commit bbf25010f1a6b761914430f5fca081ec8c7accd1 Author: Linus Torvalds Date: Tue Oct 9 13:31:38 2007 -0700 Linux 2.6.23 commit a6d85430424d44e946e0946bfaad607115510989 Author: Trond Myklebust Date: Tue Oct 9 11:04:57 2007 -0400 NLM: Fix a memory leak in nlmsvc_testlock The recent fix for a circular lock dependency unfortunately introduced a potential memory leak in the event where the call to nlmsvc_lookup_host fails for some reason. Thanks to Roel Kluin for spotting this. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit baf14aa14efcfdb5a74d5cf804691086c6bec743 Author: Jeff Garzik Date: Tue Oct 9 13:51:57 2007 -0400 sata_mv: correct S/G table limits The recent mv_fill_sg() rewrite, to fix a data corruption problem related to IOMMU virtual merging, forgot to account for the potentially-increased size of the scatter/gather table after its run. Additionally, the DMA boundary is reduced from 0xffffffff to 0xffff to more closely match the needs of mv_fill_sg(). Signed-off-by: Jeff Garzik Signed-off-by: Linus Torvalds commit 2da23247935526da567e18caddb4533cfa194aa9 Author: Florian Fainelli Date: Tue Sep 25 17:07:30 2007 +0200 [MIPS] Au1000: set the PCI controller IO base The PCI controller IO base was not set in the au1000 pci code. Signed-off-by: Felix Fietkau Signed-off-by: John Crispin Signed-off-by: Florian Fainelli Signed-off-by: Ralf Baechle commit f708631ac75c901b20c7622be9abdbc29d4d2dd7 Author: Florian Fainelli Date: Tue Sep 25 17:07:24 2007 +0200 [MIPS] Alchemy: Fix USB initialization. This patch fixes a wrong ifdef in the board setup code, leading to the GPIO pin not being pulled high, and thus the USB switch not being powered at all. This finishes the rename of CONFIG_USB_OHCI to CONFIG_USB_OHCI_HCD, which started in 2005 (before 2.6.12-rc2), then probably because things were working anyway for most people got forgotten. [Ralf: Paolo's original patch didn't fix the module case, Florian's patch only fixed MTX1 etc. so this is a combined patch plus some cleanups.] Cc: Giuseppe Patanè Cc: Ralf Baechle Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Felix Fietkau Signed-off-by: John Crispin Signed-off-by: Florian Fainelli Signed-off-by: Ralf Baechle commit 378a545954abfec1c9499203206e0ffb5c2118d2 Author: Giuseppe Sacco Date: Sat Oct 6 19:55:03 2007 +0200 [MIPS] IP32: Fix fatal typo in address computation. Signed-off-by: Giuseppe Sacco Signed-off-by: Ralf Baechle commit e2a57a815933b2d2e375f9de6be223098024ab90 Author: Maarten Bressers Date: Mon Oct 8 15:59:13 2007 -0700 Correct Makefile rule for generating custom keymap When building a custom keymap, after setting GENERATE_KEYMAP := 1 in drivers/char/Makefile, the kernel build fails like this: CC drivers/char/vt.o make[2]: *** No rule to make target `drivers/char/%.map', needed by `drivers/char/defkeymap.c'. Stop. make[1]: *** [drivers/char] Error 2 make: *** [drivers] Error 2 This was caused by commit af8b128719f5248e542036ea994610a29d0642a6, which deleted a necessary colon from the Makefile rule that generates the keymap, since that rule contains both a target and a target-pattern. The following patch puts the colon back: Signed-off-by: Maarten Bressers Cc: Yoichi Yuasa Cc: Ralf Baechle Cc: Sam Ravnborg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d39d5ed97e2b8e089f85ffaf5909768d83147be0 Author: Karsten Keil Date: Mon Oct 8 12:52:09 2007 +0200 ISDN: Fix data access out of array bounds Fix against access random data bytes outside the dev->chanmap array. Thanks to Oliver Neukum for pointing me to this issue. Signed-off-by: Karsten Keil Signed-off-by: Linus Torvalds commit 87e2831c3fa39cbf6f7ab676bb5aef039b9659e2 Author: Yan Zheng Date: Mon Oct 8 12:16:20 2007 -0700 AIO: fix cleanup in io_submit_one(...) When IOCB_FLAG_RESFD flag is set and iocb->aio_resfd is incorrect, statement 'goto out_put_req' is executed. At label 'out_put_req', aio_put_req(..) is called, which requires 'req->ki_filp' set. Signed-off-by: Yan Zheng Cc: Zach Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 745ad48e8cac47beec0b2f72dc3c64424bce1fec Author: Yan Zheng Date: Mon Oct 8 10:08:37 2007 -0700 fix page release issue in filemap_fault find_lock_page increases page's usage count, we should decrease it before return VM_FAULT_SIGBUS Signed-off-by: Yan Zheng Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dd204d63cd11509081b41d7ab305fdc173382039 Author: Yan Zheng Date: Mon Oct 8 10:05:48 2007 -0700 fix VM_CAN_NONLINEAR check in sys_remap_file_pages The test for VM_CAN_NONLINEAR always fails Signed-off-by: Yan Zheng Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a200ee182a016752464a12cb2e8762e48254bb09 Author: Peter Zijlstra Date: Mon Oct 8 18:54:37 2007 +0200 mm: set_page_dirty_balance() vs ->page_mkwrite() All the current page_mkwrite() implementations also set the page dirty. Which results in the set_page_dirty_balance() call to _not_ call balance, because the page is already found dirty. This allows us to dirty a _lot_ of pages without ever hitting balance_dirty_pages(). Not good (tm). Force a balance call if ->page_mkwrite() was successful. Signed-off-by: Peter Zijlstra Signed-off-by: Linus Torvalds commit bf0b48dfc368c07c42b5a3a5658c8ee81b4283ac Author: Brian Haley Date: Mon Oct 8 00:12:05 2007 -0700 [IPv6]: Fix ICMPv6 redirect handling with target multicast address When the ICMPv6 Target address is multicast, Linux processes the redirect instead of dropping it. The problem is in this code in ndisc_redirect_rcv(): if (ipv6_addr_equal(dest, target)) { on_link = 1; } else if (!(ipv6_addr_type(target) & IPV6_ADDR_LINKLOCAL)) { ND_PRINTK2(KERN_WARNING "ICMPv6 Redirect: target address is not link-local.\n"); return; } This second check will succeed if the Target address is, for example, FF02::1 because it has link-local scope. Instead, it should be checking if it's a unicast link-local address, as stated in RFC 2461/4861 Section 8.1: - The ICMP Target Address is either a link-local address (when redirected to a router) or the same as the ICMP Destination Address (when redirected to the on-link destination). I know this doesn't explicitly say unicast link-local address, but it's implied. This bug is preventing Linux kernels from achieving IPv6 Logo Phase II certification because of a recent error that was found in the TAHI test suite - Neighbor Disovery suite test 206 (v6LC.2.3.6_G) had the multicast address in the Destination field instead of Target field, so we were passing the test. This won't be the case anymore. The patch below fixes this problem, and also fixes ndisc_send_redirect() to not send an invalid redirect with a multicast address in the Target field. I re-ran the TAHI Neighbor Discovery section to make sure Linux passes all 245 tests now. Signed-off-by: Brian Haley Acked-by: David L Stevens Signed-off-by: David S. Miller commit bf1b803b01b00c3801e0aa373ba0305f8278e260 Author: Stephen Hemminger Date: Sun Oct 7 23:57:45 2007 -0700 [PKT_SCHED] cls_u32: error code isn't been propogated properly Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 891e6a931255238dddd08a7b306871240961a27f Author: Alexey Dobriyan Date: Sun Oct 7 23:44:17 2007 -0700 [ROSE]: Fix rose.ko oops on unload Commit a3d384029aa304f8f3f5355d35f0ae274454f7cd aka "[AX.25]: Fix unchecked rose_add_loopback_neigh uses" transformed rose_loopback_neigh var into statically allocated one. However, on unload it will be kfree's which can't work. Steps to reproduce: modprobe rose rmmod rose BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008 printing eip: c014c664 *pde = 00000000 Oops: 0000 [#1] PREEMPT DEBUG_PAGEALLOC Modules linked in: rose ax25 fan ufs loop usbhid rtc snd_intel8x0 snd_ac97_codec ehci_hcd ac97_bus uhci_hcd thermal usbcore button processor evdev sr_mod cdrom CPU: 0 EIP: 0060:[] Not tainted VLI EFLAGS: 00210086 (2.6.23-rc9 #3) EIP is at kfree+0x48/0xa1 eax: 00000556 ebx: c1734aa0 ecx: f6a5e000 edx: f7082000 esi: 00000000 edi: f9a55d20 ebp: 00200287 esp: f6a5ef28 ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068 Process rmmod (pid: 1823, ti=f6a5e000 task=f7082000 task.ti=f6a5e000) Stack: f9a55d20 f9a5200c 00000000 00000000 00000000 f6a5e000 f9a5200c f9a55a00 00000000 bf818cf0 f9a51f3f f9a55a00 00000000 c0132c60 65736f72 00000000 f69f9630 f69f9528 c014244a f6a4e900 00200246 f7082000 c01025e6 00000000 Call Trace: [] rose_rt_free+0x1d/0x49 [rose] [] rose_rt_free+0x1d/0x49 [rose] [] rose_exit+0x4c/0xd5 [rose] [] sys_delete_module+0x15e/0x186 [] remove_vma+0x40/0x45 [] sysenter_past_esp+0x8f/0x99 [] trace_hardirqs_on+0x118/0x13b [] sysenter_past_esp+0x5f/0x99 ======================= Code: 05 03 1d 80 db 5b c0 8b 03 25 00 40 02 00 3d 00 40 02 00 75 03 8b 5b 0c 8b 73 10 8b 44 24 18 89 44 24 04 9c 5d fa e8 77 df fd ff <8b> 56 08 89 f8 e8 84 f4 fd ff e8 bd 32 06 00 3b 5c 86 60 75 0f EIP: [] kfree+0x48/0xa1 SS:ESP 0068:f6a5ef28 Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller commit 48611c47d09023d9356e78550d1cadb8d61da9c8 Author: Ilpo Järvinen Date: Sun Oct 7 23:43:10 2007 -0700 [TCP]: Fix fastpath_cnt_hint when GSO skb is partially ACKed When only GSO skb was partially ACKed, no hints are reset, therefore fastpath_cnt_hint must be tweaked too or else it can corrupt fackets_out. The corruption to occur, one must have non-trivial ACK/SACK sequence, so this bug is not very often that harmful. There's a fackets_out state reset in TCP because fackets_out is known to be inaccurate and that fixes the issue eventually anyway. In case there was also at least one skb that got fully ACKed, the fastpath_skb_hint is set to NULL which causes a recount for fastpath_cnt_hint (the old value won't be accessed anymore), thus it can safely be decremented without additional checking. Reported by Cedric Le Goater Signed-off-by: Ilpo Järvinen Signed-off-by: David S. Miller commit 3eb215de26e6e94bf5fed9cb77230c383b30e53b Author: Dmitry Torokhov Date: Sun Oct 7 12:22:21 2007 -0400 Driver core: fix SYSF_DEPRECATED breakage for nested classdevs We should only reparent to a class former class devices that form the base of class hierarchy. Nested devices should still grow from their real parents. Signed-off-by: Dmitry Torokhov Tested-by: Andrey Borzenkov Tested-by: Anssi Hannula Signed-off-by: Linus Torvalds commit 9d9b7ad717474636dc961e6c321970fd799e1cb3 Author: Attila Kinali Date: Sun Oct 7 00:24:38 2007 -0700 Add manufacturer and card id of teltonica pcmcia modems Add the manufacturer and card id of teltonica pcmcia modems to serial_cs.c Signed-off-by: Attila Kinali Acked-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit dfb0042d43d4e7664f7e3af1b51c9b08175483a6 Author: Pavel Machek Date: Sun Oct 7 00:24:37 2007 -0700 sysrq docs: document sequence that actually works Document sequence of keypresses that actually works. Yes, this changed year-or-so ago. Signed-off-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 291041e935e6d0513f2b7e4a300aa9f02ec1d925 Author: Al Viro Date: Sun Oct 7 00:24:36 2007 -0700 fix bogus reporting of signals by audit Async signals should not be reported as sent by current in audit log. As it is, we call audit_signal_info() too early in check_kill_permission(). Note that check_kill_permission() has that test already - it needs to know if it should apply current-based permission checks. So the solution is to move the call of audit_signal_info() between those. Bogosity in question is easily reproduced - add a rule watching for e.g. kill(2) from specific process (so that audit_signal_info() would not short-circuit to nothing), say load_policy, watch the bogus OBJ_PID entry in audit logs claiming that write(2) on selinuxfs file issued by load_policy(8) had somehow managed to send a signal to syslogd... Signed-off-by: Al Viro Acked-by: Steve Grubb Acked-by: Eric Paris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7a5c5d5735e785a700a377a5fce913b8ad45a58f Author: Alexey Dobriyan Date: Sun Oct 7 00:24:34 2007 -0700 Move kasprintf.o to obj-y Modulat lguest started giving linking errors MODPOST 1 modules ERROR: "kasprintf" [drivers/lguest/lg.ko] undefined! Signed-off-by: Alexey Dobriyan Cc: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a560aa48eed66fdf78f2a2813ab7b4ca766a84ce Author: Peter Zijlstra Date: Sun Oct 7 00:24:33 2007 -0700 lockstat: documentation Provide some documentation for CONFIG_LOCK_STAT. Signed-off-by: Peter Zijlstra Acked-by: Ingo Molnar Cc: "Randy.Dunlap" Cc: Rob Landley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 52a2638bff063acb28ba3355891c49cc240cc98b Author: Rafal Bilski Date: Sun Oct 7 00:24:32 2007 -0700 Longhaul: add auto enabled "revid_errata" option VIA C3 Ezra-T has RevisionID equal to 1, but it needs RevisionKey to be 0 or CPU will ignore new frequency and will continue to work at old frequency. New "revid_errata" option will force RevisionKey to be set to 0, whatever RevisionID is. Additionaly "Longhaul" will not silently ignore unsuccessful transition. It will try to check if "revid_errata" or "disable_acpi_c3" options need to be enabled for this processor/system. Same for Longhaul ver. 2 support. It will be disabled if none of above options will work. Best case scenario (with patch apllied and v2 enabled): longhaul: VIA C3 'Ezra' [C5C] CPU detected. Longhaul v2 supported. longhaul: Using northbridge support. longhaul: VRM 8.5 longhaul: Max VID=1.350 Min VID=1.050, 13 possible voltage scales longhaul: f: 300000 kHz, index: 0, vid: 1050 mV [...] longhaul: Voltage scaling enabled. Worst case scenario: longhaul: VIA C3 'Ezra-T' [C5M] CPU detected. Powersaver supported. longhaul: Using northbridge support. longhaul: Using ACPI support. longhaul: VRM 8.5 longhaul: Claims to support voltage scaling but min & max are both 1.250. Voltage scaling disabled longhaul: Failed to set requested frequency! longhaul: Enabling "Ignore Revision ID" option. longhaul: Failed to set requested frequency! longhaul: Disabling ACPI C3 support. longhaul: Disabling "Ignore Revision ID" option. longhaul: Failed to set requested frequency! longhaul: Enabling "Ignore Revision ID" option. [akpm@linux-foundation.org: coding-style cleanups] Signed-off-by: Rafal Bilski Signed-off-by: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 74922be1485818ed368c4cf4f0b100f70bf01e08 Author: Anton Blanchard Date: Sun Oct 7 00:24:31 2007 -0700 Fix timer_stats printout of events/sec When using /proc/timer_stats on ppc64 I noticed the events/sec field wasnt accurate. Sometimes the integer part was incorrect due to rounding (we werent taking the fractional seconds into consideration). The fraction part is also wrong, we need to pad the printf statement and take the bottom three digits of 1000 times the value. Signed-off-by: Anton Blanchard Acked-by: Ingo Molnar Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 0c2043abefacac97b6d01129c1123a466c95b7c1 Author: Linus Torvalds Date: Sun Oct 7 16:17:38 2007 -0700 Don't do load-average calculations at even 5-second intervals It turns out that there are a few other five-second timers in the kernel, and if the timers get in sync, the load-average can get artificially inflated by events that just happen to coincide. So just offset the load average calculation it by a timer tick. Noticed by Anders Boström, for whom the coincidence started triggering on one of his machines with the JBD jiffies rounding code (JBD is one of the subsystems that also end up using a 5-second timer by default). Tested-by: Anders Boström Cc: Chuck Ebbert Cc: Arjan van de Ven Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 70cb97935b8859f27296772885104b599f560576 Author: Linus Torvalds Date: Sun Oct 7 16:02:55 2007 -0700 VT_WAITACTIVE: Avoid returning EINTR when not necessary We should generally prefer to return ERESTARTNOHAND rather than EINTR, so that processes with unhandled signals that get ignored don't return EINTR. This can help with X startup issues: Fatal server error: xf86OpenConsole: VT_WAITACTIVE failed: Interrupted system call although the real fix is having the X server always retry EINTR regardless (since EINTR does happen for signals that have handlers installed). Keithp has a patch for that. Regardless, ERESTARTNOHAND is the correct thing to use. Signed-off-by: Linus Torvalds commit a1134dd48d59e532b801659163539bf01cae7673 Author: Stefan Richter Date: Sun Oct 7 12:31:22 2007 +0200 firewire: point to migration document Signed-off-by: Stefan Richter commit 3a4986955c0d9806e96a9d738ef7c40cb0cdaba3 Author: Kyle McMartin Date: Sat Oct 6 01:42:34 2007 -0400 Revert "intel_agp: fix stolen mem range on G33" This reverts commit f443675affe3f16dd428e46f0f7fd3f4d703eeab, which breaks horribly if you aren't running an unreleased xf86-video-intel driver out of git. Signed-off-by: Kyle McMartin Cc: Dave Airlie Cc: Zhenyu Wang Acked-by: Keith Packard Signed-off-by: Linus Torvalds commit 71e4eda8ce698178ee448ff82bdc5803c77a736d Author: Benjamin Herrenschmidt Date: Sat Oct 6 18:52:27 2007 +1000 Fix non-terminated PCI match table in PowerMac IDE The PCI device table in the powermac IDE driver isn't properly terminated. Depending on how your kernel is linked and other random factors, you can end up with this driver matched against any other PCI device in your system, possibly crashing at boot. Thanks to Heikki for tracking this down with me, the bug have been there for some time, though it rarely hurts due to luck. In this case, the switch from .22 to .23-rc9 is causing it to show up due to differences in the resulting layout of .data I suppose. Signed-off-by: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Bartlomiej Zolnierkiewicz Cc: Heikki Lindholm Signed-off-by: Linus Torvalds commit 67dd5a25f4efbfccf973159429cb20acdc5b0e0e Author: Jeremy Fitzhardinge Date: Fri Oct 5 17:19:35 2007 -0700 xen: disable split pte locks for now When pinning and unpinning pagetables, we must protect them against being used by other CPUs, lest they see the pagetable in an intermediate read-only-but-not-pinned state. When using split pte locks, doing this properly would require taking all the pte locks for the pagetable while pinning, but this may overflow the PREEMPT_BITS part of the preempt counter if the process has mapped more than about 512M of memory. However, failing to take the pte locks causes write-protect faults when the pageout code is trying to clear the Access bit on a pte which is part of a freshy created and still being pinned process after fork. This is a short-term fix until the problem is solved properly. Signed-off-by: Jeremy Fitzhardinge Acked-by: Rik van Riel Acked-by: Hugh Dickins Cc: David Rientjes Cc: Andrew Morton Cc: Andi Kleen Cc: Keir Fraser Cc: Jan Beulich Signed-off-by: Linus Torvalds commit 4afcddae4cc7d8bb36c1d47967d6ede29ea45e1a Author: Ben Dooks Date: Thu Oct 4 23:18:08 2007 +0100 [ARM] 4598/2: OSIRIS: Ensure we do not get nRSTOUT during suspend Ensure nRSTOUT is not asserted during or on resume. Signed-off-by: Ben Dooks Signed-off-by: Russell King commit 28047eced817b3b7cd404fac4b26f29fcf04f1f7 Author: Ben Dooks Date: Thu Oct 4 23:16:42 2007 +0100 [ARM] 4597/2: OSIRIS: ensure CPLD0 is preserved after suspend Ensure that CPLD is restored to the original state on resume, and that before going into suspend we select the NAND bank we booted from for restarting. Signed-off-by: Ben Dooks Signed-off-by: Russell King commit c946b3047205d7e107be16885bbb42ab9f10350a Author: Francois Romieu Date: Thu Oct 4 00:42:50 2007 +0200 r8169: revert part of 6dccd16b7c2703e8bbf8bca62b5cf248332afbe2 The 8169/8110SC currently announces itself as: [...] eth0: RTL8169sc/8110sc at 0x........, ..:..:..:..:..:.., XID 18000000 IRQ .. ^^^^^^^^ It uses RTL_GIGA_MAC_VER_05 and this part of the changeset can cut its performance by a factor of 2~2.5 as reported by Timo. (the driver includes code just before the hunk to write the ChipCmd register when mac_version == RTL_GIGA_MAC_VER_0[1-4]) Signed-off-by: Francois Romieu Cc: Timo Jantunen Signed-off-by: Jeff Garzik commit 4ecbca8554d0f643351ee07d3284138a5e85ba81 Author: Serge Belyshev Date: Thu Oct 4 23:10:04 2007 +0200 Remove unnecessary cast in prefetch() It is ok to call prefetch() function with NULL argument, as specifically commented in include/linux/prefetch.h. But in standard C, it is invalid to dereference NULL pointer (see C99 standard 6.5.3.2 paragraph 4 and note #84). prefetch() has a memory reference for its argument. Newer gcc versions (4.3 and above) will use that to conclude that "x" argument is non-null and thus wreaking havok everywhere prefetch() was inlined. Fixed by removing cast and changing asm constraint. [ It seems in theory gcc 4.2 could miscompile this too; although no cases known. In 2.6.24 we should probably switch to __builtin_prefetch() instead, but this is a simpler fix for now. -- AK ] Signed-off-by: Serge Belyshev Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit 8cfaf45367d41400ce99e1757ab5690d1fc94dbc Author: Giuseppe Sacco Date: Thu Oct 4 23:09:12 2007 +0200 [MIPS] IP32: Enable PCI bridges Fixe MACE PCI addressing by adding the bus number parameter. Remove check of the used slot since every slot should be valid. Converted mkaddr from #define to inline function. Signed-off-by: Giuseppe Sacco Signed-off-by: Ralf Baechle commit b2b27757b6f0e88e30f10c431c763523dd7858ca Author: David S. Miller Date: Thu Oct 4 15:03:35 2007 -0700 [SPARC64]: Fix 'niu' complex IRQ probing. They should be computed the same as how we compute them under 'virtual-devices'. Signed-off-by: David S. Miller commit 1177bf9704a4e4e127b961950d75ca6c94fb419b Author: Akinobu Mita Date: Thu Oct 4 14:55:59 2007 -0700 [SPARC64]: check fork_idle() error Check the return value of fork_idle() to catch error. Signed-off-by: Akinobu Mita Signed-off-by: David S. Miller commit 16abfa086096895d438b19198e408ee96da7b508 Author: Hugh Dickins Date: Thu Oct 4 16:56:06 2007 +0100 Fix sys_remap_file_pages BUG at highmem.c:15! Gurudas Pai reports kernel BUG at arch/i386/mm/highmem.c:15! below sys_remap_file_pages, while running Oracle database test on x86 in 6GB RAM: kunmap thinks we're in_interrupt because the preempt count has wrapped. That's because __do_fault expected to unmap page_table, but one of its two callers do_nonlinear_fault already unmapped it: let do_linear_fault unmap it first too, and then there's no need to pass the page_table arg down. Why have we been so slow to notice this? Probably through forgetting that the mapping_cap_account_dirty test means that sys_remap_file_pages nowadays only goes the full nonlinear vma route on a few memory-backed filesystems like ramfs, tmpfs and hugetlbfs. [ It also depends on CONFIG_HIGHPTE, so it becomes even harder to trigger in practice. Many who have need of large memory have probably migrated to x86-64.. Problem introduced by commit d0217ac04ca6591841e5665f518e38064f4e65bd ("mm: fault feedback #1") -- Linus ] Signed-off-by: Hugh Dickins Cc: gurudas pai Cc: Nick Piggin Cc: Andrew Morton Signed-off-by: Linus Torvalds commit d5e89385e92a77b2764d9eb8284808a7628cb2a8 Author: FUJITA Tomonori Date: Wed Oct 3 09:00:58 2007 +0900 [SCSI] megaraid_old: fix READ_CAPACITY The bulk transfer mode got eleminated by 3f6270ef76f2ce5c134615a470685d6c2a66c07e. Unfortunately, this mode is required for READ_CAPACITY commands on certain cards, so put it back again. This fixes a boot failure regression reported by Burton Windle. Signed-off-by: FUJITA Tomonori Signed-off-by: James Bottomley commit 27097ef9ff219c81a023911c7b0d5e7bc2419177 Author: David S. Miller Date: Wed Oct 3 21:37:57 2007 -0700 [SPARC64]: Temporary workaround for PCI-E slot on T1000. The PCI-E slot on T1000 connects directly to the Fire PCI chip with no intervening bridges visible in the OBP tree. Unfortunately the bus numbering of the device in that slot is different (2) from the PCI host controller (0), and thus the pci_bus_{read,write}_config_*() calls don't work out. Complicating things further the Fire PCI controller has no config space it responds to either. For now treat this case specially so that devices in the slot work. Longer term we need to perhaps cons up a dummy bridge between the Fire and the PCI-E slot so that the bus hierarchy is complete inside of the kernel and thus the bus numbering all works out right. Signed-off-by: David S. Miller commit e2fd58d06f79b10cad22240a6e6fb1c1108aa0ee Author: David S. Miller Date: Wed Oct 3 21:23:40 2007 -0700 [SPARC64]: VIO device addition log message level is too high. There is no reason this should be KERN_ERR, KERN_INFO is just fine. Signed-off-by: David S. Miller commit 07607c5492f836923c2ab9eb1cd1d39be7dace49 Author: David S. Miller Date: Wed Oct 3 21:08:11 2007 -0700 [SPARC64]: Fix domain-services port probing. We should only use ports underneath "domain-services", other DS ports in the MDESC aren't for us to use. Signed-off-by: David S. Miller commit 991bf528f602882580d0918842b125255d246a19 Author: Scott Thompson Date: Tue Oct 2 13:53:01 2007 -0700 drivers/ata/pata_ixp4xx_cf.c: ioremap return code check Add missing ioremap return checks. Signed-off-by: Scott Thompson hushmail.com> Acked-by: Tejun Heo Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 90925d3050253ff7b4f5d1660071df75f44bd0ff Author: Jiri Slaby Date: Tue Oct 2 13:53:01 2007 -0700 Ata: pata_marvell, use ioread* for iomap-ped memory pata_marvell, use ioread* for iomap-ped memory read* on pci_iomapped memory is incorrect, fix it Signed-off-by: Jiri Slaby Acked-by: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit 4007b493ee6e4a52c2b618ab8361847fba5bf116 Author: Olof Johansson Date: Tue Oct 2 20:45:27 2007 -0500 libata: fix for sata_mv >64KB DMA segments Fix bug in sata_mv for cases where the IOMMU layer has merged SG entries to larger than 64KB. They need to be split up before being sent to the driver. Just for simplicity's sake, split up at 64K boundary instead of 64K size, since that's what the common code does anyway. Signed-off-by: Olof Johansson Signed-off-by: Jeff Garzik commit bda0233b89c10ae46ccecb78bffdaf0fd7833d17 Author: Sunil Mushran Date: Fri Sep 21 11:41:43 2007 -0700 ocfs2: Unlock mutex in local alloc failure case The fs was not unlocking the local alloc inode mutex in the code path in which it failed to find a window of free bits in the global bitmap. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit 529d303e075aa6d988f30935b8995ffb382ad38e Author: Stephen Hemminger Date: Tue Oct 2 18:02:09 2007 -0700 sky2: jumbo frame regression fix Remove unneeded check that caused problems with jumbo frame sizes. The check was recently added and is wrong. When using jumbo frames the sky2 driver does fragmentation, so rx_data_size is less than mtu. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit cda6a20b68c1f21f4b4bc9cd3ee08494e7ebf0d5 Author: Michael Hennerich Date: Thu Oct 4 00:36:18 2007 +0800 Blackfin arch: fix PORT_J BUG for BF537/6 EMAC driver reported by Kalle Pokki Cc: Kalle Pokki Signed-off-by: Michael Hennerich Signed-off-by: Bryan Wu commit c58c2140f08de4ad0b0dbd48f6e78168dc321042 Author: Michael Hennerich Date: Thu Oct 4 00:35:05 2007 +0800 Blackfin arch: gpio pinmux and resource allocation API required by BF537 on chip ethernet mac driver Signed-off-by: Michael Hennerich Signed-off-by: Bryan Wu commit 9ea0f043fec38fadb0101fbf29563a5635f42e93 Author: Ralf Baechle Date: Wed Oct 3 14:29:19 2007 +0100 [MIPS] Terminally fix local_{dec,sub}_if_positive They contain 64-bit instructions so wouldn't work on 32-bit kernels or 32-bit hardware. Since there are no users, blow them away. They probably were only ever created because there are atomic_sub_if_positive and atomic_dec_if_positive which exist only for sake of semaphores. Signed-off-by: Ralf Baechle commit fef74705ea310acd716c2722bfeb0f796cf23640 Author: Ralf Baechle Date: Mon Oct 1 04:15:00 2007 +0100 [MIPS] Type proof reimplementation of cmpxchg. Signed-off-by: Ralf Baechle commit f6a9e6dec537dc1d9d2c62d7b8ad205d0993bddc Author: Maciej W. Rozycki Date: Tue Oct 2 14:47:22 2007 +0100 [MIPS] pg-r4k.c: Fix a typo in an R4600 v2 erratum workaround Restore a load from KSEG1 done as a workaround for an R4600 v2 erratum, dropped with 211be16de99a7424e66c0b6c0d00e2c970508ac2. Signed-off-by: Maciej W. Rozycki Signed-off-by: Ralf Baechle commit ee0a8169b693e1c708d0f9af0a5e4ade65a65439 Author: Richard Knutsson Date: Mon Oct 1 02:24:38 2007 +0200 [PATCH] softmac: Fix compiler-warning CC net/ieee80211/softmac/ieee80211softmac_wx.o /home/kernel/src/net/ieee80211/softmac/ieee80211softmac_wx.c: In function ‘ieee80211softmac_wx_set_essid’: /home/kernel/src/net/ieee80211/softmac/ieee80211softmac_wx.c:117: warning: label ‘out’ defined but not used due to commit: efe870f9f4ad74410a18ecbf0d9ba7c14b50a0fb. Removing the label. Signed-off-by: Richard Knutsson Signed-off-by: John W. Linville commit a4aa2e867c5d696c0f249ad8d63d0d983b4ffaf9 Author: David S. Miller Date: Tue Oct 2 16:17:17 2007 -0700 [SPARC64]: Don't use in/local regs for ldx/stx data in N1 memcpy. It doesn't matter for use in 64-bit objects, but when used in 32-bit environments the top 32-bits of the local and in registers will get chopped off on the next register window spill/restore which leads to difficult to track down and subtle bugs. Signed-off-by: David S. Miller commit 4365e99f9587b94010e9818a4237ce2b1c734e91 Author: Joe Perches Date: Tue Oct 2 12:57:11 2007 -0700 [PATCH] bcm43xx: Correct printk with PFX before KERN_ Correct printk with PFX before KERN_ in bcm43xx_wx.c Signed-off-by: Joe Perches Signed-off-by: John W. Linville commit d136552e8beadcf5e59089292e2ba44f09e3aad8 Author: Jeff Garzik Date: Tue Oct 2 13:16:10 2007 -0400 aic94xx: fix DMA data direction for SMP requests DMA-mapped SMP (scsi management protocol) requests going /to/ the device need the PCI DMA data direction to indicate such. Signed-off-by: Jeff Garzik commit f662fe5a0b144efadbfc00e8040e603ec318746e Author: Peter Korsgaard Date: Mon Oct 1 13:36:07 2007 +0200 dm9601: Fix receive MTU dm9601 didn't take the ethernet header into account when calculating RX MTU, causing packets bigger than 1486 to fail. Signed-off-by: Peter Korsgaard Signed-off-by: Jeff Garzik commit 593ff56ef2a23ed3a66ee87d9c9b33044b9fb193 Author: Dale Farnsworth Date: Mon Oct 1 16:02:18 2007 -0700 mv643xx_eth: Do not modify struct netdev tx_queue_len This driver erroneously zeros dev->tx_queue_len, since mp->tx_ring_size has not yet been initialized. Actually, the driver shouldn't modify tx_queue_len at all and should leave the value set by alloc_etherdev(), currently 1000. Signed-off-by: Dale Farnsworth Signed-off-by: Jeff Garzik commit 50626297b1beb0a29c0f174be39f36485533216c Author: Ron Mercer Date: Mon Oct 1 11:43:23 2007 -0700 qla3xxx: bugfix: Fix VLAN rx completion handling. Fix 4032 chip undocumented "feature" where bit-8 is set if the inbound completion is for a VLAN. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit b323e0e49fe9331ee3a7a336af879d6e303b16b3 Author: Ron Mercer Date: Mon Oct 1 11:43:22 2007 -0700 qla3xxx: bugfix: Add memory barrier before accessing rx completion. Signed-off-by: Ron Mercer Signed-off-by: Jeff Garzik commit 4c74d4ec3524a8f31deadd115139dd93bc91d598 Author: Tejun Heo Date: Sun Sep 30 01:11:20 2007 -0700 ata_piix: add another TECRA M3 entry to broken suspend list There's a different version of DMI table for TECRA M3 where it has proper vendor and product name entry. Add the entry to the broken suspend list. Angus Turnbull reported and provided initial patch. Signed-off-by: Tejun Heo Cc: Angus Turnbull Signed-off-by: Jeff Garzik commit 30084fbd1caa4b2e1a336fcdef60b68129d1d8f8 Author: Ingo Molnar Date: Tue Oct 2 14:13:08 2007 +0200 sched: fix profile=sleep fix sleep profiling - we lost this chunk in the CFS merge. Found-by: Mel Gorman Signed-off-by: Ingo Molnar commit 25e5566ed38650f7990041fcd20571d6ddd2a040 Author: David S. Miller Date: Tue Oct 2 01:03:09 2007 -0700 [SPARC64]: Fix missing load-twin usage in Niagara-1 memcpy. For the case where the source is not aligned modulo 8 we don't use load-twins to suck the data in and this kills performance since normal loads allocate in the L1 cache (unlike load-twin) and thus big memcpys swipe the entire L1 D-cache. We need to allocate a register window to implement this properly, but that actually simplifies a lot of things as a nice side-effect. Signed-off-by: David S. Miller commit 04045f98e0457aba7d4e6736f37eed189c48a5f7 Author: John W. Linville Date: Mon Oct 1 21:03:54 2007 -0700 [IEEE80211]: avoid integer underflow for runt rx frames Reported by Chris Evans : > The summary is that an evil 80211 frame can crash out a victim's > machine. It only applies to drivers using the 80211 wireless code, and > only then to certain drivers (and even then depends on a card's > firmware not dropping a dubious packet). I must confess I'm not > keeping track of Linux wireless support, and the different protocol > stacks etc. > > Details are as follows: > > ieee80211_rx() does not explicitly check that "skb->len >= hdrlen". > There are other skb->len checks, but not enough to prevent a subtle > off-by-two error if the frame has the IEEE80211_STYPE_QOS_DATA flag > set. > > This leads to integer underflow and crash here: > > if (frag != 0) > flen -= hdrlen; > > (flen is subsequently used as a memcpy length parameter). How about this? Signed-off-by: John W. Linville Signed-off-by: David S. Miller commit 9b42c336d06411e6463949d2dac63949f66ff70b Author: Eric Dumazet Date: Mon Oct 1 13:58:36 2007 -0700 [TCP]: secure_tcp_sequence_number() should not use a too fast clock TCP V4 sequence numbers are 32bits, and RFC 793 assumed a 250 KHz clock. In order to follow network speed increase, we can use a faster clock, but we should limit this clock so that the delay between two rollovers is greater than MSL (TCP Maximum Segment Lifetime : 2 minutes) Choosing a 64 nsec clock should be OK, since the rollovers occur every 274 seconds. Problem spotted by Denys Fedoryshchenko [ This bug was introduced by f85958151900f9d30fa5ff941b0ce71eaa45a7de ] Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 32740ddc1095e5e320bf961dda146bf97bc28adb Author: Alexey Kuznetsov Date: Sun Sep 30 17:51:33 2007 -0700 [SFQ]: Remove artificial limitation for queue limit. This is followup to Patrick's patch. A little optimization to enqueue routine allows to remove artificial limitation on queue length. Plus, testing showed that hash function used by SFQ is too bad or even worse. It does not even sweep the whole range of hash values. Switched to Jenkins' hash. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller commit 3146b39c185f8a436d430132457e84fa1d8f8208 Author: Linus Torvalds Date: Mon Oct 1 20:24:52 2007 -0700 Linux 2.6.23-rc9 No, I didn't want to do this, but we had more stuff go in after -rc8 than we had in the previous -rc. Gaah. commit cf8dc57cbac0fe089308f57c333ab763c36782ff Author: Andi Kleen Date: Mon Oct 1 01:20:08 2007 -0700 x86_64: increase VDSO_TEXT_OFFSET for ancient binutils For some reason old binutils genertate larger headers so increase the text offset of the vdso to avoid linker errors. Roland McGrath explains: "There are extra symbols in the '.dynsym' section that are responsible for the size difference (They also cause corresponding inflation in '.gnu.version') Older ld's wrongly generated these unneeded symbols in .dynsym. This was fixed not all that long ago (2006); binutils-2.17.50.0.6 might be the first fixed version, but I have not verified for sure where the cutoff was. The unneeded symbols et al from old ld add almost 700 bytes excess. This limits fairly tightly the amount by which the actual text and data in the vDSO can grow in the future without pushing the whole file over 4kb. If it does grow later on, we should consider changing the layout with a config option or something to pack it better without that padding, when building the kernel with newer binutils." Signed-off-by: Andi Kleen Cc: Roland McGrath Cc: Badari Pulavarty Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e48395f1753cab0fde6c03f1db833cece9ef2ba0 Author: Anton Blanchard Date: Mon Oct 1 07:45:55 2007 +1000 [POWERPC] Fix xics set_affinity code On a POWER6 machine running 2.6.23-rc8 I sometimes see the following error: xics_set_affinity: No online cpus in the mask 00000000,00000000,00000000,00000001 for irq 20 In a desperate attempt to get a changelog entry in 2.6.23, I took a look into it. It turns out we are passing a real and not a virtual irq into get_irq_server. This works for the case where hwirq < NR_IRQS and we set virq = hwirq. In my case however hwirq = 590082 and we try and access irq_desc[590082], slightly past the end at 512 entries. Lucky we ship lots of memory with our machines. Signed-off-by: Anton Blanchard Signed-off-by: Paul Mackerras commit 75723957673bfa10c98b735259f891cc79cf0450 Author: Linus Torvalds Date: Mon Oct 1 13:17:28 2007 -0700 Fix possible splice() mmap_sem deadlock Nick Piggin points out that splice isn't being good about the mmap semaphore: while two readers can nest inside each others, it does leave a possible deadlock if a writer (ie a new mmap()) comes in during that nesting. Original "just move the locking" patch by Nick, replaced by one by me based on an optimistic pagefault_disable(). And then Jens tested and updated that patch. Reported-by: Nick Piggin Tested-by: Jens Axboe Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 564256c9e06d75e16d894a2cd30604bd6582cbba Author: Tim Shimmin Date: Mon Oct 1 16:39:37 2007 +1000 Revert "[XFS] Avoid replaying inode buffer initialisation log items if on-disk version is newer." This reverts commit b394e43e995d08821588a22561c6a71a63b4ff27. Lachlan McIlroy says: It tried to fix an issue where log replay is replaying an inode cluster initialisation transaction that should not be replayed because the inode cluster on disk is more up to date. Since we don't log file sizes (we rely on inode flushing to get them to disk) then we can't just replay all the transations in the log and expect the inode to be completely restored. We lose file size updates. Unfortunately this fix is causing more (serious) problems than it is fixing. SGI-PV: 969656 SGI-Modid: xfs-linux-melb:xfs-kern:29804a Signed-off-by: Lachlan McIlroy Signed-off-by: Tim Shimmin commit 9f96cb1e8bca179a92afa40dfc3c49990f1cfc71 Author: Martin Schwidefsky Date: Mon Oct 1 01:20:13 2007 -0700 robust futex thread exit race Calling handle_futex_death in exit_robust_list for the different robust mutexes of a thread basically frees the mutex. Another thread might grab the lock immediately which updates the next pointer of the mutex. fetch_robust_entry over the next pointer might therefore branch into the robust mutex list of a different thread. This can cause two problems: 1) some mutexes held by the dead thread are not getting freed and 2) some mutexs held by a different thread are freed. The next point need to be read before calling handle_futex_death. Signed-off-by: Martin Schwidefsky Acked-by: Ingo Molnar Acked-by: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8792f961ba8057d9f27987def3600253a3ba060f Author: Samuel Ortiz Date: Mon Oct 1 01:20:12 2007 -0700 VT ioctl race fix When calling the RELDISP VT ioctl, we are reading vt_newvt while the console workqueue could be messing with it (through change_console()). We fix this race by taking the console semaphore before reading vt_newvt. Signed-off-by: Samuel Ortiz Acked-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4047727e5ae33f9b8d2b7766d1994ea6e5ec2991 Author: Mark Lord Date: Mon Oct 1 01:20:10 2007 -0700 Fix SMP poweroff hangs We need to disable all CPUs other than the boot CPU (usually 0) before attempting to power-off modern SMP machines. This fixes the hang-on-poweroff issue on my MythTV SMP box, and also on Thomas Gleixner's new toybox. Signed-off-by: Mark Lord Acked-by: Thomas Gleixner Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 281e0e3b34acb76a157576d27abc85c09fcf78e3 Author: Ralf Baechle Date: Mon Oct 1 01:20:10 2007 -0700 hugetlb: fix clear_user_highpage arguments The virtual address space argument of clear_user_highpage is supposed to be the virtual address where the page being cleared will eventually be mapped. This allows architectures with virtually indexed caches a few clever tricks. That sort of trick falls over in painful ways if the virtual address argument is wrong. Signed-off-by: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8814842fbb6d8907cd23711cc4cbc3a6a191080f Author: Dave Jones Date: Mon Oct 1 01:20:09 2007 -0700 Add /dev/oldmem to devices.txt documentation Signed-off-by: Dave Jones Cc: "H. Peter Anvin" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6f6b3940ed326eed58074d777ab92fda3a60a382 Author: Maciej W. Rozycki Date: Mon Oct 1 13:24:04 2007 +0100 [MIPS] vmlinux.lds.S: Handle note sections Store any note sections after the exception tables like the other architectures do. This is required for .note.gnu.build-id emitted from binutils 2.18 onwards if nothing else. Signed-off-by: Maciej W. Rozycki Signed-off-by: Ralf Baechle commit ca074a33928762c65e261dd94006c1b6a47e46fa Author: Ralf Baechle Date: Sun Sep 30 00:45:08 2007 +0100 [MIPS] Fix value of O_TRUNC A "cleanup" almost two years ago deleted the old definition from , so asm-generic/fcntl.h defaulted it to the the same value as FASYNC ... which happened to be the wrong thing. Signed-off-by: Ralf Baechle commit f998351c755a0e87785f2616c4f91f1b3b19b149 Author: Randy Dunlap Date: Sun Sep 30 20:35:39 2007 -0400 [PATCH] libertas: build problems when partially modular Fix missing symbols in libertas USB driver when it is modular and rest of libertas is built-in. Signed-off-by: Randy Dunlap Signed-off-by: John W. Linville commit 8cc8c28a9acdceda0e60519167a052cc3408c5c3 Author: David S. Miller Date: Sun Sep 30 17:00:34 2007 -0700 [SPARC64]: Fix put_user() calls in binfmt_aout32.c argv and envp are pointers to u32's in userspace, so don't try to put_user() a NULL to them. Aparently gcc-4.2.x now warns about this, and since we use -Werror for arch/sparc64 code, this breaks the build. Signed-off-by: David S. Miller commit 46edfc54ee2cc60db0f10d982d6b9b7850733ff2 Author: Russell King Date: Sun Sep 30 17:36:22 2007 +0100 [ARM] Resolve PCI section warnings Fix the following (valid) section warnings: WARNING: vmlinux.o(.text+0xf7b5c): Section mismatch: reference to .init.text:pcibios_fixup_bus (between 'pci_scan_child_bus' and 'pci_scan_bridge') WARNING: vmlinux.o(.text+0xfc5f4): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_map_rom' and 'pci_unmap_rom') WARNING: vmlinux.o(.text+0xfc824): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_update_resource' and 'pci_claim_resource') WARNING: vmlinux.o(.text+0xfd6d8): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd730): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd788): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfd7e0): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_setup_cardbus' and 'find_free_bus_resource') WARNING: vmlinux.o(.text+0xfe024): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') WARNING: vmlinux.o(.text+0xfe0f4): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') WARNING: vmlinux.o(.text+0xfe17c): Section mismatch: reference to .init.text:pcibios_resource_to_bus (between 'pci_bus_assign_resources' and 'sys_pciconfig_read') Signed-off-by: Russell King commit cb50f548c0ee9b2aac39743fc4021a7188825a98 Author: Ian Armstrong Date: Sat Aug 18 15:58:51 2007 -0300 V4L/DVB (6052): ivtv: fix udma yuv bug Using udma yuv causes the driver becomes locked into that mode. This prevents use of the mpeg decoder & non-udma yuv output. This patch clears the operating mode when the device is closed. Signed-off-by: Ian Armstrong Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit a64314e62d89562b6fc77593648bec3acc35bf61 Author: Jan Lübbe Date: Sat Sep 29 18:47:51 2007 +0200 fix console change race exposed by CFS The new behaviour of CFS exposes a race which occurs if a switch is requested when vt_mode.mode is VT_PROCESS. The process with vc->vt_pid is signaled before vc->vt_newvt is set. This causes the switch to fail when triggered by the monitoing process because the target is still -1. [ If the signal sending fails, the subsequent "reset_vc(vc)" will then reset vt_newvt to -1, so this works for that case too. - Linus ] Signed-off-by: Jan Lübbe Signed-off-by: Linus Torvalds commit 4827bbb06e4b59922c2b9bfb13ad1bf936bdebe5 Author: Nick Piggin Date: Sat Sep 29 15:28:48 2007 +0200 i386: remove bogus comment about memory barrier The comment being removed by this patch is incorrect and misleading. In the following situation: 1. load ... 2. store 1 -> X 3. wmb 4. rmb 5. load a <- Y 6. store ... 4 will only ensure ordering of 1 with 5. 3 will only ensure ordering of 2 with 6. Further, a CPU with strictly in-order stores will still only provide that 2 and 6 are ordered (effectively, it is the same as a weakly ordered CPU with wmb after every store). In all cases, 5 may still be executed before 2 is visible to other CPUs! The additional piece of the puzzle that mb() provides is the store/load ordering, which fundamentally cannot be achieved with any combination of rmb()s and wmb()s. This can be an unexpected result if one expected any sort of global ordering guarantee to barriers (eg. that the barriers themselves are sequentially consistent with other types of barriers). However sfence or lfence barriers need only provide an ordering partial ordering of memory operations -- Consider that wmb may be implemented as nothing more than inserting a special barrier entry in the store queue, or, in the case of x86, it can be a noop as the store queue is in order. And an rmb may be implemented as a directive to prevent subsequent loads only so long as their are no previous outstanding loads (while there could be stores still in store queues). I can actually see the occasional load/store being reordered around lfence on my core2. That doesn't prove my above assertions, but it does show the comment is wrong (unless my program is -- can send it out by request). So: mb() and smp_mb() always have and always will require a full mfence or lock prefixed instruction on x86. And we should remove this comment. Signed-off-by: Nick Piggin Cc: Paul McKenney Cc: David Howells Cc: Andi Kleen Signed-off-by: Linus Torvalds commit 2bcff60f7ce88c09a2bc1302ff14510737bfcb7b Author: Dale Farnsworth Date: Fri Sep 28 06:30:43 2007 -0700 mv643xx_eth: Check ETH_INT_CAUSE_STATE bit Commit 468d09f8946d40228c56de26fe4874b2f98067ed masked the "state" interrupt (bit 20 of the cause register). This results in Radstone's PPC7D repeatedly re-entering the interrupt routine, locking up the board. The following patch returns the required handling for this interrupt. Signed-off-by: Martyn Welch Signed-off-by: Dale Farnsworth Signed-off-by: Jeff Garzik commit 1bef7dc00caa7bcbff4fdb55e599e2591461fafa Author: Benjamin Herrenschmidt Date: Sat Sep 29 09:06:21 2007 +1000 Fix bogus PCI quirk for e100 Linas reported me that some machines were crashing at boot in quirk_e100_interrupt. It appears that this quirk is doing an ioremap directly on a PCI BAR value, which isn't legal and will cause all sorts of bad things to happen on architectures where PCI BARs don't directly match processor bus addresses. This fixes it by using the proper PCI resources instead which is possible since the quirk has been moved by a previous commit to happen late enough for that. Signed-off-by: Benjamin Herrenschmidt Acked-by: Linas Vepstas Signed-off-by: Linus Torvalds commit b082dff349e0a9374d19765f17b3fdceb74fda56 Author: Dmitry Torokhov Date: Thu Sep 27 00:09:29 2007 -0400 Input: xpad - fix dependancy on LEDS class Input: xpad - fix dependancy on LEDS class The driver can not be built-in when LEDS class is a module. Signed-off-by: Dmitry Torokhov Signed-off-by: Linus Torvalds commit 54af3bb543c071769141387a42deaaab5074da55 Author: Trond Myklebust Date: Fri Sep 28 12:27:41 2007 -0400 NFS: Fix an Oops in encode_lookup() It doesn't look as if the NFS file name limit is being initialised correctly in the struct nfs_server. Make sure that we limit whatever is being set in nfs_probe_fsinfo() and nfs_init_server(). Also ensure that readdirplus and nfs4_path_walk respect our file name limits. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit f8ab18d2d987a59ccbf0495032b2aef05b730037 Author: David S. Miller Date: Fri Sep 28 15:18:35 2007 -0700 [TCP]: Fix MD5 signature handling on big-endian. Based upon a report and initial patch by Peter Lieven. tcp4_md5sig_key and tcp6_md5sig_key need to start with the exact same members as tcp_md5sig_key. Because they are both cast to that type by tcp_v{4,6}_md5_do_lookup(). Unfortunately tcp{4,6}_md5sig_key use a u16 for the key length instead of a u8, which is what tcp_md5sig_key uses. This just so happens to work by accident on little-endian, but on big-endian it doesn't. Instead of casting, just place tcp_md5sig_key as the first member of the address-family specific structures, adjust the access sites, and kill off the ugly casts. Signed-off-by: David S. Miller commit 422efb17eee0471baf4e1876ac9e8ba4c9e7a37a Author: Kyle McMartin Date: Fri Sep 28 13:15:20 2007 -0400 [MIPS] Fix fallocate on o32 binary compat ABI MIPS was mistakenly forgetting to use the fallocate compat wrapper, which I noticed while cleaning up all the duplicate fallocate wrappers. Signed-off-by: Kyle McMartin Signed-off-by: Ralf Baechle commit 9ae6399f0178c49a6e9cb7562ecc2f7d10c9f195 Author: Ralf Baechle Date: Tue Sep 11 08:50:40 2007 +0100 [MIPS] Fix CONFIG_BUILD_ELF64 kernels with symbols in CKSEG0. The __pa() for those did assume that all symbols have XKPHYS values and the math fails for any other address range. Signed-off-by: Ralf Baechle commit d8998737bd56e65d5e7326b515769c20dc01cb63 Author: Ralf Baechle Date: Wed Sep 26 13:01:37 2007 +0100 [MIPS] IP32: Fix initialization of UART base addresses. Signed-off-by: Ralf Baechle commit 4ee5b10abeb2b5581be10d3022694cd19084e9b0 Author: H. Peter Anvin Date: Thu Sep 27 17:17:12 2007 -0700 [x86 setup] Correct the SMAP check for INT 0x15, AX=0xe820 The e820 probe code was checking %edx, not %eax, for the SMAP signature on return. This worked on *almost* all systems, since %edx still contained SMAP from the call on entry, but on a handful of systems it failed -- plus, we would have missed real mismatches. The error output is "=d" to make sure gcc knows %edx is clobbered here. Signed-off-by: H. Peter Anvin commit f93c7c5aab8d5efaf99c88c8452d9303baabc89b Author: jacmet@sunsite.dk Date: Fri Sep 28 16:21:15 2007 +0200 [POWERPC] mpc8349emitx.dts: Setup USB-DR for peripheral mode. Setup dr_mode for USB-DR to peripheral as the default (host mode) doesn't make much sense for the mini-AB connector on the ITX board. Peripheral mode is preferable to OTG as the fsl_usb2_udc.c driver doesn't yet properly support it. Signed-off-by: Peter Korsgaard Signed-off-by: Kumar Gala commit 39db0fd9db6caea8887f61fee4a0e53c6f8fec5e Author: jacmet@sunsite.dk Date: Fri Sep 28 16:21:14 2007 +0200 [POWERPC] Fix mpc834x USB-MPH configuration. mpc834x USB-MPH configuration got broken by commit 6f442560021aecf08658e26ed9a37e6928ef0fa1. The selection bits in SICRL should be cleared rather than set to configure the USB MUXes for the MPH. Signed-off-by: Peter Korsgaard Signed-off-by: Kumar Gala commit d214602804a85e5da68b745ae69d9beaa5bedc93 Author: Jochen Friedrich Date: Mon Sep 24 19:15:43 2007 +0200 [POWERPC] Fix cpm_uart driver for cpm1 machines in cpm_uart_cpm1.h, DPRAM_BASE is assigned an address derived from cpmp. On ARC=ppc, this is a physical address with 1:1 DMA mapping which can't be used for arithmetric compare operations with virtual addresses returned by cpm_dpram_addr. This patch changes the assignment to use cpm_dpram_addr as well, like in cpm_uart_cpm2.h. Signed-off-by: Jochen Friedrich Signed-off-by: Kumar Gala commit bc63818931ea55c54d6e59b7d38bff8f295dc8c1 Author: Jochen Friedrich Date: Mon Sep 24 19:14:57 2007 +0200 [PPC] Fix cpm_dpram_addr returning phys mem instead of virt mem cpm_dpram_addr returns physical memory of the DP RAM instead of iomapped virtual memory. As there usually is a 1:1 MMU map of the IMMR area, this is often not noticed. However, cpm_dpram_phys assumes this iomapped virtual memory and returns garbage on the 1:1 mapped memory causing CPM1 uart console to fail. This patch fixes the problem (copied from the powerpc tree). Signed-off-by: Jochen Friedrich Signed-off-by: Kumar Gala commit 83af919e0f239e87bc644a2c932b9cebf5771380 Author: Jochen Friedrich Date: Mon Sep 24 19:13:46 2007 +0200 [POWERPC] Fix copy'n'paste typo in commproc.c The powerpc version of commproc.c exports cpm_dpram_addr twice and cpm_dpram_phys not at all due to a typo. This patch fixes this problem. CC arch/powerpc/sysdev/commproc.o arch/powerpc/sysdev/commproc.c:398: error: redefinition of '__kcrctab_cpm_dpram_addr' arch/powerpc/sysdev/commproc.c:392: error: previous definition of '__kcrctab_cpm_dpram_addr' was here arch/powerpc/sysdev/commproc.c:398: error: redefinition of '__kstrtab_cpm_dpram_addr' arch/powerpc/sysdev/commproc.c:392: error: previous definition of '__kstrtab_cpm_dpram_addr' was here arch/powerpc/sysdev/commproc.c:398: error: redefinition of '__ksymtab_cpm_dpram_addr' arch/powerpc/sysdev/commproc.c:392: error: previous definition of '__ksymtab_cpm_dpram_addr' was here make[1]: *** [arch/powerpc/sysdev/commproc.o] Error 1 make: *** [arch/powerpc/sysdev] Error 2 Signed-off-by: Jochen Friedrich Signed-off-by: Kumar Gala commit f4ec7f98714c2c0b7afa422c0cba6fb5c875c2c2 Author: Auke Kok Date: Thu Aug 30 11:23:58 2007 -0700 e1000: Add device IDs of blade version of the 82571 quad port This blade-specific board form factor is identical to the 82571EB board. Signed-off-by: Auke Kok Signed-off-by: Jeff Garzik commit 88f5f0cad396be594d6d55cb2d0cd69e8df9ab16 Author: Stephen Hemminger Date: Thu Sep 27 12:38:12 2007 -0700 sky2: fix transmit state on resume This should fix http://bugzilla.kernel.org/show_bug.cgi?id=8667 After resume, driver has reset the chip so the current state of transmit checksum offload state machine and DMA state machine will be undefined. The fix is to set the state so that first Tx will set MSS and offset values. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit d6c9bc1ed4301cbc3df4565ff5348b64bf2a767c Author: Stephen Hemminger Date: Thu Sep 27 12:32:44 2007 -0700 sky2: FE+ vlan workaround The FE+ workaround means the driver can no longer trust the status register to indicate VLAN tagged frames. The fix for this is to just disable VLAN acceleration for that chip version. Tested and works fine. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 3b12e0141f7a97c3b84731b5f935ed738bb6f960 Author: Stephen Hemminger Date: Wed Sep 26 17:58:47 2007 -0700 sky2: sky2 FE+ receive status workaround The Yukon FE+ chip appears to have a hardware glitch that causes bogus receive status values to be posted. The data in the packet is good, but the status value is random garbage. As a temporary workaround until the problem is better understood, implement the workaround the vendor driver used of ignoring the status value on this chip. Since this means trusting dodgy hardware values; add additional checking of the receive packet length. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit e4a7b1d1d90d202a030688ab5b177c3c0f15ee3e Author: Dave Airlie Date: Fri Sep 28 11:46:28 2007 +1000 i915: make vbl interrupts work properly on i965g/gm hw. This code is ported from the DRM git tree and allows the vblank interrupts to function on the i965 hw. It also requires a change in Mesa's 965 driver to actually use them. [ Without this patch, my 965GM drops vblank interrupts - Jesse ] Signed-off-by: Dave Airlie Acked-by: Jesse Barnes Signed-off-by: Linus Torvalds commit 7d809ba3f98b8aa8f9ba0dcdf6349958a0b77b7b Author: Ralf Baechle Date: Tue Sep 11 08:50:40 2007 +0100 [MIPS] Fix CONFIG_BUILD_ELF64 kernels with symbols in CKSEG0. The __pa() for those did assume that all symbols have XKPHYS values and the math fails for any other address range. Signed-off-by: Ralf Baechle commit 6e351064b16914e4843248355288b777fa559947 Author: Ralf Baechle Date: Wed Sep 26 13:01:37 2007 +0100 [MIPS] IP32: Fix initialization of UART base addresses. Signed-off-by: Ralf Baechle commit e79ad711a0108475c1b3a03815527e7237020b08 Author: David S. Miller Date: Thu Sep 27 13:52:00 2007 -0700 [NET]: Zero length write() on socket should not simply return 0. This fixes kernel bugzilla #5731 It should generate an empty packet for datagram protocols when the socket is connected, for one. The check is doubly-wrong because all that a write() can be is a sendmsg() call with a NULL msg_control and a single entry iovec. No special semantics should be assigned to it, therefore the zero length check should be removed entirely. This matches the behavior of BSD and several other systems. Alan Cox notes that SuSv3 says the behavior of a zero length write on non-files is "unspecified", but that's kind of useless since BSD has defined this behavior for a quarter century and BSD is essentially what application folks code to. Based upon a patch from Stephen Hemminger. Signed-off-by: David S. Miller commit 9c908f97d0f9aee32fa6d4b0a44c4c5d0ccab2b0 Author: David S. Miller Date: Thu Sep 27 13:09:28 2007 -0700 [SPARC]: Fix EBUS use of uninitialized variable. If of_get_property() fails, it returns NULL and the 'len' parameter is undefined. So we need to explicitly set len to zero in such cases. Noticed by Al Viro. Signed-off-by: David S. Miller commit ff0ce6845bc18292e80ea40d11c3d3a539a3fc5e Author: Linus Torvalds Date: Wed Sep 26 15:52:17 2007 -0700 Revert "[PATCH] x86-64: fix x86_64-mm-sched-clock-share" This reverts commit 184c44d2049c4db7ef6ec65794546954da2c6a0e. As noted by Dave Jones: "Linus, please revert the above cset. It doesn't seem to be necessary (it was added to fix a miscompile in 'make allnoconfig' which doesn't seem to be repeatable with it reverted) and actively breaks the ARM SA1100 framebuffer driver." Requested-by: Dave Jones Cc: Russell King Cc: Andrew Morton Cc: Andi Kleen Signed-off-by: Linus Torvalds commit f7f847b01571e86044dc77e03d92f43699652f8d Author: Linus Torvalds Date: Wed Sep 26 15:21:33 2007 -0700 Revert "x86-64: Disable local APIC timer use on AMD systems with C1E" This reverts commit e66485d747505e9d960b864fc6c37f8b2afafaf0, since Rafael Wysocki noticed that the change only works for his in -mm, not in mainline (and that both "noapictimer" _and_ "apicmaintimer" are broken on his hardware, but that's apparently not a regression, just a symptom of the same issue that causes the automatic apic timer disable to not work). It turns out that it really doesn't work correctly on x86-64, since x86-64 doesn't use the generic clock events for timers yet. Thanks to Rafal for testing, and here's the ugly details on x86-64 as per Thomas: "I just looked into the code and the logic vs. noapictimer on SMP is completely broken. On i386 the noapictimer option not only disables the local APIC timer, it also registers the CPUs for broadcasting via IPI on SMP systems. The x86-64 code uses the broadcast only when the local apic timer is active, i.e. "noapictimer" is not on the command line. This defeats the whole purpose of "noapictimer". It should be there to make boxen work, where the local APIC timer actually has a hardware problem, e.g. the nx6325. The current implementation of x86_64 only fixes the ACPI c-states related problem where the APIC timer stops in C3(2), nothing else. On nx6325 and other AMD X2 equipped systems which have the C1E enabled we run into the following: PIT keeps jiffies (and the system) running, but the local APIC timer interrupts can get out of sync due to this C1E effect. I don't think this is a critical problem, but it is wrong nevertheless. I think it's safe to revert the C1E patch and postpone the fix to the clock events conversion." On further reflection, Thomas noted: "It's even worse than I thought on the first check: "noapictimer" on the command line of an SMP box prevents _ONLY_ the boot CPU apic timer from being used. But the secondary CPU is still unconditionally setting up the APIC timer and uses the non calibrated variable calibration_result, which is of course 0, to setup the APIC timer. Wreckage guaranteed." so we'll just have to wait for the x86 merge to hopefully fix this up for x86-64. Tested-and-requested-by: Rafael J. Wysocki Acked-by: Thomas Gleixner Signed-off-by: Linus Torvalds commit 2efa33f81ef56e7700c09a3d8a881c96692149e5 Author: H. Peter Anvin Date: Wed Sep 26 14:11:43 2007 -0700 [x86 setup] Handle case of improperly terminated E820 chain At least one system (a Geode system with a Digital Logic BIOS) has been found which suddenly stops reporting the SMAP signature when reading the E820 memory chain. We can't know what, exactly, broke in the BIOS, so if we detect this situation, declare the E820 data unusable and fall back to E801. Also, revert to original behavior of always probing all memory methods; that way all the memory information is available to the kernel. Signed-off-by: H. Peter Anvin Cc: Jordan Crouse Cc: Joerg Pommnitz commit df912ea4ae7233d1504fbd861ee127bd7ee5781d Author: Jeremy Fitzhardinge Date: Tue Sep 25 11:50:00 2007 -0700 xen: execve's error paths don't pin the mm before unpinning execve's error paths don't activate (and therefore pin) the mm before calling exit_mmap to free it up, so don't try to unpin unless it is actually pinned. This prevents a BUG_ON from triggering. Signed-off-by: Jeremy Fitzhardinge Cc: Christian Ostheimer Signed-off-by: Linus Torvalds commit e66485d747505e9d960b864fc6c37f8b2afafaf0 Author: Thomas Gleixner Date: Tue Sep 25 21:37:01 2007 +0200 x86-64: Disable local APIC timer use on AMD systems with C1E commit 3556ddfa9284a86a59a9b78fe5894430f6ab4eef titled [PATCH] x86-64: Disable local APIC timer use on AMD systems with C1E solves a problem with AMD dual core laptops e.g. HP nx6325 (Turion 64 X2) with C1E enabled: When both cores go into idle at the same time, then the system switches into C1E state, which is basically the same as C3. This stops the local apic timer. This was debugged right after the dyntick merge on i386 and despite the patch title it fixes only the 32 bit path. x86_64 is still missing this fix. It seems that mainline is not really affected by this issue, as the PIT is running and keeps jiffies incrementing, but that's just waiting for trouble. -mm suffers from this problem due to the x86_64 high resolution timer patches. This is a quick and dirty port of the i386 code to x86_64. I spent quite a time with Rafael to debug the -mm / hrt wreckage until someone pointed us to this. I really had forgotten that we debugged this half a year ago already. Sigh, is it just me or is there something yelling arch/x86 into my ear? Signed-off-by: Thomas Gleixner Tested-by: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit 3dffec45c2742961dd27f55aba426cb9cf3f0dcd Author: S.Çağlar Onur Date: Wed Sep 26 12:15:33 2007 +0300 Silent drivers/char/hpet.c build warnings on i386 Following patch silents; ... drivers/char/hpet.c:72: warning: 'clocksource_hpet' defined but not used drivers/char/hpet.c:81: warning: 'hpet_clocksource' defined but not used ... build warnings on i386, they appeared after commit 3b2b64fd311c92f2137eb7cee7025794cd854057 Signed-off-by: S.Çağlar Onur Signed-off-by: Linus Torvalds -- drivers/char/hpet.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) commit 255129d1e9ca0ed3d69d5517fae3e03d7ab4b806 Author: Trond Myklebust Date: Tue Sep 25 15:55:03 2007 -0400 NLM: Fix a circular lock dependency in lockd The problem is that the garbage collector for the 'host' structures nlm_gc_hosts(), holds nlm_host_mutex while calling down to nlmsvc_mark_resources, which, eventually takes the file->f_mutex. We cannot therefore call nlmsvc_lookup_host() from within nlmsvc_create_block, since the caller will already hold file->f_mutex, so the attempt to grab nlm_host_mutex may deadlock. Fix the problem by calling nlmsvc_lookup_host() outside the file->f_mutex. Signed-off-by: Trond Myklebust Signed-off-by: Linus Torvalds commit f6a592e8abd2f2394623ce5427cbb4c265495974 Author: Chris Malley Date: Wed Sep 26 14:19:18 2007 +1000 lguest example launcher truncates block device file to 0 length on problems The function should also use ftruncate64() rather than ftruncate() to prevent files over 4GB (not uncommon for a root filesystem) being zeroed. Signed-off-by: Chris Malley Signed-off-by: Rusty Russell Signed-off-by: Linus Torvalds commit 78bd8fbbcd66fc977baa40e7fd838a4461b0f727 Author: Al Viro Date: Wed Sep 26 01:54:32 2007 +0100 fix sctp_del_bind_addr() last argument type It gets pointer to fastcall function, expects a pointer to normal one and calls the sucker. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit 459685c75b82a0431da102365d507fdb72858b84 Author: Al Viro Date: Wed Sep 26 01:54:12 2007 +0100 hibernation doesn't even build on frv - tons of helpers are missing Signed-off-by: Al Viro Acked-By: David Howells Signed-off-by: Linus Torvalds commit d8c4a2f9d9e7827362fd7ab0b5d9637c6af5ac5b Author: Al Viro Date: Wed Sep 26 01:53:52 2007 +0100 mv643xx_eth: duplicate methods in initializer Signed-off-by: Al Viro Signed-off-by: Linus Torvalds commit ed4d6375a1498009a9e68d93661207351d36874f Author: Al Viro Date: Wed Sep 26 01:53:42 2007 +0100 usbvision-video: buggered method tables duplicated .mmap in one, .vidioc_s_audio misspelled as .vidioc_g_audio in other Signed-off-by: Al Viro Acked-by: Mauro Carvalho Chehab Signed-off-by: Linus Torvalds commit 5309809129ca3ab14f8bd5e5ef66c1b7686eb639 Author: Linus Torvalds Date: Wed Sep 26 09:16:21 2007 -0700 Add explicit zeroing to "envp" array in device 'show' method As Stephen Hemminger says, this is a "belt and suspenders" patch that zeroes the envp array at allocation time, even though all the users should NULL-terminate it anyway (and we've hopefully fixed everybody that doesn't do that). And we'll apparently clean the whole envp thing up for 2.6.24 anyway. But let's just be robust, and do both this *and* make sure that all users are doing the right thing. Acked-by: Stephen Hemminger Acked-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds commit 603c461250b223ac42c10b8d1df653af1a361d44 Author: Jeremy Kerr Date: Wed Sep 26 10:53:45 2007 +1000 [POWERPC] spufs: fix mismerge, making context signal{1,2} files readable again The commit 8b6f50ef1d5cc86b278eb42bc91630fad455fb10 seems to have been affected by a mismerge of a duplicate patch (d054b36ffd302ec65aabec16a0c60ddd9e6b5a62) - both the spufs_dir_contents and spufs_dir_nosched_contents have been given write-only signal notification files. This change reverts the spufs_dir_contents array to use the readable signal notification file implementation. Signed-off-by: Jeremy Kerr Acked-by: Arnd Bergmann Signed-off-by: Paul Mackerras commit ae3ba4fd966e38d8d766d19f7a58b551df8ecc97 Author: Al Viro Date: Wed Sep 26 08:20:44 2007 +0200 cdrom_open() forgets to unlock on -EROFS failure exits Signed-off-by: Al Viro Signed-off-by: Jens Axboe commit 45dfd5b5dd20f17fe23dafc5cfe921474d27f849 Author: Michal Schmidt Date: Tue Sep 25 23:05:39 2007 -0700 [PPP_MPPE]: Don't put InterimKey on the stack Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller commit 6f4c618ddb0e6b7e6d49cfc8134e694be1c0bc9b Author: Wei Yongjun Date: Wed Sep 19 17:19:52 2007 +0800 SCTP : Add paramters validity check for ASCONF chunk If ADDIP is enabled, when an ASCONF chunk is received with ASCONF paramter length set to zero, this will cause infinite loop. By the way, if an malformed ASCONF chunk is received, will cause processing to access memory without verifying. This is because of not check the validity of parameters in ASCONF chunk. This patch fixed this. Signed-off-by: Wei Yongjun Signed-off-by: Vlad Yasevich commit 3c77f961b55b6060858c68a213d7f4470d7f3eb2 Author: Vlad Yasevich Date: Mon Sep 17 15:14:28 2007 -0400 SCTP: Discard OOTB packetes with bundled INIT early. RFC 4460 and future RFC 4960 (2960-bis) specify that packets with bundled INIT chunks need to be dropped. We currenlty do that only after processing any leading chunks. For OOTB chunks, since we already walk the entire packet, we should discard packets with bundled INITs. There are other chunks chunks that MUST NOT be bundled, but the spec is silent on theire treatment. Thus, we'll leave their teatment alone for the moment. Signed-off-by: Vlad Yasevich Acked-by: Wei Yongjun commit ece25dfa0991f65c4e1d26beb1c3c45bda4239b8 Author: Vlad Yasevich Date: Fri Sep 7 16:30:54 2007 -0400 SCTP: Clean up OOTB handling and fix infinite loop processing While processing OOTB chunks as well as chunks with an invalid length of 0, it was possible to SCTP to get wedged inside an infinite loop because we didn't catch the condition correctly, or didn't mark the packet for discard correctly. This work is based on original findings and work by Wei Yongjun Signed-off-by: Vlad Yasevich commit d3f259687fd248aa4de477149481478c122ba48b Author: Vlad Yasevich Date: Fri Sep 7 11:47:45 2007 -0400 SCTP: Explicitely discard OOTB chunks Explicitely discard OOTB chunks, whether the result is a SHUTDOWN COMPLETE or an ABORT. We need to discard the OOTB SHUTDOWN ACK to prevent bombing attackes since responsed MUST NOT be bundled. We also explicietely discard in the ABORT case since that function is widely used internally. Signed-off-by: Vlad Yasevich Acked-by: Neil Horman commit 02c4e12c6400b6dccdc6b5c2c18325551e4b2dc9 Author: Wei Yongjun Date: Fri Aug 31 10:03:58 2007 +0800 SCTP: Send ABORT chunk with correct tag in response to INIT ACK When SCTP client received an INIT ACK chunk with missing mandatory parameter such as "cookie parameter", it will send back a ABORT with T-bit not set and verification tag is set to 0. This is because before we accept this INIT ACK chunk, we do not know the peer's tag. This patch change to reflect vtag when responding to INIT ACK with missing mandatory parameter. Signed-off-by: Wei Yongjun Signed-off-by: Vlad Yasevich commit a09c83847b664dcd67a72613374061c900afb799 Author: Vlad Yasevich Date: Wed Sep 5 15:53:58 2007 -0400 SCTP: Validate buffer room when processing sequential chunks When we process bundled chunks, we need to make sure that the skb has the buffer for each header since we assume it's always there. Some malicious node can send us something like DATA + 2 bytes and we'll try to walk off the end refrencing potentially uninitialized memory. Signed-off-by: Vlad Yasevich commit ca9938fea576ebbb8d8c4fbe8a5bcc937e49e1ca Author: Johannes Berg Date: Tue Sep 11 12:50:32 2007 +0200 [PATCH] mac80211: fix initialisation when built-in When mac80211 is built into the kernel it needs to init earlier so that device registrations are run after it has initialised. The same applies to rate control algorithms. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 136e83d6b8999f4ef680ff9cf2a67e1e1ccbd94e Author: Johannes Berg Date: Mon Sep 10 13:55:08 2007 +0200 [PATCH] net/mac80211/wme.c: fix sparse warning wme.c triggers a sparse warning; it wasn't noticed before because until recently ARRAY_SIZE triggered a sparse error. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 3a4624652e68ee897145ac698a85bfd2603367c3 Author: Johannes Berg Date: Mon Sep 10 13:44:45 2007 +0200 [PATCH] cfg80211: fix initialisation if built-in When cfg80211 is built into the kernel it needs to init earlier so that device registrations are run after it has initialised. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville commit 7b5ee3a038c869e773092834abaa8174e0d77514 Author: Satyam Sharma Date: Mon Sep 3 01:41:34 2007 +0530 [PATCH] net/wireless/sysfs.c: Shut up build warning net/wireless/sysfs.c:108: warning: ‘wiphy_uevent’ defined but not used when CONFIG_HOTPLUG=n is because the only usage site of this function is #ifdef'ed as such, so let's #ifdef the definition also. Signed-off-by: Satyam Sharma Acked-by: Johannes Berg Signed-off-by: John W. Linville commit 744551cceb73acd62189cb4afe0a336b2c9684d8 Author: Thomas Bogendoerfer Date: Tue Sep 25 22:49:37 2007 -0700 [SUNSAB]: Fix broken SYSRQ. Include SYSRQ support for SUNSAB if SUNSAB_CONSOLE is selected Signed-off-by: Thomas Bogendoerfer Signed-off-by: David S. Miller commit ff4abd6cfacf0bb23a077f615d3a5cd17359db1b Author: David Miller Date: Fri Aug 24 22:25:58 2007 -0700 [SCSI] esp: fix instance numbering. Because the ->unique_id is set too late, the ESP scsi host instance numbers in the kernel log during probing are wrong. Bug reported by Meelis Roos. Signed-off-by: David S. Miller Signed-off-by: James Bottomley commit edeb614c1c8388b354d93ff7790317cc5d6a38ec Author: Tejun Heo Date: Fri Sep 21 16:29:05 2007 +0900 pata_sis: add missing UDMA5 timing value in sis_66_set_dmamode() sis_66_set_dmamode() also handles early UDMA100 (SIS630 ET) but is missing udma timing value for UDMA100. According to sis5513, this should be 0x8000. This caused UDMA100 device to fail on pata_sis till it downgrades to UDMA66 while it works fine on sis5513 at UDMA100. Reported by Adam Blech. Signed-off-by: Tejun Heo Cc: Adam Blech Signed-off-by: Jeff Garzik commit 228f47b959a0cf2e24c9696757c7e6510334e499 Author: Tejun Heo Date: Sun Sep 23 12:37:05 2007 +0900 sata_sil24: fix IRQ clearing race when PCIX_IRQ_WOC is used When PCIX_IRQ_WOC is used, sil24 has an inherent race condition between clearing IRQ pending and reading IRQ status. If IRQ pending is cleared after reading IRQ status, there's possibility of lost IRQ. If IRQ pending is cleared before reading IRQ status, spurious IRQs will occur. sata_sil24 till now cleared IRQ pending after reading IRQ status thus losing IRQs on machines where PCIX_IRQ_WOC was used. Reverse the order and ignore spurious IRQs if PCIX_IRQ_WOC. Signed-off-by: Tejun Heo Signed-off-by: Jeff Garzik commit 78e1ca49c7ead5cd00882ed0c776260857613122 Author: Zhao Yakui Date: Thu Sep 20 21:23:13 2007 -0400 ACPI: hpet: ACPI Error (utglobal-0126): Unknown exception code: 0xFFFFFFF0 If hpet has been initialized before registering hpet driver, the callback function of hpet_resources will return the status code of -EBUSY, which is not defined in the ACPI exception table. So when ACPI checks the status code of callback function, it will report the unknown exception code. So the status code in ACPI is used instead of the generic error code in the ACPI callback function of hpet_resources. For example: -EBUSY is replaced by AE_ALREADY_EXISTS -EINVAL is replaced by AE_NO_MEMORY http://bugzilla.kernel.org/show_bug.cgi?id=8630 Signed-off-by: Zhao Yakui Signed-off-by: Len Brown commit 853298bc03ef65e3eb392f5d61265605214ee8fb Author: Alexey Starikovskiy Date: Tue Sep 25 18:45:15 2007 +0400 ACPI: CONFIG_ACPI_SLEEP=n power off regression in 2.6.23-rc8 (NOT in rc7) Signed-off-by: Alexey Starikovskiy Acked-by: Rafael J. Wysocki Signed-off-by: Len Brown commit 2f3f22269bdf702311342c5d106dfdd7347d1c3e Author: Alexey Starikovskiy Date: Mon Sep 24 14:33:21 2007 +0200 ACPI: suspend: build-fix for CONFIG_SUSPEND=n and CONFIG_HIBERNATION=y This fixes compilation with CONFIG_SUSPEND unset and CONFIG_HIBERNATION set (raf. http://marc.info/?l=linux-acpi&m=119055289723895&w=4). Signed-off-by: Alexey Starikovskiy Signed-off-by: Rafael J. Wysocki Signed-off-by: Len Brown commit bbbd2bf00bab467cff7b1f418b2cb24c71291f59 Author: Rusty Russell Date: Mon Sep 24 21:24:44 2007 -0700 fix modules oopsing in lguest guests The assembly templates for lguest guest patching are in the .init.text section. This means that modules get patched with "cc cc cc cc" or similar junk. Signed-off-by: Rusty Russell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit fdfb870f8e34e77567043b388051df14f7d33482 Author: Danny ter Haar Date: Mon Sep 24 21:24:43 2007 -0700 typo fix Kernel config option Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d1cf16c91605d051d36360f70858b06b103b4aed Author: Stephen Hemminger Date: Mon Sep 24 21:24:42 2007 -0700 missing null termination in one wire uevent Need to null terminate environment. Found by inspection while looking for similar problems to platform uevent bug Signed-off-by: Stephen Hemminger Cc: Greg Kroah-Hartman Acked-by: Evgeniy Polyakov Cc: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit afa684f6fda6086b229348f0ea21df7c8ad17964 Author: Cliff Wickman Date: Mon Sep 24 21:24:41 2007 -0700 fix "mspec: handle shrinking virtual memory areas" The vma_data structure may be shared by vma's from multiple tasks, with no way of knowing which areas are shared or not shared, so release/clear pages only when the refcount (of vma's) goes to zero. Signed-off-by: Cliff Wickman Cc: Jes Sorensen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f9b7cba1b8a74c10b0771ca28d4c554aeb9803fc Author: Evgeniy Dushistov Date: Mon Sep 24 21:24:39 2007 -0700 ufs: fix sun state Different types of ufs hold state in different places, to hide complexity of this, there is ufs_get_fs_state, it returns state according to "UFS_SB(sb)->s_flags", but during mount ufs_get_fs_state is called, before setting s_flags, this cause message for ufs types like sun ufs: "fs need fsck", and remount in readonly state. Signed-off-by: Evgeniy Dushistov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 474f81967217f3bec2389ae913da72641f2c40e3 Author: Roland McGrath Date: Mon Sep 24 16:52:44 2007 -0700 [POWERPC] Ensure FULL_REGS on exec When PTRACE_O_TRACEEXEC is used, a ptrace call to fetch the registers at the PTRACE_EVENT_EXEC stop (PTRACE_PEEKUSR) will oops in CHECK_FULL_REGS. With recent versions, "gdb --args /bin/sh -c 'exec /bin/true'" and "run" at the (gdb) prompt is sufficient to produce this. I also have written an isolated test case, see https://bugzilla.redhat.com/show_bug.cgi?id=301791#c15. This change fixes the problem by clearing the low bit of pt_regs.trap in start_thread so that FULL_REGS is true again. This is correct since all of the GPRs that "full" refers to are cleared in start_thread. Signed-off-by: Roland McGrath Signed-off-by: Paul Mackerras commit 21c0f275085e5b884a409d75a7deb73ece6477fb Author: Jeff Garzik Date: Tue Sep 25 00:11:34 2007 -0400 Revert "drivers/net/pcmcia/3c589_cs: fix port configuration switcheroo" This reverts commit fadacb1b80e35e0b36a90d43e21ef91eec4b889b. The change being reverted made the driver consistent with include/linux/netdevice.h, but then inconsistent with the other PCMCIA ethernet drivers. Signed-off-by: Jeff Garzik commit cb560737676260ac15b68d426305ad5e755417ea Author: Thomas Rohwer Date: Tue Sep 25 00:06:25 2007 -0400 Input: appletouch - fix idle reset logic Idle count should only be incremented when touchpad button is not pressed, otherwise reset may happen at a wrong time and touchpad will never report button release event. Signed-off-by: Thomas Rohwer Acked-by: Matthew Garrett Signed-off-by: Dmitry Torokhov commit e0c281163d634e2982a81b55fc974a6663afde65 Author: Stephen Hemminger Date: Thu Sep 20 13:03:49 2007 -0700 sky2: be more selective about FIFO watchdog Be more selective about when to enable the ram buffer watchdog code. It is unnecessary on XL A3 or later revs, and with Yukon FE the buffer is so small (4K) that the watchdog detects false positives. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 6d3105d5388c359882068b161b431ab3db4b3721 Author: Stephen Hemminger Date: Mon Sep 24 19:34:51 2007 -0700 sky2: FE+ Phy initialization One more snippet of PHY initialization required for FE+ chips. Discovered in latest sk98lin 10.21.1.3 driver. Please apply to 2.6.23. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 4942de4a0e914f205d351a81873f4f63986bcc3c Author: Linus Torvalds Date: Mon Sep 24 17:33:10 2007 -0700 Linux 2.6.23-rc8 Getting there... commit e4d84909dd48b5e5806a5d18b881e1ca1610ba9b Author: Dan Williams Date: Mon Sep 24 10:06:13 2007 -0700 raid5: fix 2 bugs in ops_complete_biofill 1/ ops_complete_biofill tried to avoid calling handle_stripe since all the state necessary to return read completions is available. However the process of determining whether more read requests are pending requires locking the stripe (to block add_stripe_bio from updating dev->toead). ops_complete_biofill can run in tasklet context, so rather than upgrading all the stripe locks from spin_lock to spin_lock_bh this patch just unconditionally reschedules handle_stripe after completing the read request. 2/ ops_complete_biofill needlessly qualified processing R5_Wantfill with dev->toread. The result being that the 'biofill' pending bit is cleared before handling the pending read-completions on dev->read. R5_Wantfill can be unconditionally handled because the 'biofill' pending bit prevents new R5_Wantfill requests from being seen by ops_run_biofill and ops_complete_biofill. Found-by: Yuri Tikhonov [neilb@suse.de: simpler fix for bug 1 than moving code] Signed-off-by: NeilBrown Signed-off-by: Dan Williams commit 6247cdc2cd334dad0ea5428245a7d8f4b075f21e Author: Dan Williams Date: Fri Sep 21 13:27:04 2007 -0700 async_tx: fix dma_wait_for_async_tx Fix dma_wait_for_async_tx to not loop forever in the case where a dependency chain is longer than two entries. This condition will not happen with current in-kernel drivers, but fix it for future drivers. Found-by: Saeed Bishara Signed-off-by: Dan Williams commit c5d2b9f444b8d9f5ad7c5e583686c119ba3a9ba7 Author: Dan Williams Date: Thu Sep 20 15:49:08 2007 -0700 async_tx: usage documentation and developer notes (v2) Changes in v2: * cleanups from Randy and Shannon Reviewed-by: Randy Dunlap Reviewed-by: Shannon Nelson Signed-off-by: Dan Williams commit 1146fe30504a1edd8a434f500e1be139492570c9 Author: Ralf Baechle Date: Fri Sep 21 17:13:55 2007 +0100 [MIPS] SMTC: Make ack_bad_irq() safe with no IM backstop. Issue reported and original patch by Kevin Kissel, cleaner (imho) implementation by me. Signed-off-by: Ralf Baechle commit ccec6e2c4a74adf76ed4e2478091a311b1806212 Author: Takashi Iwai Date: Mon Sep 17 21:55:10 2007 +0200 Convert snd-page-alloc proc file to use seq_file Use seq_file for the proc file read/write of snd-page-alloc module. This automatically fixes bugs in the old proc code. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds commit 6e694ea33e7a7fad908d188c46f441f04fb633d4 Author: Jack Morgenstein Date: Wed Sep 19 09:52:25 2007 -0700 IB/mlx4: Fix data corruption triggered by wrong headroom marking order This is an addendum to commit 0e6e7416 ("IB/mlx4: Handle new FW requirement for send request prefetching"). We also need to handle prefetch marking properly for S/G segments, or else the HCA may end up processing S/G segments that are not fully written and end up sending the wrong data. This can actually cause data corruption in practice, especially on systems with relatively slow CPUs (where the HCA is more likely to prefetch while the CPU is in the middle of writing a work request into memory). We write S/G segments in reverse order into the WQE, in order to guarantee that the first dword of all cachelines containing S/G segments is written last (overwriting the headroom invalidation pattern). The entire cacheline will thus contain valid data when the invalidation pattern is overwritten. Signed-off-by: Jack Morgenstein Signed-off-by: Roland Dreier commit b7e113dc9d52c4a37d2da6fafe77959f3a28eccf Author: Thomas Gleixner Date: Sat Sep 22 22:29:06 2007 +0000 clockevents: remove the suspend/resume workaround^Wthinko In a desparate attempt to fix the suspend/resume problem on Andrews VAIO I added a workaround which enforced the broadcast of the oneshot timer on resume. This was actually resolving the problem on the VAIO but was just a stupid workaround, which was not tackling the root cause: the assignement of lower idle C-States in the ACPI processor_idle code. The cpuidle patches, which utilize the dynamic tick feature and go faster into deeper C-states exposed the problem again. The correct solution is the previous patch, which prevents lower C-states across the suspend/resume. Remove the enforcement code, including the conditional broadcast timer arming, which helped to pamper over the real problem for quite a time. The oneshot broadcast flag for the cpu, which runs the resume code can never be set at the time when this code is executed. It only gets set, when the CPU is entering a lower idle C-State. Signed-off-by: Thomas Gleixner Tested-by: Andrew Morton Cc: Len Brown Cc: Venkatesh Pallipadi Cc: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit b04e7bdb984e3b7f62fb7f44146a529f88cc7639 Author: Thomas Gleixner Date: Sat Sep 22 22:29:05 2007 +0000 ACPI: disable lower idle C-states across suspend/resume device_suspend() calls ACPI suspend functions, which seems to have undesired side effects on lower idle C-states. It took me some time to realize that especially the VAIO BIOSes (both Andrews jinxed UP and my elfstruck SMP one) show this effect. I'm quite sure that other bug reports against suspend/resume about turning the system into a brick have the same root cause. After fishing in the dark for quite some time, I realized that removing the ACPI processor module before suspend (this removes the lower C-state functionality) made the problem disappear. Interestingly enough the propability of having a bricked box is influenced by various factors (interrupts, size of the ram image, ...). Even adding a bunch of printks in the wrong places made the problem go away. The previous periodic tick implementation simply pampered over the problem, which explains why the dyntick / clockevents changes made this more prominent. We avoid complex functionality during the boot process and we have to do the same during suspend/resume. It is a similar scenario and equaly fragile. Add suspend / resume functions to the ACPI processor code and disable the lower idle C-states across suspend/resume. Fall back to the default idle implementation (halt) instead. Signed-off-by: Thomas Gleixner Tested-by: Andrew Morton Cc: Len Brown Cc: Venkatesh Pallipadi Cc: Rafael J. Wysocki Signed-off-by: Linus Torvalds commit 36a740974129d7301054fa810adf22025896be78 Author: Avi Kivity Date: Sat Sep 22 14:43:45 2007 +0200 KVM: Fix virtualization menu help text What guest drivers? Cc: Jan Engelhardt Signed-off-by: Avi Kivity Signed-off-by: Linus Torvalds commit 0b95f22bd3b91c7114c6892bbfbb5a8576b27fbe Author: Bryan Wu Date: Sun Sep 23 00:51:32 2007 +0800 Blackfin arch: add some missing syscall When compiling the Blackfin kernel, checksyscalls.pl will report lots of missing syscalls warnings. This patch will add some missing syscalls which make sense on Blackfin arch After appling this patch, toolchain should be rebuilt. Then recompiling the kernel with the new toolchain. Signed-off-by: Bryan Wu commit 576bb9ced2d274446639d7fbeee7125e24daf012 Author: Andrew Morton Date: Wed Oct 3 23:43:57 2007 +0800 binfmt_flat: checkpatch fixing minimum support for the blackfin relocations Cc: Bernd Schmidt Cc: David McCullough Cc: Greg Ungerer Cc: Miles Bader Signed-off-by: Andrew Morton Signed-off-by: Bryan Wu commit f9720205d1f847cb59e197e851b5276425363f6b Author: Bernd Schmidt Date: Wed Oct 3 23:41:43 2007 +0800 Binfmt_flat: Add minimum support for the Blackfin relocations Add minimum support for the Blackfin relocations, since we don't have enough space in each reloc. The idea is to store a value with one relocation so that subsequent ones can access it. Actually, this patch is required for Blackfin. Currently if BINFMT_FLAT is enabled, git-tree kernel will fail to compile. Signed-off-by: Bernd Schmidt Signed-off-by: Bryan Wu Cc: David McCullough Cc: Greg Ungerer Cc: Miles Bader Signed-off-by: Andrew Morton commit 2302827c95fe0f441025acd5133e532d2eef322b Author: James Bottomley Date: Sat Sep 22 08:40:09 2007 -0500 [SCSI] scsi_transport_spi: fix domain validation failure from incorrect width setting Domain Validation in the SPI transport class is failing on boxes with damaged cables (and failing to the extent that the box hangs). The problem is that the first test it does is a cable integrity test for wide transfers and if this fails, it turns the wide bit off. The problem is that the next set of tests it does turns wide back on again, with the result that it runs through the entirety of DV with a known bad setting and then hangs the system. The attached patch fixes the problem by physically nailing the wide setting to what it deduces it should be for the whole of Domain Validation. Signed-off-by: James Bottomley commit 5a50fe709d527f31169263e36601dd83446d5744 Author: Frans Pop Date: Thu Sep 20 22:27:44 2007 +0200 ACPI: suspend: consolidate handling of Sx states addendum Make the S0 state be always reported as supported Signed-off: Frans Pop Acked-by: Alexey Starikovskiy Signed-off-by: Rafael J. Wysocki Signed-off-by: Len Brown commit da8f153e51290e7438ba7da66234a864e5d3e1c1 Author: Linus Torvalds Date: Fri Sep 21 12:09:41 2007 -0700 Revert "x86_64: Quicklist support for x86_64" This reverts commit 34feb2c83beb3bdf13535a36770f7e50b47ef299. Suresh Siddha points out that this one breaks the fundamental requirement that you cannot free page table pages before the TLB caches are flushed. The quicklists do not give the same kinds of guarantees that the mmu_gather structure does, at least not in NUMA configurations. Requested-by: Suresh Siddha Acked-by: Andi Kleen Cc: Andrew Morton Cc: Christoph Lameter Cc: Asit Mallick Cc: Tony Luck Signed-off-by: Linus Torvalds commit da51f9e10c48599bff498b378d040c4063adfe9d Author: Ralf Baechle Date: Fri Sep 21 09:01:15 2007 +0100 [MIPS] BCM1480: include . Signed-off-by: Ralf Baechle commit 339c3a6a12faf57c57a23f3d714ce89a831822fc Author: Ralf Baechle Date: Fri Sep 21 08:59:07 2007 +0100 [MIPS] BCM1480: Export zbbus_mhz. Symbol is required by the ZBus profiler. Signed-off-by: Ralf Baechle commit 176df2457ef6207156ca1a40991c54ca01fef567 Author: Andi Kleen Date: Fri Sep 21 16:16:18 2007 +0200 x86_64: Zero extend all registers after ptrace in 32bit entry path. Strictly it's only needed for eax. It actually does a little more than strictly needed -- the other registers are already zero extended. Also remove the now unnecessary and non functional compat task check in ptrace. This is CVE-2007-4573 Found by Wojciech Purczynski Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit d59952d532ed8fc93ccb98186f73d9ce5cfcb93d Author: Jean Tourrilhes Date: Thu Sep 20 11:08:18 2007 -0700 [PATCH] WE : Add missing auth compat-ioctl Johannes just found that we are missing a compat-ioctl declaration. The fix is trivial. As previous patches for compat-ioctl, this should also go to stable. More info : http://marc.info/?l=linux-wireless&m=119029667902588&w=2 Signed-off-by: Jean Tourrilhes Signed-off-by: John W. Linville commit efe870f9f4ad74410a18ecbf0d9ba7c14b50a0fb Author: Larry Finger Date: Tue Sep 18 22:00:52 2007 -0500 [PATCH] softmac: Fix inability to associate with WEP networks Commit 4cf92a3c was submitted as a fix for bug #8686 at bugzilla.kernel.org (http://bugzilla.kernel.org/show_bug.cgi?id=8686). Unfortunately, the fix led to a new bug, reported by Yoshifuji Hideaki, that prevented association for WEP encrypted networks that use ifconfig to control the device. This patch effectively reverts the earlier commit and does a proper fix for bug #8686. Signed-off-by: Larry Finger Signed-off-by: John W. Linville commit f216cc3748a3a22c2b99390fddcdafa0583791a2 Author: Alexey Starikovskiy Date: Thu Sep 20 21:32:35 2007 +0400 ACPI: suspend: consolidate handling of Sx states. Recent changes to sleep initialization in ACPI dropped reporting of supported Sx states above S3. Fix that and also move S5 init into same file as other Sx. The only functional change is adding printk() for S4 and S5 cases. Signed-off-by: Alexey Starikovskiy Acked-by: Rafael J. Wysocki Signed-off-by: Len Brown commit 813d974c53a2b353566a86bb127625b403696dae Author: Sunil Mushran Date: Thu Sep 20 10:59:48 2007 -0700 ocfs2: Pack vote message and response structures The ocfs2_vote_msg and ocfs2_response_msg structs needed to be packed to ensure similar sizeofs in 32-bit and 64-bit arches. Without this, we had inadvertantly broken 32/64 bit cross mounts. Signed-off-by: Sunil Mushran Signed-off-by: Mark Fasheh commit 5c26a7b70f89c36e8d9acc95cb896c3cd205fc8d Author: Mark Fasheh Date: Tue Sep 18 17:49:29 2007 -0700 ocfs2: Don't double set write parameters The target page offsets were being incorrectly set a second time in ocfs2_prepare_page_for_write(), which was causing problems on a 16k page size kernel. Additionally, ocfs2_write_failure() was incorrectly using those parameters instead of the parameters for the individual page being cleaned up. Signed-off-by: Mark Fasheh commit db56246c6980e376b02d2da568d119da71f82fb9 Author: Mark Fasheh Date: Mon Sep 17 09:06:29 2007 -0700 ocfs2: Fix pos/len passed to ocfs2_write_cluster This was broken for file systems whose cluster size is greater than page size. Pos needs to be incremented as we loop through the descriptors, and len needs to be capped to the size of a single cluster. Signed-off-by: Mark Fasheh commit 415cb800375cc4e89fb5a6a454e484bd4adbffb4 Author: Mark Fasheh Date: Sun Sep 16 20:10:16 2007 -0700 ocfs2: Allow smaller allocations during large writes The ocfs2 write code loops through a page much like the block code, except that ocfs2 allocation units can be any size, including larger than page size. Typically it's equal to or larger than page size - most kernels run 4k pages, the minimum ocfs2 allocation (cluster) size. Some changes introduced during 2.6.23 changed the way writes to pages are handled, and inadvertantly broke support for > 4k page size. Instead of just writing one cluster at a time, we now handle the whole page in one pass. This means that multiple (small) seperate allocations might happen in the same pass. The allocation code howver typically optimizes by getting the maximum which was reserved. This triggered a BUG_ON in the extend code where it'd ask for a single bit (for one part of a > 4k page) and get back more than it asked for. Fix this by providing a variant of the high level allocation function which allows the caller to specify a maximum. The traditional function remains and just calls the new one with a maximum determined from the initial reservation. Signed-off-by: Mark Fasheh commit ed2ba977d43a6031f78f9e49d739ef5094f512e4 Author: Stephen Hemminger Date: Thu Sep 20 12:06:10 2007 -0700 [PATCH] missing null termination in power supply uevent Need to null terminate environment. Found by inspection while looking for similar problems to platform uevent bug Signed-off-by: Stephen Hemminger commit b8fceee17a310f189188599a8fa5e9beaff57eb0 Author: Davide Libenzi Date: Thu Sep 20 12:40:16 2007 -0700 signalfd simplification This simplifies signalfd code, by avoiding it to remain attached to the sighand during its lifetime. In this way, the signalfd remain attached to the sighand only during poll(2) (and select and epoll) and read(2). This also allows to remove all the custom "tsk == current" checks in kernel/signal.c, since dequeue_signal() will only be called by "current". I think this is also what Ben was suggesting time ago. The external effect of this, is that a thread can extract only its own private signals and the group ones. I think this is an acceptable behaviour, in that those are the signals the thread would be able to fetch w/out signalfd. Signed-off-by: Davide Libenzi Signed-off-by: Linus Torvalds commit 9db619e66503494e41159de3c76fafabe80d016b Author: Wolfgang Walter Date: Thu Sep 20 15:51:46 2007 -0400 rpc: fix garbage in printk in svc_tcp_accept() we upgraded the kernel of a nfs-server from 2.6.17.11 to 2.6.22.6. Since then we get the message lockd: too many open TCP sockets, consider increasing the number of nfsd threads lockd: last TCP connect from ^\\236^\É^D These random characters in the second line are caused by a bug in svc_tcp_accept. (Note: there are two previous __svc_print_addr(sin, buf, sizeof(buf)) calls in this function, either of which would initialize buf correctly; but both are inside "if"'s and are not necessarily executed. This is less obvious in the second case, which is inside a dprintk(), which is a macro which expands to an if statement.) Signed-off-by: Wolfgang Walter Signed-off-by: J. Bruce Fields Signed-off-by: Linus Torvalds commit c69c0892d8dd68b01a9fced5cab8527f0698c15e Author: henry su Date: Thu Sep 20 16:07:33 2007 -0400 [libata] ahci: add ATI SB800 PCI IDs ATI/AMD SB800 shares some device IDs with SB700, and SB800 adds two more device IDs:0x4394,0x4395. Signed-off-by: henry su Signed-off-by: Jeff Garzik commit e1cc9de8361f267101402a1181cff4d3d3225a6d Author: Alan Cox Date: Thu Sep 20 15:03:07 2007 +0100 libata-sff: Fix documentation Code moved to ioread/iowrite but the comment didn't Also note a posting issue Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit 0e3dbc01d53940fe10e5a5cfec15ede3e929c918 Author: Alan Cox Date: Thu Sep 20 15:22:47 2007 +0100 libata: Update the blacklist with a few more devices Signed-off-by: Alan Cox Signed-off-by: Jeff Garzik commit faf60e72d07d163a623e47269680918fccaa789a Author: Stephen Hemminger Date: Wed Sep 19 15:36:47 2007 -0700 sky2: version 1.18 Update version number Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 75e806838a3327d4ca9030e588d34de11b04f341 Author: Stephen Hemminger Date: Wed Sep 19 15:36:46 2007 -0700 sky2: receive FIFO checking A driver writer from another operating system hinted that the versions of Yukon 2 chip with rambuffer (EC and XL) have a hardware bug that if the FIFO ever gets completely full it will hang. Sounds like a classic ring full vs ring empty wrap around bug. As a workaround, use the existing watchdog timer to check for ring full lockup. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit 05745c4ab1c58fbb6ab8e8d3a40e0e395d7e2b0e Author: Stephen Hemminger Date: Wed Sep 19 15:36:45 2007 -0700 sky2: fe+ chip support Add support for newest Marvell chips. The Yukon FE plus chip is found in some not yet released laptops. Tested on hardware evaluation boards. This version of the patch is for 2.6.23. It supersedes the two previous patches that are sitting in netdev-2.6 (upstream branch). Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit ea76e63598eb312e5d33a782275be91038fc6df2 Author: Stephen Hemminger Date: Wed Sep 19 15:36:44 2007 -0700 sky2: reorganize chip revision features This patch should cause no functional changes in driver behaviour. There are (too) many revisions of the Yukon 2 chip now. Instead of adding more conditionals based on chip revision; rerganize into a set of feature flags so adding new versions is less problematic. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit c99210b50fe741026d86fdcb5f3f5a0c00c503cc Author: Stephen Hemminger Date: Wed Sep 19 15:36:43 2007 -0700 sky2: ethtool speed report bug On 100mbit versions, the driver always reports gigabit speed available. The correct modes are already computed, then overwritten. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit d6532232cd3de79c852685823a9c52f723816d0a Author: Stephen Hemminger Date: Wed Sep 19 15:36:42 2007 -0700 sky2: fix VLAN receive processing (resend) The length check for truncated frames was not correctly handling the case where VLAN acceleration had already read the tag. Also, the Yukon EX has some features that use high bit of status as security tag. Signed-off-by: Pierre-Yves Ritschard Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik commit be7963b7e7f08a149e247c0bf29a4abd174e0929 Author: Stefan Richter Date: Thu Sep 20 21:17:33 2007 +0200 ieee1394: ohci1394: fix initialization if built non-modular Initialization of ohci1394 was broken according to one reporter if the driver was statically linked, i.e. not built as loadable module. Dmesg: PCI: Device 0000:02:07.0 not available because of resource collisions ohci1394: Failed to enable OHCI hardware. This was reported for a Toshiba Satellite 5100-503. The cause is commit 8df4083c5291b3647e0381d3c69ab2196f5dd3b7 in Linux 2.6.19-rc1 which only served purposes of early remote debugging via FireWire. This functionality is better provided by the currently out-of-tree driver ohci1394_earlyinit. Reversal of the commit was OK'd by Andi Kleen. Signed-off-by: Stefan Richter commit cd46171c7297739dc7e46d885862e98023eab9c7 Author: Michael Chan Date: Thu Sep 20 11:04:58 2007 -0700 [BNX2]: Add PHY workaround for 5709 A1. Add the DIS_EARLY_DAC PHY workaround for 5709 A1. Without it, link sometimes does not come up. Update version to 1.6.5. Signed-off-by: Michael Chan Signed-off-by: David S. Miller commit f3d5e3a4155b6f42f6f6f0a2cc95ca0adbabe1af Author: Herbert Xu Date: Wed Sep 19 10:46:28 2007 -0700 [PPP] L2TP: Fix skb handling in pppol2tp_xmit This patch makes pppol2tp_xmit call skb_cow_head so that we don't modify cloned skb data. It also gets rid of skb2 we only need to preserve the original skb for congestion notification, which is only applicable for ppp_async and ppp_sync. The other semantic change made here is the removal of socket accounting for data tranmitted out of pppol2tp_xmit. The original code leaked any existing socket skb accounting. We could fix this by dropping the original skb owner. However, this is undesirable as the packet has not physically left the host yet. In fact, all other tunnels in the kernel do not account skb's passing through to their own socket. In partciular, ESP over UDP does not do so and it is the closest tunnel type to PPPoL2TP. So this patch simply removes the socket accounting in pppol2tp_xmit. The accounting still applies to control packets of course. I've also added a reminder that the outgoing checksum here doesn't work. I suppose existing deployments don't actually enable checksums. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 7a70e39b6633ad85936b029463134ee2599600f1 Author: Herbert Xu Date: Tue Sep 18 13:18:42 2007 -0700 [PPP] L2TP: Fix skb handling in pppol2