-off-by: Greg Kroah-Hartman commit 01105a246345f011fde64d24a601090b646e9e4c Author: Alan Stern Date: Thu Jul 30 15:28:14 2009 -0400 USB: usbfs: fix -ENOENT error code to be -ENODEV This patch (as1272) changes the error code returned when an open call for a USB device node fails to locate the corresponding device. The appropriate error code is -ENODEV, not -ENOENT. Signed-off-by: Alan Stern CC: Kay Sievers Cc: stable Signed-off-by: Greg Kroah-Hartman commit e8e2ff462dd92693f29eb848f42d3eb720390d59 Author: Gupta, Ajay Kumar Date: Wed Jul 29 11:58:57 2009 +0530 USB: musb: fix the nop registration for OMAP3EVM OMAP3EVM uses ISP1504 phy which doesn't require any programming and thus has to use NOP otg transceiver. Cleanups being done: - Remove unwanted code in usb-musb.c file - Register NOP in OMAP3EVM board file using usb_nop_xceiv_register(). - Select NOP_USB_XCEIV for OMAP3EVM boards. - Don't enable TWL4030_USB in omap3_evm_defconfig Signed-off-by: Ajay Kumar Gupta Signed-off-by: Eino-Ville Talvala Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50 Author: Michael Buesch Date: Wed Jul 29 11:39:03 2009 +0200 USB: devio: Properly do access_ok() checks access_ok() checks must be done on every part of the userspace structure that is accessed. If access_ok() on one part of the struct succeeded, it does not imply it will succeed on other parts of the struct. (Does depend on the architecture implementation of access_ok()). This changes the __get_user() users to first check access_ok() on the data structure. Signed-off-by: Michael Buesch Cc: stable Cc: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman commit 49276560c9004fce24c42e3c0ad75f34d956fc63 Author: Khanh-Dang Nguyen Thu Lam Date: Tue Jul 28 19:41:17 2009 +0200 USB: pl2303: New vendor and product id I am submitting a patch for the pl2303 driver. This patch adds support for the "Sony QN-3USB" cable (vendor=0x054c, product=0x0437). This USB cable is a so-called data cable used to connect a Sony mobile phone to a computer. Supported models are Sony CMD-J5, J6, J7, J16, J26, J70 and Z7. I have used this patch with my Sony CMD-J70 for several days and I haven't encountered any kernel/hardware issue. From: Khanh-Dang Nguyen Thu Lam Signed-off-by: Greg Kroah-Hartman commit 8a57a9dda760ea7845390f1cd36f3eb2a49391d8 Author: Roel Kluin Date: Thu Aug 6 16:07:50 2009 -0700 ocfs2: keep index within status_map[] Do not exceed array status_map[] Signed-off-by: Roel Kluin Cc: Mark Fasheh Signed-off-by: Andrew Morton Signed-off-by: Joel Becker commit e7432675f8ca868a4af365759a8d4c3779a3d922 Author: Sunil Mushran Date: Thu Aug 6 16:12:58 2009 -0700 ocfs2: Initialize the cluster we're writing to in a non-sparse extend In a non-sparse extend, we correctly allocate (and zero) the clusters between the old_i_size and pos, but we don't zero the portions of the cluster we're writing to outside of pos<->len. It handles clustersize > pagesize and blocksize < pagesize. [Cleaned up by Joel Becker.] Signed-off-by: Sunil Mushran Signed-off-by: Joel Becker commit ceab36edd3d3ad3ffd01d41d6d1e05ac1ff8357e Author: Yan Zheng Date: Fri Aug 7 13:51:33 2009 -0400 Btrfs: fix balancing oops when invalidate_inode_pages2 returns EBUSY invalidate_inode_pages2_range may return -EBUSY occasionally which results Oops. This patch fixes the issue by moving invalidate_inode_pages2_range into a loop and keeping calling it until the return value is not -EBUSY. The EBUSY return is temporary, and can happen when the btrfs release page function is unable to release a page because the EXTENT_LOCK bit is set. Signed-off-by: Yan Zheng Signed-off-by: Chris Mason commit 60f2e8f8a07331097a57ec4abcdc680405579377 Author: Julia Lawall Date: Fri Aug 7 13:51:33 2009 -0400 Btrfs: correct error-handling zlib error handling find_zlib_workspace returns an ERR_PTR value in an error case instead of NULL. A simplified version of the semantic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @match exists@ expression x, E; statement S1, S2; @@ x = find_zlib_workspace(...) ... when != x = E ( * if (x == NULL || ...) S1 else S2 | * if (x == NULL && ...) S1 else S2 ) // Signed-off-by: Julia Lawall Signed-off-by: Chris Mason commit 4baf8c9201e88546918cbfa61ea8062c38bc1644 Author: Bartlomiej Zolnierkiewicz Date: Fri Aug 7 13:47:08 2009 -0400 Btrfs: remove superfluous NULL pointer check in btrfs_rename() This takes care of the following entry from Dan's list: fs/btrfs/inode.c +4788 btrfs_rename(36) warning: variable derefenced before check 'old_inode' Reported-by: Dan Carpenter Cc: Jonathan Corbet Cc: Eugene Teo Cc: Julia Lawall Signed-off-by: Bartlomiej Zolnierkiewicz Signed-off-by: Chris Mason commit 36b8659f9316b24c514a7c8290596b2382b91dd2 Merge: cba8784 c0c60c4 Author: Linus Torvalds Date: Fri Aug 7 10:46:51 2