commit d8c3291c73b958243b33f8509d4507e76dafd055 Author: Linus Torvalds Date: Thu May 11 16:31:53 2006 -0700 Linux v2.6.17-rc4 commit dac07ec121de66b6be988b14ae2cd9ce45357b21 Author: Jens Axboe Date: Thu May 11 08:20:16 2006 +0200 [BLOCK] limit request_fn recursion Don't recurse back into the driver even if the unplug threshold is met, when the driver asks for a requeue. This is both silly from a logical point of view (requeues typically happen due to driver/hardware shortage), and also dangerous since we could hit an endless request_fn -> requeue -> unplug -> request_fn loop and crash on stack overrun. Also limit blk_run_queue() to one level of recursion, similar to how blk_start_queue() works. This patch fixed a real problem with SLES10 and lpfc, and it could hit any SCSI lld that returns non-zero from it's ->queuecommand() handler. Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds commit 210525d65d33d17eb6bea6c965ce442d60d9aa8d Author: Patrick McHardy Date: Thu May 11 12:22:03 2006 -0700 [NET_SCHED]: HFSC: fix thinko in hfsc_adjust_levels() When deleting the last child the level of a class should drop to zero. Noticed by Andreas Mueller Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit f358166a9405e4f1d8e50d8f415c26d95505b6de Author: Linus Torvalds Date: Thu May 11 11:08:49 2006 -0700 ptrace_attach: fix possible deadlock schenario with irqs Eric Biederman points out that we can't take the task_lock while holding tasklist_lock for writing, because another CPU that holds the task lock might take an interrupt that then tries to take tasklist_lock for writing. Which would be a nasty deadlock, with one CPU spinning forever in an interrupt handler (although admittedly you need to really work at triggering it ;) Since the ptrace_attach() code is special and very unusual, just make it be extra careful, and use trylock+repeat to avoid the possible deadlock. Cc: Oleg Nesterov Cc: Eric W. Biederman Cc: Roland McGrath Signed-off-by: Linus Torvalds commit ce477ae4f8c75c94587c3157deffad8219db09a0 Author: Michael S. Tsirkin Date: Wed May 10 17:58:41 2006 +0300 IB/mthca: FMR ioremap fix Addresses for ioremap must be calculated off of pci_resource_start; we can't directly use the bus address as seen by the HCA. Fix the code that remaps device memory for FMR access. Based on patch by Klaus Smolin. Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier commit d8e95e52a9db0e26b37f51ab5140b89da7c4b31e Author: James Cameron Date: Wed May 10 13:33:29 2006 -0700 sis900: phy for FoxCon motherboard 661FX7MI-S motherboard which uses the SiS 661FX chipset. The patch adds an entry to mii_chip_info for the transceiver. The PHY ids were found using the sis900_c_122.diff patch from http://brownhat.org/sis900.html but that patch didn't solve the problem, because the PHY at address 1 was already being chosen. Without my patch, when bursts of packets arrive from other hosts on a LAN, the interface dropped one roughly 10% of the time, causing retransmits. There were fifth second pauses in refresh of large xterms, and it made Netrek suck. I can provide further test data. Workaround in lieu of patch is to use mii-tool to advertise 100baseTx-HD, then force renegotiation. I wasn't able to identify the actual transceiver, so the description field is a guess. This patch is similar to Artur Skawina's patch: http://marc.theaimsgroup.com/?l=linux-netdev&m=114297516729079&w=2 I'm not sure, but I wonder if it means the default behaviour should be changed, so as to better handle future transceivers. Diff is against 2.6.16.13. Signed-off-by: James Cameron Signed-off-by: Stephen Hemminger commit 4c1b46226ce4424a93b8ac544e37afb26c8a72c6 Author: Francois Romieu Date: Wed May 10 12:48:57 2006 -0700 dl2k: use DMA_48BIT_MASK constant Typo will be harder with this one. Signed-off-by: Francois Romieu Signed-off-by: Stephen Hemminger commit 64b1c2b42b555ef38c475d104f2faf3f6f93690d Author: Herbert Valerio Riedel Date: Wed May 10 12:12:57 2006 -0400 phy: mdiobus_register(): initialize all phy_map entries make sure phy_map entries whose PHY address is masked are initialized to NULL, given that other code (such as mdiobus_unregister for instance) assumes that non-NULL phy_map entries are allocated phy_devices Signed-off-by: Herbert Valerio Riedel Signed-off-by: Stephen Hemminger commit f4ea431bb7c4856b930eafca6eb1fb474dae9b40 Author: Stephen Hemminger Date: Tue May 9 14:46:54 2006 -0700 sky2: ifdown kills irq mask Bringing down a port also masks off the status and other IRQ's needed for device to function due to missing paren's. Signed-off-by: Stephen Hemminger commit 7fc5b1e3a170d865f625e609c087cf8d84fd285d Author: Harald Welte Date: Wed May 10 13:28:52 2006 +0200 [Cardman 40x0] Fix udev device creation This patch corrects the order of the calls to register_chrdev() and pcmcia_register_driver(). Now udev correctly creates userspace device files /dev/cmmN and /dev/cmxN respectively. Based on an earlier patch by Jan Niehusmann . Signed-off-by: Harald Welte Signed-off-by: Linus Torvalds commit b0013fd47b14fc26eec07a6b2cec0c2a8954e1d7 Author: Alexey Kuznetsov Date: Wed May 10 13:24:38 2006 -0700 [IPV6]: skb leakage in inet6_csk_xmit inet6_csk_xit does not free skb when routing fails. Signed-off-by: Alexey Kuznetsov Signed-off-by: David S. Miller commit ac05202e8b83594bf6797d241371e6c752f371e6 Author: Stephen Hemminger Date: Wed May 10 13:21:53 2006 -0700 [BRIDGE]: Do sysfs registration inside rtnl. Now that netdevice sysfs registration is done as part of register_netdevice; bridge code no longer has to be tricky when adding it's kobjects to bridges. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit b17a7c179dd3ce7d04373fddf660eda21efc9db9 Author: Stephen Hemminger Date: Wed May 10 13:21:17 2006 -0700 [NET]: Do sysfs registration as part of register_netdevice. The last step of netdevice registration was being done by a delayed call, but because it was delayed, it was impossible to return any error code if the class_device registration failed. Side effects: * one state in registration process is unnecessary. * register_netdevice can sleep inside class_device registration/hotplug * code in netdev_run_todo only does unregistration so it is simpler. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 6dd727da92290193d0f74fa39f3ad53f423524db Author: mdr@sgi.com Date: Mon May 1 13:07:04 2006 -0500 [SCSI] mptfc: race between mptfc_register_dev and mptfc_target_alloc A race condition exists in mptfc between the thread registering a device with the fc transport and the scan work generated by the transport. This race existed prior to the application of the mptfc bug fix patch. mptfc_register_dev() calls fc_remote_port_add() with the FC_RPORT_ROLE_TARGET bit set in the rport ids passed to the function. Having this bit set causes fc_remote_port_add() to schedule a scan of the device. This scan can execute before mptfc_register_dev() can fill in the dd_data in the rport structure. When this happens, mptfc_target_alloc() will fail because dd_data is null. Attached is a patch which fixes the problem. The patch changes the rport ids passed to fc_remote_port_add() to not have the TARGET bit set. This prevents the scan from being scheduled. After mptfc_register_dev() fills in the rport dd_data field, fc_remote_port_rolechg() is called, changing the role of the rport to TARGET. Thus, the scan is scheduled after dd_data is filled in which prevents the failure in mptfc_target_alloc(). Signed-off-by: Michael Reed Signed-off-by: Eric Moore Signed-off-by: James Bottomley commit a50bb7b9af9a7c39b2aba15678eb686ae428718c Author: Jesper Juhl Date: Tue May 9 23:14:35 2006 -0700 [TG3]: Fix possible NULL deref in tg3_run_loopback(). tg3_run_loopback doesn't check that dev_alloc_skb() returns anything useful. Even if dev_alloc_skb() fails to return an skb to us we'll happily go on and assume it did, so we risk dereferencing a NULL pointer. Much better to fail gracefully by returning -ENOMEM than crashing here. Signed-off-by: Jesper Juhl Signed-off-by: David S. Miller commit 5941d079f2c3bdf0dffed1afb8941678fcd0bcb7 Author: Roland Dreier Date: Tue May 9 22:54:59 2006 -0700 IPoIB: Free child interfaces properly When deleting a child interface with a non-default P_Key via /sys/class/net/ibX/delete_child, the interface must be freed with free_netdev() (rather than kfree() on the private data). Signed-off-by: Roland Dreier commit 8c1056839e808aad728db86d739ffec71d2d1db8 Author: Herbert Xu Date: Tue May 9 15:27:54 2006 -0700 [NET] linkwatch: Handle jiffies wrap-around The test used in the linkwatch does not handle wrap-arounds correctly. Since the intention of the code is to eliminate bursts of messages we can afford to delay things up to a second. Using that fact we can easily handle wrap-arounds by making sure that we don't delay things by more than one second. This is based on diagnosis and a patch by Stefan Rompf. Signed-off-by: Herbert Xu Acked-by: Stefan Rompf Signed-off-by: David S. Miller commit 788252e6616afc75098397cc6b0bcb5482ad07ac Author: Christoph Hellwig Date: Tue May 9 15:27:04 2006 -0700 [IRDA]: Switching to a workqueue for the SIR work Since sir_kthread.c pretty much duplicates the workqueue functionality, we'd better switch. The SIR fsm has been merged into sir_dev.c and thus sir_kthread.c is deleted. Signed-off-by: Christoph Hellwig Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit d94c77b9b55f2c868ffd63cbd1f9749755c4b3d0 Author: David Brownell Date: Tue May 9 15:26:11 2006 -0700 [IRDA]: smsc-ircc: Minimal hotplug support. Minimal PNP hotplug support for the smsc-ircc2 driver. A modular driver will be modprobed via hotplug, but still bypasses driver model probing. Signed-off-by: David Brownell Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit 11766199a0bb9a7ba57510119e7340140e7c3e24 Author: Adrian Bunk Date: Tue May 9 15:25:25 2006 -0700 [IRDA]: Removing unused EXPORT_SYMBOLs This patch removes the following unused EXPORT_SYMBOL's: - irias_find_attrib - irias_new_string_value - irias_new_octseq_value Signed-off-by: Adrian Bunk Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit f353976dc2f31c9be092d4cb9476a39ba3973926 Author: Samuel Ortiz Date: Tue May 9 15:24:49 2006 -0700 [IRDA]: New maintainer. As agreed with Jean Tourrilhes, I am taking over IrDA maintainership. Signed-off-by: Samuel Ortiz Signed-off-by: David S. Miller commit f07d5b946510a54937a75a3654941e855ffdc4c2 Author: Alan Stern Date: Tue May 9 15:23:03 2006 -0700 [NET]: Make netdev_chain a raw notifier. From: Alan Stern This chain does it's own locking via the RTNL semaphore, and can also run recursively so adding a new mutex here was causing deadlocks. Signed-off-by: David S. Miller commit 63cbd2fda38f3d1f107c4fd6261e5660be3eccf9 Author: Wei Yongjun Date: Tue May 9 15:18:50 2006 -0700 [IPV4]: ip_options_fragment() has no effect on fragmentation Fix error point to options in ip_options_fragment(). optptr get a error pointer to the ipv4 header, correct is pointer to ipv4 options. Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller commit 3a01c1ef75e1d84752ddef607c389bbde9c2576e Author: Stefan Rompf Date: Tue May 9 15:15:35 2006 -0700 [NET]: Add missing operstates documentation. Signed-off-by: Stefan Rompf Signed-off-by: David S. Miller commit 41b11afb048d67cc0e221191191ba0b2012dce47 Author: Pavel Machek Date: Tue May 9 22:27:51 2006 +0100 [ARM] 3508/1: Update collie defconfig Patch from Pavel Machek Update collie defconfig to something that can bring closer-to-working system to its user. Signed-off-by: Pavel Machek Signed-off-by: Russell King commit 1929ab8c6860a4a94109eed038b0fa9d12c81721 Author: Russell King Date: Tue May 9 22:14:28 2006 +0100 [ARM] Fix thread struct allocator for SMP case The ARM thread struct allocator is racy on SMP systems. Fix it by turning it into a per-cpu based allocator. This also allows keeps the cache cache warm for thread structs and kernel stacks. Signed-off-by: Russell King commit a3285aa4eecd722508dab01c4932b11b4ba80134 Author: Roland Dreier Date: Tue May 9 10:50:29 2006 -0700 IB/mthca: Fix race in reference counting Fix races in in destroying various objects. If a destroy routine waits for an object to become free by doing wait_event(&obj->wait, !atomic_read(&obj->refcount)); /* now clean up and destroy the object */ and another place drops a reference to the object by doing if (atomic_dec_and_test(&obj->refcount)) wake_up(&obj->wait); then this is susceptible to a race where the wait_event() and final freeing of the object occur between the atomic_dec_and_test() and the wake_up(). And this is a use-after-free, since wake_up() will be called on part of the already-freed object. Fix this in mthca by replacing the atomic_t refcounts with plain old integers protected by a spinlock. This makes it possible to do the decrement of the reference count and the wake_up() so that it appears as a single atomic operation to the code waiting on the wait queue. While touching this code, also simplify mthca_cq_clean(): the CQ being cleaned cannot go away, because it still has a QP attached to it. So there's no reason to be paranoid and look up the CQ by number; it's perfectly safe to use the pointer that the callers already have. Signed-off-by: Roland Dreier commit d945e1df28ca07642b3e1a9b9d07074ba5f76be0 Author: Roland Dreier Date: Tue May 9 10:50:28 2006 -0700 IB/srp: Fix tracking of pending requests during error handling If a SCSI abort completes, or the command completes successfully, then the driver must remove the command from its queue of pending commands. Similarly, if a device reset succeeds, then all commands queued for the given device must be removed from the queue. Signed-off-by: Roland Dreier commit d8b9f23b23e080d820e3c0aa5ccd7834c26ebf96 Author: Ralph Campbell Date: Tue May 9 10:50:28 2006 -0700 IB: Fix display of 4-bit port counters in sysfs The code to display local_link_integrity_errors and excessive_buffer_overrun_errors in /sys/class/infiniband//ports//counters/ uses the wrong shift to extract the 4 bit values. Signed-off-by: Ralph Campbell Signed-off-by: Roland Dreier commit c51e078f82096a7d35ac8ec2416272e843a0e1c4 Author: Marcelo Tosatti Date: Fri May 5 17:09:29 2006 -0300 [PATCH] ppc32/8xx: Fix r3 trashing due to 8MB TLB page instantiation Instantiation of 8MB pages on the TLB cache for the kernel static mapping trashes r3 register on !CONFIG_8xx_CPU6 configurations. This ensures r3 gets saved and restored. Signed-off-by: Marcelo Tosatti Signed-off-by: Paul Mackerras commit e4de00215c3af02116db3d486bf53700dfe10619 Author: Paul Mackerras Date: Tue May 9 16:00:59 2006 +1000 powerpc/32: Define an is_kernel_addr() to fix ARCH=ppc compilation My commit 6bfd93c32a5065d0e858780b3beb0b667081601c broke the ARCH=ppc compilation by using the is_kernel_addr() macro in asm/uaccess.h. This fixes it by defining a suitable is_kernel_addr() for ARCH=ppc. Signed-off-by: Paul Mackerras commit 8ec93459655a3618dedec6360bb28d63f0010ef6 Author: Jens Osterkamp Date: Thu May 4 05:59:41 2006 -0400 spidernet: enable support for bcm5461 ethernet phy A newer board revision changed the type of ethernet phy. Moreover, this generalizes the way that a phy gets switched into fiber mode when autodetection is not available. Signed-off-by: Jens Osterkamp Signed-off-by: Arnd Bergmann Signed-off-by: Stephen Hemminger commit b636d17a3bee8ba988e78e4bc8262f0dc3fad8ab Author: Jens Osterkamp Date: Thu May 4 05:59:56 2006 -0400 spidernet: introduce new setting We found a new chip setting that we need in order to make the driver work more reliable. Signed-off-by: Arnd Bergmann Signed-off-by: Stephen Hemminger commit aedc0e520e5ae9ba1342c25c4604d18fb236c2bc Author: Sergei Shtylyov Date: Tue May 9 00:58:28 2006 +0400 Fix RTL8019AS init for Toshiba RBTX49xx boards Ensure that 8-bit mode is selected for the on-board Realtek RTL8019AS chip on Toshiba RBHMA4x00, get rid of the duplicate #ifdef's when setting ei_status.word16. The chip's datasheet says that the PSTOP register shouldn't exceed 0x60 in 8-bit mode -- ensure this too. Signed-off-by: Sergei Shtylyov Signed-off-by: Stephen Hemminger commit 8cd35da094bed8a41eb722c1d03eab24d57bf706 Author: Herbert Valerio Riedel Date: Mon May 1 15:37:09 2006 +0200 au1000_eth.c: use ether_crc() from since the au1000 driver already selects the CRC32 routines, simply replace the internal ether_crc() implementation with the semantically equivalent one from Signed-off-by: Herbert Valerio Riedel Signed-off-by: Stephen Hemminger commit 6d4b0f617d577975108ccc7e3b0c7dbe50144df6 Author: Stephen Hemminger Date: Mon May 8 15:11:34 2006 -0700 sky2: version 1.3 Update version number, to track changes. Signed-off-by: Stephen Hemminger commit ed6d32c7a927bfccf921d15a3e25160f4528c3eb Author: Stephen Hemminger Date: Mon May 8 15:11:33 2006 -0700 Add more support for the Yukon Ultra chip found in dual core centino laptops. The newest Yukon Ultra chipset's require more special tweaks. They seem to be like the Yukon XL chipsets. This code is transliterated from the latest SysKonnect driver; I don't have any Ultra hardware. Signed-off-by: Stephe Hemminger Signed-off-by: Stephen Hemminger commit 72cb8529208020484cecd69bbf87719b50ee6313 Author: Stephen Hemminger Date: Mon May 8 15:11:32 2006 -0700 sky2: synchronize irq on remove Need to make sure interrupt is not racing with unregister of network device. Signed-off-by: Stephen Hemminger commit e71ebd73276cc21efc74aba4118ef037cd32e50a Author: Stephen Hemminger Date: Mon May 8 15:11:31 2006 -0700 sky2: dont write status ring It is more efficient not to write the status ring from the processor and just read the active portion. Signed-off-by: Stephen Hemminger commit 01bd75645f94d49cb7ffd61022890166ce00ec2a Author: Stephen Hemminger Date: Mon May 8 15:11:30 2006 -0700 sky2: edge triggered workaround enhancement Need to make the edge-triggered workaround timer faster to get marginally better peformance. The test_and_set_bit in schedule_prep() acts as a barrier already. Make it a module parameter so that laptops who are concerned about power can set it to 0; and user's stuck with broken BIOS's can turn the driver into pure polling. Signed-off-by: Stephen Hemminger commit cb5d9547307f44f210f88c829bad4249eeb24bc3 Author: Stephen Hemminger Date: Mon May 8 15:11:29 2006 -0700 sky2: use mask instead of modulo operation Gcc isn't smart enough to know that it can do a modulo operation with power of 2 constant by doing a mask. So add macro to do it for us. Signed-off-by: Stephen Hemminger commit f55925d7eb04f936ab4c001f10e3e9c74c1297ae Author: Stephen Hemminger Date: Mon May 8 15:11:28 2006 -0700 sky2: tx ring index mask fix Mask for transmit ring status was picking up bits from the unused sync ring. They were always zero, so far... Also, make sure to remind self not to make tx ring too big. Signed-off-by: Stephen Hemminger commit 1e5f1283a2aed429f4457e2eb875b1928a6643df Author: Stephen Hemminger Date: Mon May 8 15:11:27 2006 -0700 sky2: status irq hang fix The status interrupt flag should be cleared before processing, not afterwards to avoid race. Need to process in poll routine even if no new interrupt status. This is a normal occurrence when more than 64 frames (NAPI weight) are processed in one poll routine. Signed-off-by: Stephen Hemminger commit d324031245abbb54e4e0321004430826052b6c37 Author: Stephen Hemminger Date: Mon May 8 15:11:26 2006 -0700 sky2: backout NAPI reschedule This is a backout of earlier patch. The whole rescheduling hack was a bad idea. It doesn't really solve the problem and it makes the code more complicated for no good reason. Signed-off-by: Stephen Hemminger commit 601e7f024edbea8018de34c83a7398623214e636 Author: Linus Torvalds Date: Mon May 8 13:38:42 2006 -0700 Revert "kbuild: fix modpost segfault for 64bit mipsel kernel" This reverts commit c8d8b837ebe4b4f11e1b0c4a2bdc358c697692ed, which caused problems for the x86 build. Quoth Sam: "It was discussed on mips list but apparently the fix was bogus. I will not have time to look into it so mips can carry this local fix until we get a proper fix in mainline." Signed-off-by: Linus Torvalds commit f9d8f063fee645a23776519fb5c910b9d9435270 Author: Russell King Date: Mon May 8 20:31:11 2006 +0100 [ARM] Update mach-types Signed-off-by: Russell King commit 5eb204eb1fff7387d3ab3e6225c0099dc34e69db Author: Russell King Date: Mon May 8 20:30:24 2006 +0100 [ARM] Update versatile_defconfig Update versatile default configuration, enabling the AACI sound driver, VFP and Versatile AB support. Signed-off-by: Russell King commit 6810b548b25114607e0814612d84125abccc0a4f Author: Andi Kleen Date: Mon May 8 15:17:31 2006 +0200 [PATCH] x86_64: Move ondemand timer into own work queue Taking the cpu hotplug semaphore in a normal events workqueue is unsafe because other tasks can wait for any workqueues with it hold. This results in a deadlock. Move the DBS timer into its own work queue which is not affected by other work queue flushes to avoid this. Has been acked by Venkatesh. Cc: venkatesh.pallipadi@intel.com Cc: cpufreq@lists.linux.org.uk Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit ac71d12c990526b01ef6cfe50907ef8530a30331 Author: Andi Kleen Date: Mon May 8 15:17:28 2006 +0200 [PATCH] x86_64: Avoid EBDA area in early boot allocator Based on analysis&patch from Robert Hentosch Observed on a Dell PE6850 with 16GB The problem occurs very early on, when the kernel allocates space for the temporary memory map called bootmap. The bootmap overlaps the EBDA region. EBDA region is not historically reserved in the e820 mapping. When the bootmap is freed it marks the EBDA region as usable. If you notice in setup.c there is already code to work around the EBDA in reserve_ebda_region(), this check however occurs after the bootmap is allocated and doesn't prevent the bootmap from using this range. AK: I redid the original patch. Thanks also to Jan Beulich for spotting some mistakes. Cc: Robert_Hentosch@dell.com Cc: jbeulich@novell.com Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit 8b1ffe9550e71224c43d8c754245bd76f4ea9bb8 Author: Corey Minyard Date: Mon May 8 15:17:25 2006 +0200 [PATCH] x86_64: add nmi_exit to die_nmi Playing with NMI watchdog on x86_64, I discovered that it didn't do what I expected. It always panic-ed, even when it didn't happen from interrupt context. This patch solves that problem for me. Also, in this case, do_exit() will be called with interrupts disabled, I believe. Would it be wise to also call local_irq_enable() after nmi_exit()? [Yes I added it -AK] Currently, on x86_64, any NMI watchdog timeout will cause a panic because the irq count will always be set to be in an interrupt when do_exit() is called from die_nmi(). If we add nmi_exit() to the die_nmi() call (since the nmi will never exit "normally") it seems to solve this problem. The following small program can be used to trigger the NMI watchdog to reproduce this: main () { iopl(3); for (;;) asm("cli"); } Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit cdc60a4c8e71c4bcf67e83fac6c0cabd0ff19bfe Author: Corey Minyard Date: Mon May 8 15:17:22 2006 +0200 [PATCH] x86_64: fix die_lock nesting I noticed this when poking around in this area. The oops_begin() function in x86_64 would only conditionally claim the die_lock if the call is nested, but oops_end() would always release the spinlock. This patch adds a nest count for the die lock so that the release of the lock is only done on the final oops_end(). Signed-off-by: Corey Minyard Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit 5192d84e4c32cd335fd572e5ff0712041f45f7e7 Author: Andi Kleen Date: Mon May 8 15:17:19 2006 +0200 [PATCH] x86_64: Check for too many northbridges in IOMMU code The IOMMU code can only deal with 8 northbridges. Error out when more are found. Signed-off-by: Andi Kleen Signed-off-by: Linus Torvalds commit e0c1e9bf81badc7ba59e120d6218101903d5d103 Author: Kimball Murray Date: Mon May 8 15:17:16 2006 +0200 [PATCH] x86_64: avoid IRQ0 ioapic pin collision The patch addresses a problem with ACPI SCI interrupt entry, which gets re-used, and the IRQ is assigned to another unrelated device. The patch corrects the code such that SCI IRQ is skipped and duplicate entry is avoided. Second issue came up with VIA chipset, the problem was caused by original patch assigning IRQs starting 16 and up. The VIA chipset uses 4-bit IRQ register for internal interrupt routing, and therefore cannot handle IRQ numbers assigned to its devices. The patch corrects this problem by allowing PCI IRQs below 16. Cc: len.brown@intel.com Signed-off by: Natalie Protasevich Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 75dff55af9a989293e9f9bacf049858f4262bc08 Author: Trond Myklebust Date: Sun May 7 23:02:42 2006 -0400 [PATCH] fs/locks.c: Fix lease_init It is insane to be giving lease_init() the task of freeing the lock it is supposed to initialise, given that the lock is not guaranteed to be allocated on the stack. This causes lockups in fcntl_setlease(). Problem diagnosed by Daniel Hokka Zakrisson Also fix a slab leak in __setlease() due to an uninitialised return value. Problem diagnosed by Björn Steinbrink. Signed-off-by: Trond Myklebust Tested-by: Daniel Hokka Zakrisson Signed-off-by: Linus Torvalds commit e63a3690013a475746ad2cea998ebb534d825704 Author: Nathan Scott Date: Mon May 8 19:51:58 2006 +1000 [XFS] Fix a possible metadata buffer (AGFL) refcount leak when fixing an AG freelist. SGI-PV: 952681 SGI-Modid: xfs-linux-melb:xfs-kern:25902a Signed-off-by: Nathan Scott commit b1ecdda9313ec5d2f971993f44f6b657acf70cff Author: Nathan Scott Date: Mon May 8 19:51:42 2006 +1000 [XFS] Fix a project quota space accounting leak on rename. SGI-PV: 951636 SGI-Modid: xfs-linux-melb:xfs-kern:25811a Signed-off-by: Nathan Scott commit d08d389d5aef0509edba7ee42cd6c6a3998fee22 Author: Nathan Scott Date: Mon May 8 19:51:28 2006 +1000 [XFS] Fix a possible forced shutdown due to mishandling write barriers with remount,ro. SGI-PV: 951944 SGI-Modid: xfs-linux-melb:xfs-kern:25742a Signed-off-by: Nathan Scott commit fd5f0cd6b0cef59ba18e5ac13be5b2775fa6ec28 Author: Jan Beulich Date: Tue May 2 12:33:20 2006 +0200 kbuild: Do not overwrite makefile as anohter user Change the conditional of the outputmakefile rule to be evaluated entirely in make, and add a conditional to not touch the generated makefile when e.g. running 'make install' as root while the build was done as non-root. Also adjust the comment describing this, and move the message printing and redirection to mkmakefile. Signed-off-by: Jan Beulich Signed-off-by: Sam Ravnborg commit 74fae122eb9f0db8b8718b9851c31c2f374fb134 Author: Bellido Nicolas Date: Sun May 7 22:49:24 2006 +0100 [ARM] 3507/1: Replace map_desc.physical with map_desc.pfn: aaed2000 Patch from Bellido Nicolas aaed2000 map_desc.pfn conversion Signed-off-by: Nicolas Bellido Signed-off-by: Russell King commit 9a708becafe99fa32211e8c53dbacefdb4b11718 Author: Bellido Nicolas Date: Sun May 7 22:49:23 2006 +0100 [ARM] 3506/1: aaec2000: debug-macro.S needs hardware.h Patch from Bellido Nicolas Include hardware.h in debug-macro.S, otherwise io_p2v is undefined. Signed-off-by: Nicolas Bellido Signed-off-by: Russell King commit 201be92a4243e58bcc6c0878489bcc2aaaf51c80 Author: Bellido Nicolas Date: Sun May 7 22:49:22 2006 +0100 [ARM] 3505/1: aaec2000: entry-macro.S needs asm/arch/irqs.h Patch from Bellido Nicolas Since git commit 2b78838842346da390e8547cd37035184376d506, entry-macro.S needs to include asm/arch/irqs.h Signed-off-by: Nicolas Bellido Signed-off-by: Russell King commit 8a33b224ecb576e27695ff8922c8e579dbf7070e Author: Bellido Nicolas Date: Sun May 7 22:49:21 2006 +0100 [ARM] 3504/1: Fix clcd includes for aaec2000 Patch from Bellido Nicolas Since this patch: [ARM] 3366/1: Allow the 16bpp mode configuration in the CLCD control register linux/amba/bus.h needs to be included before linux/amba/clcd.h Signed-off-by: Nicolas Bellido Signed-off-by: Russell King commit 16b6dd4419cdef637a907cfc26594e4ebe688975 Author: Bellido Nicolas Date: Sun May 7 22:49:21 2006 +0100 [ARM] 3503/1: Fix map_desc structure for aaec2000 Patch from Bellido Nicolas Patch: [ARM] 2982/1: Replace map_desc.physical with map_desc.pfn: aaec2000 incorrectly expanded the struct map_desc for aaec2000. Signed-off-by: Nicolas Bellido Signed-off-by: Russell King commit 216251cff98838f2b79c53fc8a9e76884944be7d Author: Sascha Hauer Date: Sun May 7 18:56:27 2006 +0100 [ARM] 3501/1: i.MX: fix lowlevel debug macros Patch from Sascha Hauer This patch fixes the addruart macro to work with both mmu enabled and disabled. Signed-off-by: Sascha Hauer Signed-off-by: Russell King commit f5b40e363ad6041a96e3da32281d8faa191597b9 Author: Linus Torvalds Date: Sun May 7 10:49:33 2006 -0700 Fix ptrace_attach()/ptrace_traceme()/de_thread() race This holds the task lock (and, for ptrace_attach, the tasklist_lock) over the actual attach event, which closes a race between attacking to a thread that is either doing a PTRACE_TRACEME or getting de-threaded. Thanks to Oleg Nesterov for reminding me about this, and Chris Wright for noticing a lost return value in my first version. Signed-off-by: Linus Torvalds commit 0eb1bd210d94e9f2c87551d794bb2755e5e24eed Author: Randy Dunlap Date: Sat May 6 18:34:10 2006 -0700 [IRDA] irda-usb: use NULL instead of 0 Use NULL instead of 0 for a null pointer value (sparse warning): drivers/net/irda/irda-usb.c:1781:30: warning: Using plain integer as NULL pointer Also, correct timeout argument to use milliseconds instead of jiffies. Signed-off-by: Randy Dunlap Signed-off-by: David S. Miller commit 0182bd2b1e2fb45a55f110795bfdb9aa5f6c6b0b Author: Hua Zhong Date: Sat May 6 18:11:39 2006 -0700 [IPV4]: Remove likely in ip_rcv_finish() This is another result from my likely profiling tool (dwalker@mvista.com just sent the patch of the profiling tool to linux-kernel mailing list, which is similar to what I use). On my system (not very busy, normal development machine within a VMWare workstation), I see a 6/5 miss/hit ratio for this "likely". Signed-off-by: Hua Zhong Signed-off-by: David S. Miller commit fe9925b551a95fae6ec61470c79f8b701a2fe928 Author: Stephen Hemminger Date: Sat May 6 17:56:03 2006 -0700 [NET]: Create netdev attribute_groups with class_device_add Atomically create attributes when class device is added. This avoids the race between registering class_device (which generates hotplug event), and the creation of attribute groups. Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman Signed-off-by: David S. Miller commit 1498221d51a43d5fa1a580618591497d90f957d9 Author: Stephen Hemminger Date: Sat May 6 17:55:11 2006 -0700 [CLASS DEVICE]: add attribute_group creation Extend the support of attribute groups in class_device's to allow groups to be created as part of the registration process. This allows network device's to avoid race between registration and creating groups. Note that unlike attributes that are a property of the class object, the groups are a property of the class_device object. This is done because there are different types of network devices (wireless for example). Signed-off-by: Stephen Hemminger Signed-off-by: Greg Kroah-Hartman Signed-off-by: David S. Miller commit f12267011d16b1722e71aa12cd3e89eb70a9edd6 Author: Russell King Date: Sat May 6 11:29:21 2006 +0100 [ARM] rtc-sa1100: fix compiler warnings and error cleanup Fix: drivers/rtc/rtc-sa1100.c: In function `sa1100_rtc_proc': drivers/rtc/rtc-sa1100.c:298: warning: unsigned int format, long unsigned int arg (arg 3) and arrange for sa1100_rtc_open() to pass the devid to free_irq() rather than NULL. Signed-off-by: Russell King commit 19ca5d27e15c10d8529984ecd98dcba2637edcd2 Author: Russell King Date: Sat May 6 11:26:30 2006 +0100 [ARM] Allow SA1100 RTC alarm to be configured for wakeup The SA1100 RTC alarm can be configured to wake up the CPU from sleep mode, and the RTC driver has been using the API to configure this mode. Unfortunately, the code was which sets the required bit in the hardware was missing. Signed-off-by: Russell King commit 5528e568a760442e0ec8fd2dea1f0791875a066b Author: John Heffner Date: Fri May 5 17:41:44 2006 -0700 [TCP]: Fix snd_cwnd adjustments in tcp_highspeed.c Xiaoliang (David) Wei wrote: > Hi gurus, > > I am reading the code of tcp_highspeed.c in the kernel and have a > question on the hstcp_cong_avoid function, specifically the following > AI part (line 136~143 in net/ipv4/tcp_highspeed.c ): > > /* Do additive increase */ > if (tp->snd_cwnd < tp->snd_cwnd_clamp) { > tp->snd_cwnd_cnt += ca->ai; > if (tp->snd_cwnd_cnt >= tp->snd_cwnd) { > tp->snd_cwnd++; > tp->snd_cwnd_cnt -= tp->snd_cwnd; > } > } > > In this part, when (tp->snd_cwnd_cnt == tp->snd_cwnd), > snd_cwnd_cnt will be -1... snd_cwnd_cnt is defined as u16, will this > small chance of getting -1 becomes a problem? > Shall we change it by reversing the order of the cwnd++ and cwnd_cnt -= > cwnd? Absolutely correct. Thanks. Signed-off-by: John Heffner Signed-off-by: David S. Miller commit f530937b2cccdb131cb459977943c98421ab09b3 Author: Ralf Baechle Date: Fri May 5 17:19:26 2006 -0700 [NETROM/ROSE]: Kill module init version kernel log messages. There are out of date and don't tell the user anything useful. The similar messages which IPV4 and the core networking used to output were killed a long time ago. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 134af34632a7b3b0a98a79a2e56bf9cc927e0eac Author: Herbert Xu Date: Fri May 5 17:09:13 2006 -0700 [DCCP]: Fix sock_orphan dead lock Calling sock_orphan inside bh_lock_sock in dccp_close can lead to dead locks. For example, the inet_diag code holds sk_callback_lock without disabling BH. If an inbound packet arrives during that admittedly tiny window, it will cause a dead lock on bh_lock_sock. Another possible path would be through sock_wfree if the network device driver frees the tx skb in process context with BH enabled. We can fix this by moving sock_orphan out of bh_lock_sock. The tricky bit is to work out when we need to destroy the socket ourselves and when it has already been destroyed by someone else. By moving sock_orphan before the release_sock we can solve this problem. This is because as long as we own the socket lock its state cannot change. So we simply record the socket state before the release_sock and then check the state again after we regain the socket lock. If the socket state has transitioned to DCCP_CLOSED in the time being, we know that the socket has been destroyed. Otherwise the socket is still ours to keep. This problem was discoverd by Ingo Molnar using his lock validator. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 1c29fc4989bc2a3838b2837adc12b8aeb0feeede Author: Stephen Hemminger Date: Fri May 5 17:07:13 2006 -0700 [BRIDGE]: keep track of received multicast packets It makes sense to add this simple statistic to keep track of received multicast packets. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller commit 35d63edb1c807bc5317e49592260e84637bc432e Author: Sridhar Samudrala Date: Fri May 5 17:05:23 2006 -0700 [SCTP]: Fix state table entries for chunks received in CLOSED state. Discard an unexpected chunk in CLOSED state rather can calling BUG(). Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 62b08083ec3dbfd7e533c8d230dd1d8191a6e813 Author: Sridhar Samudrala Date: Fri May 5 17:04:43 2006 -0700 [SCTP]: Fix panic's when receiving fragmented SCTP control chunks. Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that are received as skb's with fragment list. Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 672e7cca17ed6036a1756ed34cf20dbd72d5e5f6 Author: Vladislav Yasevich Date: Fri May 5 17:03:49 2006 -0700 [SCTP]: Prevent possible infinite recursion with multiple bundled DATA. There is a rare situation that causes lksctp to go into infinite recursion and crash the system. The trigger is a packet that contains at least the first two DATA fragments of a message bundled together. The recursion is triggered when the user data buffer is smaller that the full data message. The problem is that we clone the skb for every fragment in the message. When reassembling the full message, we try to link skbs from the "first fragment" clone using the frag_list. However, since the frag_list is shared between two clones in this rare situation, we end up setting the frag_list pointer of the second fragment to point to itself. This causes sctp_skb_pull() to potentially recurse indefinitely. Proposed solution is to make a copy of the skb when attempting to link things using frag_list. Signed-off-by: Vladislav Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 7c3ceb4fb9667f34f1599a062efecf4cdc4a4ce5 Author: Neil Horman Date: Fri May 5 17:02:09 2006 -0700 [SCTP]: Allow spillover of receive buffer to avoid deadlock. This patch fixes a deadlock situation in the receive path by allowing temporary spillover of the receive buffer. - If the chunk we receive has a tsn that immediately follows the ctsn, accept it even if we run out of receive buffer space and renege data with higher TSNs. - Once we accept one chunk in a packet, accept all the remaining chunks even if we run out of receive buffer space. Signed-off-by: Neil Horman Acked-by: Mark Butler Acked-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala Signed-off-by: David S. Miller commit 568cb09b9d889b6f2852ede19772b8e9eed36c1e Author: Nicolas Pitre Date: Fri May 5 22:35:05 2006 +0100 [ARM] 3495/1: EABI: undefine removed syscalls, but... Patch from Nicolas Pitre ... but only for user space. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King commit 99532559dc7a8e686b2cef14c780a7ad5dbd4a31 Author: Nicolas Pitre Date: Fri May 5 22:32:24 2006 +0100 [ARM] 3500/1: fix PXA27x DMA allocation priority Patch from Nicolas Pitre Intel PXA27x developers manual section 5.4.1.1 lists a priority distribution for the DMA channels differently than what the code currently assumes. This patch fixes that. Noticed by Simon Vogl Signed-off-by: Nicolas Pitre Signed-off-by: Russell King commit b7d7ef87e15dea105be59ec8f14e2f92182dd421 Author: George G. Davis Date: Fri May 5 22:32:23 2006 +0100 [ARM] 3499/1: Fix VFP FPSCR corruption for double exception case Patch from George G. Davis The ARM VFP FPSCR register is corrupted when a condition flags modifying VFP instruction is followed by a non-condition flags modifying VFP instruction and both instructions raise exceptions. The fix is to read the current FPSCR in between emulation of these two instructions and use the current FPSCR value when handling the second exception. Signed-off-by: George G. Davis Signed-off-by: Russell King commit 178e0cc5ff249965c6cfbd78b1af6a5e614d837c Author: David Woodhouse Date: Fri May 5 18:19:37 2006 +0100 [PATCH] bcm43xx: Fix access to non-existent PHY registers Fix the conditions under which we poke at the APHY registers in bcm43xx_phy_initg() to avoid a machine check on chips where they don't exist. Signed-off-by: David Woodhouse Signed-off-by: John W. Linville commit 869aaab1812c4212e65fb181e94b824cf49f9509 Author: Michael Buesch Date: Fri May 5 17:23:51 2006 +0200 [PATCH] bcm43xx: Fix array overrun in bcm43xx_geo_init The problem here is that the bcm34xx driver and the ieee80211 stack do not agree on what channels are possible for 802.11a. The ieee80211 stack only wants channels between 34 and 165, while the bcm43xx driver accepts anything from 0 to 200. I made the bcm43xx driver comply with the ieee80211 stack expectations, by using the proper constants. Signed-off-by: Jean Delvare [mb]: Reduce stack usage by kzalloc-ing ieee80211_geo Signed-off-by: Michael Buesch Signed-off-by: John W. Linville commit f9f7b9602ecb66f55718d6d1afa3e2b1e721b22d Author: Stefano Brivio Date: Fri May 5 01:26:29 2006 +0200 [PATCH] bcm43xx: check for valid MAC address in SPROM Check for valid MAC address in SPROM fields instead of relying on PHY type while setting the MAC address in the networking subsystem, as some devices have multiple PHYs. Signed-off-by: Stefano Brivio Signed-off-by: John W. Linville commit f21709d70ad6d7ad50288f7056c3a368138b017c Author: Jean Delvare Date: Thu May 4 19:47:19 2006 +0200 [PATCH] ieee80211: Fix A band channel count (resent) The channel count for 802.11a is still not right. We better compute it from the min and max channel numbers, rather than hardcoding it. Signed-off-by: Jean Delvare Signed-off-by: John W. Linville commit 5b4b9775a00c20ade1b1ac8aa25e0e4059d6243e Author: Michael Buesch Date: Mon May 1 22:43:00 2006 +0200 [PATCH] bcm43xx: fix iwmode crash when down This fixes a crash when iwconfig ethX mode foo is done before ifconfig ethX up or after ifconfig ethX down Signed-off-by: Michael Buesch Signed-off-by: John W. Linville commit d57336e3f2dd7c2d1fbe4a8323029869fb6e1f00 Author: Daniel Drake Date: Sun Apr 30 22:09:07 2006 +0100 [PATCH] softmac: make non-operational after being stopped zd1211 with softmac and wpa_supplicant revealed an issue with softmac and the use of workqueues. Some of the work functions actually reschedule themselves, so this meant that there could still be pending work after flush_scheduled_work() had been called during ieee80211softmac_stop(). This patch introduces a "running" flag which is used to ensure that rescheduling does not happen in this situation. I also used this flag to ensure that softmac's hooks into ieee80211 are non-operational once the stop operation has been started. This simply makes softmac a little more robust, because I could crash it easily by receiving frames in the short timeframe after shutting down softmac and before turning off the ZD1211 radio. (ZD1211 is now fixed as well!) Signed-off-by: Daniel Drake Acked-by: Johannes Berg Signed-off-by: John W. Linville commit 995c99268e0b12eb3c8939211ba5368dd92d98d9 Author: Daniel Drake Date: Sun Apr 30 19:49:30 2006 +0100 [PATCH] softmac: don't reassociate if user asked for deauthentication When wpa_supplicant exits, it uses SIOCSIWMLME to request deauthentication. softmac then tries to reassociate without any user intervention, which isn't the desired behaviour of this signal. This change makes softmac only attempt reassociation if the remote network itself deauthenticated us. Signed-off-by: Daniel Drake Acked-by: Johannes Berg Signed-off-by: John W. Linville commit 913ed41eb5c948d2f8b5deffd29c2638eceef3d7 Author: Jon Mason Date: Wed May 3 17:26:58 2006 -0500 [IA64] remove asm-ia64/bitops.h self-inclusion asm-ia64/bitops.h includes itself. The #ifndef _ASM_IA64_BITOPS_H prevents this from being an issue, but it should still be removed. Signed-off-by: Jon Mason Signed-off-by: Tony Luck commit 3e6e155646706f1ef9f791a4402d145f112a3f8d Author: Chen, Kenneth W Date: Wed May 3 11:53:43 2006 -0700 [IA64] strcpy returns NULL pointer and not destination pointer Bob Picco noted that 6edfba1b33c701108717f4e036320fc39abe1912 dropped the -ffreestanding compiler flag from the top level Makefile, which allows the compiler to substitute memcpy() in places where strcpy() is used with a known size source string. But the ia64 memcpy() returns 0 for success, and "bytes copied" for failure. Fix to return the address of the destination string (like stdlibc version, and other architectures). There are no places where ia64 specific code makes use of the non-standard return value. Signed-off-by: Ken Chen Signed-off-by: Tony Luck commit 56cf6504fc1c0c221b82cebc16a444b684140fb7 Author: Russell King Date: Fri May 5 17:57:52 2006 +0100 [BLOCK] Fix oops on removal of SD/MMC card The block layer keeps a reference (driverfs_dev) to the struct device associated with the block device, and uses it internally for generating uevents in block_uevent. Block device uevents include umounting the partition, which can occur after the backing device has been removed. Unfortunately, this reference is not counted. This means that if the struct device is removed from the device tree, the block layers reference will become stale. Guard against this by holding a reference to the struct device in add_disk(), and only drop the reference when we're releasing the gendisk kobject - in other words when we can be sure that no further uevents will be generated for this block device. Signed-off-by: Russell King Acked-by: Jens Axboe commit 2eb9d3157107497fdccb51e1570fea677f6e3c82 Author: Uwe Zeisberger Date: Fri May 5 15:11:14 2006 +0100 [ARM] 3496/1: more constants for asm-offsets.h Patch from Uwe Zeisberger added the following constants: - MACHINFO_TYPE - MACHINFO_NAME - MACHINFO_PHYSIO - MACHINFO_PGOFFIO - PROCINFO_INITFUNC - PROCINFO_MMUFLAGS and removed their definition from head.S and head-nommu.S Signed-off-by: Uwe Zeisberger Signed-off-by: Russell King commit ff10952a547dad934d9ed9afc5cf579ed1ccb53a Author: Nicolas Pitre Date: Fri May 5 15:11:14 2006 +0100 [ARM] 3494/1: asm-arm/bug.h needs linux/stddef.h Patch from Nicolas Pitre ... for the definition of NULL. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King commit fed3be9bd56e67c9b9324277b7f95c32e73a75bb Author: Linus Torvalds Date: Thu May 4 13:23:40 2006 -0400 CREDITS file update (Tristan Greaves) By request from Tristan. Signed-off-by: Linus Torvalds commit 920e70c5c603ada05dd480ca0ccc0ae12a5fdc39 Author: Russell King Date: Thu May 4 18:22:51 2006 +0100 [MMC] Move set_ios debugging into mmc.c Rather than having every driver duplicate the set_ios debugging, provide a single version in mmc.c which can be expanded as we add additional functionality. Signed-off-by: Russell King commit 5b802344357338a4d645beac8ca97470bcbe3542 Author: Sascha Hauer Date: Thu May 4 14:07:42 2006 +0100 [ARM] 3490/1: i.MX: move uart resources to board files Patch from Sascha Hauer This patch moves the i.MX uart resources and the gpio pin setup to the board files. This allows the boards to decide how many internal uarts are connected to the outside world and whether they use rts/cts or not. Signed-off-by: Sascha Hauer Signed-off-by: Russell King commit fe10c6abea8bc83291a13e0580b3e4c355710b09 Author: Russell King Date: Thu May 4 13:51:45 2006 +0100 [MMC] Correct mmc_request_done comments mmc_request_done should be called at the end of handling a request, not between the data and initial command parts of the request. Signed-off-by: Russell King commit 98232d504db0a1f91ecaa93686ed3bf61963103b Author: Jens Axboe Date: Thu May 4 09:13:49 2006 +0200 [PATCH] compat_sys_vmsplice: one-off in UIO_MAXIOV check nr_segs may not be > UIO_MAXIOV, however it may be equal to. This makes the behaviour identical to the real sys_vmsplice(). The other foov syscalls also agree that this is the way to go. Signed-off-by: Jens Axboe commit d1a649838802edd94b6335834919463c6ae61f40 Author: Patrick Caulfield Date: Wed May 3 23:36:23 2006 -0700 [DECNET]: Fix level1 router hello This patch fixes hello messages sent when a node is a level 1 router. Slightly contrary to the spec (maybe) VMS ignores hello messages that do not name level2 routers that it also knows about. So, here we simply name all the routers that the node knows about rather just other level1 routers. (I hope the patch is clearer than the description. sorry). Signed-off-by: Patrick Caulfield Signed-off-by: David S. Miller commit 75c2d9077c63ac21488129cc23561d4f4fd0f5e5 Author: Herbert Xu Date: Wed May 3 23:31:35 2006 -0700 [TCP]: Fix sock_orphan dead lock Calling sock_orphan inside bh_lock_sock in tcp_close can lead to dead locks. For example, the inet_diag code holds sk_callback_lock without disabling BH. If an inbound packet arrives during that admittedly tiny window, it will cause a dead lock on bh_lock_sock. Another possible path would be through sock_wfree if the network device driver frees the tx skb in process context with BH enabled. We can fix this by moving sock_orphan out of bh_lock_sock. The tricky bit is to work out when we need to destroy the socket ourselves and when it has already been destroyed by someone else. By moving sock_orphan before the release_sock we can solve this problem. This is because as long as we own the socket lock its state cannot change. So we simply record the socket state before the release_sock and then check the state again after we regain the socket lock. If the socket state has transitioned to TCP_CLOSE in the time being, we know that the socket has been destroyed. Otherwise the socket is still ours to keep. Note that I've also moved the increment on the orphan count forward. This may look like a problem as we're increasing it even if the socket is just about to be destroyed where it'll be decreased again. However, this simply enlarges a window that already exists. This also changes the orphan count test by one. Considering what the orphan count is meant to do this is no big deal. This problem was discoverd by Ingo Molnar using his lock validator. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller commit 82e84249f0ee098e004c8bd6d90a1640bd56cfbb Author: Ralf Baechle Date: Wed May 3 23:28:20 2006 -0700 [ROSE]: Eleminate HZ from ROSE kernel interfaces Convert all ROSE sysctl time values from jiffies to ms as units. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 4d8937d0b113e8ec39f7d18cf13804f3b5fb8fd4 Author: Ralf Baechle Date: Wed May 3 23:27:47 2006 -0700 [NETROM]: Eleminate HZ from NET/ROM kernel interfaces Convert all NET/ROM sysctl time values from jiffies to ms as units. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit e1fdb5b39656ea2be8cadde565e543649a988af9 Author: Ralf Baechle Date: Wed May 3 23:27:16 2006 -0700 [AX.25]: Eleminate HZ from AX.25 kernel interfaces Convert all AX.25 sysctl time values from jiffies to ms as units. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 4cc7c2734e2b4032103e47d8f3e8b6fa3360d3f1 Author: Ralf Baechle Date: Wed May 3 23:26:20 2006 -0700 [ROSE]: Fix routing table locking in rose_remove_neigh. The locking rule for rose_remove_neigh() are that the caller needs to hold rose_neigh_list_lock, so we better don't take it yet again in rose_neigh_list_lock. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 70868eace5031298c6f6e991a40a2106957f582c Author: Ralf Baechle Date: Wed May 3 23:25:17 2006 -0700 [AX.25]: Move AX.25 symbol exports Move AX.25 symbol exports to next to their definitions where they're supposed to be these days. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 3ab33dcc82e014c69ebad3b524d0053378ef76c3 Author: Ralf Baechle DL5RB Date: Wed May 3 23:24:35 2006 -0700 [HAMRADIO]: Remove remaining SET_MODULE_OWNER calls from hamradio drivers. Signed-off-by: Ralf Baechle DL5RB Signed-off-by: David S. Miller commit 86cfcb95ec60e910d7efcb35ae89bf3403befaad Author: Ralf Baechle Date: Wed May 3 23:23:48 2006 -0700 [AX25, ROSE]: Remove useless SET_MODULE_OWNER calls. Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 3f072310d0ca85891323e9d325c37c76de389387 Author: Ralf Baechle Date: Wed May 3 23:22:36 2006 -0700 [AX.25]: Spelling fix Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 0cc5ae24af08abe8e2a467f45b54c48a0f52670f Author: Ralf Baechle Date: Wed May 3 23:22:01 2006 -0700 [ROSE]: Remove useless prototype for rose_remove_neigh(). Signed-off-by: Ralf Baechle Signed-off-by: David S. Miller commit 7800007c1e2d42cd4120b87b0ba3f3480f17f30a Author: Patrick McHardy Date: Wed May 3 23:20:27 2006 -0700 [NETFILTER]: x_tables: don't use __copy_{from,to}_user on unchecked memory in compat layer Noticed by Linus Torvalds Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 7582e9d17edbabab6cbe59467c5d1b5e8c04fca8 Author: Jing Min Zhao Date: Wed May 3 23:19:59 2006 -0700 [NETFILTER]: H.323 helper: Change author's email address Signed-off-by: Jing Min Zhao Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 2354feaeb2acb78f6aabdf8410d55b44492a7949 Author: Patrick McHardy Date: Wed May 3 23:19:26 2006 -0700 [NETFILTER]: NAT: silence unused variable warnings with CONFIG_XFRM=n net/ipv4/netfilter/ip_nat_standalone.c: In function 'ip_nat_out': net/ipv4/netfilter/ip_nat_standalone.c:223: warning: unused variable 'ctinfo' net/ipv4/netfilter/ip_nat_standalone.c:222: warning: unused variable 'ct' Surprisingly no complaints so far .. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 4228e2a9890cd01b0c8cc58af6fd9e08a4b5e8a7 Author: Patrick McHardy Date: Wed May 3 23:17:11 2006 -0700 [NETFILTER]: H.323 helper: fix use of uninitialized data When a Choice element contains an unsupported choice no error is returned and parsing continues normally, but the choice value is not set and contains data from the last parsed message. This may in turn lead to parsing of more stale data and following crashes. Fixes a crash triggered by testcase 0003243 from the PROTOS c07-h2250v4 testsuite following random other testcases: CPU: 0 EIP: 0060:[] Not tainted VLI EFLAGS: 00210646 (2.6.17-rc2 #3) EIP is at memmove+0x19/0x22 eax: d7be0307 ebx: d7be0307 ecx: e841fcf9 edx: d7be0307 esi: bfffffff edi: bfffffff ebp: da5eb980 esp: c0347e2c ds: 007b es: 007b ss: 0068 Process events/0 (pid: 4, threadinfo=c0347000 task=dff86a90) Stack: <0>00000006 c0347ea6 d7be0301 e09a6b2c 00000006 da5eb980 d7be003e d7be0052 c0347f6c e09a6d9c 00000006 c0347ea6 00000006 00000000 d7b9a548 00000000 c0347f6c d7b9a548 00000004 e0a1a119 0000028f 00000006 c0347ea6 00000006 Call Trace: [] mangle_contents+0x40/0xd8 [ip_nat] [] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat] [] set_addr+0x60/0x14d [ip_nat_h323] [] q931_help+0x2da/0x71a [ip_conntrack_h323] [] q931_help+0x30c/0x71a [ip_conntrack_h323] [] ip_conntrack_help+0x22/0x2f [ip_conntrack] [] nf_iterate+0x2e/0x5f [] xfrm4_output_finish+0x0/0x39f [] nf_hook_slow+0x42/0xb0 [] xfrm4_output_finish+0x0/0x39f [] xfrm4_output+0x3c/0x4e [] xfrm4_output_finish+0x0/0x39f [] ip_forward+0x1c2/0x1fa [] ip_rcv+0x388/0x3b5 [] netif_receive_skb+0x2bc/0x2ec [] process_backlog+0x6b/0xd0 [] net_rx_action+0x4b/0xb7 [] __do_softirq+0x35/0x7d [] do_softirq+0x38/0x3f Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit 6fd737031eb6869430d0f3cf6bf1440adf7aedf5 Author: Patrick McHardy Date: Wed May 3 23:16:29 2006 -0700 [NETFILTER]: H.323 helper: fix endless loop caused by invalid TPKT len When the TPKT len included in the packet is below the lowest valid value of 4 an underflow occurs which results in an endless loop. Found by testcase 0000058 from the PROTOS c07-h2250v4 testsuite. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller commit a0548871ed267ae12eb1c860c5aaebd9e466b34e Author: Jens Axboe Date: Wed May 3 10:58:22 2006 +0200 [PATCH] splice: redo page lookup if add_to_page_cache() returns -EEXIST This can happen quite easily, if several processes are trying to splice the same file at the same time. It's not a failure, it just means someone raced with us in allocating this file page. So just dump the allocated page and relookup the original. Signed-off-by: Jens Axboe commit 76ad4d11105ccd40a536db1057083f28326019fd Author: Jens Axboe Date: Wed May 3 10:41:33 2006 +0200 [PATCH] splice: rename remaining info variables to pipe Same thing was done in fs/pipe.c and most of fs/splice.c, but we had a few missing still. Signed-off-by: Jens Axboe commit 1432873af7ae29d4bb3c56114c05b539d078ca62 Author: Jens Axboe Date: Wed May 3 10:35:26 2006 +0200 [PATCH] splice: LRU fixups Nick says that the current construct isn't safe. This goes back to the original, but sets PIPE_BUF_FLAG_LRU on user pages as well as they all seem to be on the LRU in the first place. Signed-off-by: Jens Axboe commit bfc4ee39fdbb2deb8864785d5e5bc5cdd3b31a69 Author: Jens Axboe Date: Wed May 3 10:35:10 2006 +0200 [PATCH] splice: fix unlocking of page on error ->prepare_write() Looking at generic_file_buffered_write(), we need to unlock_page() if prepare write fails and it isn't due to racing with truncate(). Also trim the size if ->prepare_write() fails, if we have to. Signed-off-by: Jens Axboe commit 5dea5176e5c32ef9f0d1a41d28427b3bf6881b3a Author: Mingming Cao Date: Wed May 3 19:55:12 2006 -0700 [PATCH] ext3: multile block allocate little endian fixes Some places in ext3 multiple block allocation code (in 2.6.17-rc3) don't handle the little endian well. This was resulting in *wrong* block numbers being assigned to in-memory block variables and then stored on disk eventually. The following patch has been verified to fix an ext3 filesystem failure when run ltp test on a 64 bit machine. Signed-off-by; Mingming Cao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8683dc9990158c221e05959935e7dd50a956c574 Author: Brent Casavant Date: Wed May 3 19:55:10 2006 -0700 [PATCH] Altix: correct ioc4 port order Currently loading the ioc3 as a module will cause the ports to be numbered in reverse order. This mod maintains the proper order of cards for port numbering. Signed-off-by: Brent Casavant Cc: Pat Gefre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 96941026a51e9cb8c2d2be7499301b7fcd9ee225 Author: mark gross Date: Wed May 3 19:55:07 2006 -0700 [PATCH] EDAC Coexistence with BIOS Address the issue of EDAC/BIOS coexistence for the e752x chip-sets. We have found a problem where the BIOS will start the system with the error registers (dev0:fun1) hidden and assuming it has exclusive access to them. The edac driver violates this assumption. The workaround this patch offers is to honor the hidden-ness as an indication that it is not safe to use those registers. Signed-off-by: Mark Gross Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 6760da0197a6ee327a09dafc070b26e2f02651fe Author: Jeff Dike Date: Wed May 3 19:55:03 2006 -0700 [PATCH] uml: change timer initialization inet_init, which schedules, is called before the UML timer_init, which sets up the timer. The result is the interval timers being manipulated before the appropriate signal handlers are established, causing unhandled timers. This is fixed by making timer_init be called earlier. Signed-off-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f0ec5e39765cd254d436a6d86e211d81795952a4 Author: Andi Kleen Date: Wed May 3 19:54:57 2006 -0700 [PATCH] Remove wrong cpu_has_apic checks that came from mismerging We only need to check cpu_has_apic in the IO-APIC/L-APIC parsing, not for all of ACPI. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8c45112b823972e9ff7bbca77dc592ca2224951b Author: David S. Miller Date: Wed May 3 13:55:46 2006 -0700 [SPARC]: Hook up vmsplice into syscall tables. Signed-off-by: David S. Miller commit 0b18ac42aa036c7fa217f178aa6a02c66e19e0a1 Author: James Smart Date: Mon May 1 21:50:40 2006 -0400 [SCSI] lpfc 8.1.6 : Fix Data Corruption in Bus Reset Path This patch updates the lpfc driver to revision 8.1.6, which includes the following changes: - Fix data corruption in SCSI BUS reset path, due to reusing the same request structure for each target. - Change version number to 8.1.6 Signed-off-by: James Smart Signed-off-by: James Bottomley commit 6e1cad02763edec83dba8559d4be8d518a6562a5 Author: Eric Moore Date: Tue Apr 25 17:38:58 2006 -0600 [SCSI] mptspi: revalidate negotiation parameters after host reset and resume This is a bug fix for mptspi driver, where after a host reset or resume, we revalidate the negotiation parameters for all devices. This bug was introduced when the driver was ported to use the spi transport layer. Signed-off-by: Eric Moore Signed-off-by: James Bottomley commit 30d55280b867aa0cae99f836ad0181bb0bf8f9cb Author: Stephen Smalley Date: Wed May 3 10:52:36 2006 -0400 [PATCH] selinux: Clear selinux_enabled flag upon runtime disable. Clear selinux_enabled flag upon runtime disable of SELinux by userspace, and make sure it is defined even if selinux= boot parameter support is not enabled in configuration. Signed-off-by: Stephen Smalley Acked-by: James Morris Tested-by: Jon Smirl Acked-by: Al Viro Signed-off-by: Linus Torvalds commit d205819e2346d20fee41297ea6cf789c591abccf Author: Paul Mackerras Date: Wed May 3 23:04:37 2006 +1000 [PATCH] powerpc: Use the ibm,pa-features property if available Forthcoming IBM machines will have a "ibm,pa-features" property on CPU nodes, that contains bits indicating which optional architecture features are implemented by the CPU. This adds code to use the property, if present, to update our CPU feature bitmaps. Note that this means we can both set and clear feature bits based on what the firmware tells us. This is based on a patch by Will Schmidt . Signed-off-by: Paul Mackerras commit 6bfd93c32a5065d0e858780b3beb0b667081601c Author: Paul Mackerras Date: Wed May 3 23:02:04 2006 +1000 powerpc: Fix incorrect might_sleep in __get_user/__put_user on kernel addresses We have a case where __get_user and __put_user can validly be used on kernel addresses in interrupt context - namely, the alignment exception handler, as our get/put_unaligned just do a single access and rely on the alignment exception handler to fix things up in the rare cases where the cpu can't handle it in hardware. Thus we can get alignment exceptions in the network stack at interrupt level. The alignment exception handler does a __get_user to read the instruction and blows up in might_sleep(). Since a __get_user on a kernel address won't actually ever sleep, this makes the might_sleep conditional on the address being less than PAGE_OFFSET. Signed-off-by: Paul Mackerras commit 6e1976961c9bd9a3dc368139fab1883961efc879 Author: Vitaly Bordug Date: Sat Apr 29 23:06:00 2006 +0400 [PATCH] ppc32 CPM_UART: fixes and improvements A number of small issues are fixed, and added the header file, missed from the original series. With this, driver should be pretty stable as tested among both platform-device-driven and "old way" boards. Also added missing GPL statement , and updated year field on existing ones to reflect code update. Signed-off-by: Vitaly Bordug Signed-off-by: Paul Mackerras commit 61f5657c50341198ff05e375e6f1fc0476556562 Author: Vitaly Bordug Date: Sat Apr 29 22:32:44 2006 +0400 [PATCH] ppc32 CPM_UART: Fixed break send on SCC SCC uart sends a break sequence each time it is stopped with the CPM_CR_STOP_TX command. That means that each time an application closes the serial device, a break is transmitted. To fix this, graceful tx stop is issued for SCC. Signed-off-by: David Jander Signed-off-by: Vitaly Bordug Signed-off-by: Paul Mackerras commit 0ccde0a290b44b8296b82a7683b4c299eb51ba6b Author: Ananth N Mavinakayanahalli Date: Fri Apr 28 17:38:42 2006 +0530 [PATCH] powerpc/kprobes: fix singlestep out-of-line We currently single-step inline if the instruction on which a kprobe is inserted is a trap variant. - variants (such as tdnei, used by BUG()) typically evaluate a condition and cause a trap only if the condition is satisfied. - kprobes uses the unconditional "trap" (0x7fe00008) and single-stepping again on this instruction, resulting in another trap without evaluating the condition is obviously incorrect. Signed-off-by: Ananth N Mavinakayanahalli Signed-off-by: Paul Mackerras commit 054d8ff37710efaebd1998ce94d366df315a354f Author: Linas Vepstas Date: Thu Apr 27 02:31:20 2006 -0700 [PATCH] powerpc/pseries: avoid crash in PCI code if mem system not up The powerpc code is currently performing PCI setup before memory initialization. PCI setup touches PCI config space registers. If the PCI card is bad, this will evoke an error, which currrently can't be handled, as the PCI error recovery code expects kmalloc() to be functional. This patch will cause the system to punt instead of crashing with cpu 0x0: Vector: 300 (Data Access) at [c0000000004434d0] pc: c0000000000c06b4: .kmem_cache_alloc+0x8c/0xf4 lr: c00000000004ad6c: .eeh_send_failure_event+0x48/0xfc This patch will also print name of the offending pci device. Signed-off-by: Linas Vepstas Cc: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Paul Mackerras commit e17df688f7064dae1417ce425dd1e4b71d24d63b Author: Patrick McHardy Date: Tue May 2 23:23:07 2006 +0200 [NETFILTER] SCTP conntrack: fix infinite loop fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to guarantee progress of for_each_sctp_chunk(). (all other uses of for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix should be complete.) Based on patch from Ingo Molnar CVE-2006-1527 Signed-off-by: Patrick McHardy Signed-off-by: Linus Torvalds commit b2556da55f78a9dbe92830b1d1c0b612edfea9fd Author: Uwe Zeisberger Date: Tue May 2 20:40:56 2006 +0100 [ARM] 3488/1: make icedcc_putc do the right thing Patch from Uwe Zeisberger a) use coprocessor 14 b) make reading the dcc status volatile Signed-off-by: Uwe Zeisberger Signed-off-by: Russell King commit ebf34c9b6fcd22338ef764b039b3ac55ed0e297b Author: Ayaz Abdulla Date: Tue May 2 15:26:06 2006 -0400 forcedeth: fix multi irq issues This patch fixes the issues with multiple irqs. I am resending based on feedback. I decoupled the dma mask for consistent memory and fixed leak with multiple irq in error path. Thanks to Manfred for catching the spin lock problem. Signed-Off-By: Ayaz Abdulla commit 3e0d167a6b6e5722d7fadfad9b817f668ab41ec1 Author: Craig Brind Date: Thu Apr 27 02:30:46 2006 -0700 [PATCH] via-rhine: zero pad short packets on Rhine I ethernet cards Fixes Rhine I cards disclosing fragments of previously transmitted frames in new transmissions. Before transmission, any socket buffer (skb) shorter than the ethernet minimum length of 60 bytes was zero-padded. On Rhine I cards the data can later be copied into an aligned transmission buffer without copying this padding. This resulted in the transmission of the frame with the extra bytes beyond the provided content leaking the previous contents of this buffer on to the network. Now zero-padding is repeated in the local aligned buffer if one is used. Following a suggestion from the via-rhine maintainer, no attempt is made here to avoid the duplicated effort of padding the skb if it is known that an aligned buffer will definitely be used. This is to make the change "obviously correct" and allow it to be applied to a stable kernel if necessary. There is no change to the flow of control and the changes are only to the Rhine I code path. The patch has run on an in-service Rhine-I host without incident. Frames shorter than 60 bytes are now correctly zero-padded when captured on a separate host. I see no unusual stats reported by ifconfig, and no unusual log messages. Signed-off-by: Craig Brind Signed-off-by: Roger Luethi Cc: Jeff Garzik Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit b0b8dab288590ede2377a671db0a31380f454541 Author: Olaf Hering Date: Thu Apr 27 18:23:49 2006 -0700 [PATCH] mv643xx_eth: provide sysfs class device symlink On Sat, Mar 11, Olaf Hering wrote: > Why is the /sys/class/net/eth0/device symlink not created for the > mv643xx_eth driver? Does this work for other platform device drivers? > Seems to work for the ps2 keyboard at least. The SET_NETDEV_DEV has to be done before a call to register_netdev. With the new patch below, the device symlink for the platform device was created. Unfortunately, after the 4 ls commands, the network connection died. No idea if the box crashed or if something else broke, lost remote access. Provide sysfs 'device' in /class/net/ethN Also, set module owner field, like pcnet32 driver does. Signed-off-by: Olaf Hering Acked-by: Dale Farnsworth Signed-off-by: Andrew Morton Signed-off-by: Jeff Garzik commit d78e9079af7526c4661ff484322094832776ef41 Author: Russell King Date: Tue May 2 20:18:53 2006 +0100 [MMC] PXA: reduce the number of lines PXAMCI debug uses There's no reason for the PXAMCI debug code to print so many lines - it causes the kernel buffer to overflow when trying to debug this driver. Remove some debug messages which are duplicated by core code, and combine other messages, resulting in fewer characters written to the kernel log. Signed-off-by: Russell King commit 58741e8b3603e56c3699550e8bc89cb136329343 Author: Russell King Date: Tue May 2 20:02:39 2006 +0100 [MMC] PXA and i.MX: don't avoid sending stop command on error Always send a stop command at the end of a data transfer. If we avoid sending the stop command, some cards remain in data transfer mode, and refuse to accept further read/write commands. Signed-off-by: Russell King commit 37be4e7809e0581db85387e126ae4da68c3d6286 Author: Russell King Date: Tue May 2 17:24:59 2006 +0100 [MMC] extend data timeout for writes The CSD contains a "read2write factor" which determines the multiplier to be applied to the read timeout to obtain the write timeout. We were ignoring this parameter, resulting in the possibility for writes being timed out too early. Signed-off-by: Russell King commit d8a5a8d7cc32e4474326e0ecc1b959063490efc9 Author: Russell King Date: Tue May 2 16:04:29 2006 +0100 [SERIAL] 8250: add locking to console write function x86 SMP breaks as a result of the previous change, we have no real option other than to add locking to the 8250 console write function. If an oops is in progress, try to acquire the lock. If we fail to do so, continue anyway. Signed-off-by: Russell King commit 330ab71619bacc4d4494227a6cfc9b7f5500403d Author: Jens Axboe Date: Tue May 2 15:29:57 2006 +0200 [PATCH] vmsplice: restrict stealing a little more Apply the same rules as the anon pipe pages, only allow stealing if no one else is using the page. Signed-off-by: Jens Axboe commit a893b99be71f1d669b74f840e3a683dd077d007b Author: Jens Axboe Date: Tue May 2 15:03:27 2006 +0200 [PATCH] splice: fix page LRU accounting Currently we rely on the PIPE_BUF_FLAG_LRU flag being set correctly to know whether we need to fiddle with page LRU state after stealing it, however for some origins we just don't know if the page is on the LRU list or not. So remove PIPE_BUF_FLAG_LRU and do this check/add manually in pipe_to_file() instead. Signed-off-by: Jens Axboe commit 7591489a8fbee83f19bacc75756989a6a4d0389c Author: Jens Axboe Date: Tue May 2 12:57:18 2006 +0200 [PATCH] vmsplice: fix badly placed end paranthesis We need to use the minium of {len, PAGE_SIZE-off}, not {len, PAGE_SIZE}-off. The latter doesn't make any sense, and could cause us to attempt negative length transfers... Signed-off-by: Jens Axboe commit 46c5ea3c9ae7fbc6e52a13c92e59d4fc7f4ca80a Author: Patrick McHardy Date: Tue May 2 05:12:22 2006 +0200 [NETFILTER] x_tables: fix compat related crash on non-x86 When iptables userspace adds an ipt_standard_target, it calculates the size of the entire entry as: sizeof(struct ipt_entry) + XT_ALIGN(sizeof(struct ipt_standard_target)) ipt_standard_target looks like this: struct xt_standard_target { struct xt_entry_target target; int verdict; }; xt_entry_target contains a pointer, so when compiled for 64 bit the structure gets an extra 4 byte of padding at the end. On 32 bit architectures where iptables aligns to 8 byte it will also have 4 byte padding at the end because it is only 36 bytes large. The compat_ipt_standard_fn in the kernel adjusts the offsets by sizeof(struct ipt_standard_target) - sizeof(struct compat_ipt_standard_target), which will always result in 4, even if the structure from userspace was already padded to a multiple of 8. On x86 this works out by accident because userspace only aligns to 4, on all other architectures this is broken and causes incorrect adjustments to the size and following offsets. Thanks to Linus for lots of debugging help and testing. Signed-off-by: Patrick McHardy Signed-off-by: Linus Torvalds commit 6ba815ded3fef03e888a9fc8eae3113938ff5349 Author: Shaohua Li Date: Mon May 1 12:16:19 2006 -0700 [PATCH] timer TSC check suspend notifier change At suspend time, the TSC CPUFREQ_SUSPENDCHANGE notifier change might wrongly enable interrupt. cpufreq driver suspend/resume is in interrupt disabled environment. Signed-off-by: Shaohua Li Cc: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 160bd18e5e545cbb4e5c26f54414485f8ac291ec Author: Mikael Pettersson Date: Mon May 1 12:16:18 2006 -0700 [PATCH] x86_64: make PC Speaker driver work The PC Speaker driver's ->probe() routine doesn't even get called in the 64-bit kernels. The reason for that is that the arch code apparently has to explictly add a "pcspkr" platform device in order for the driver core to call the ->probe() routine. arch/i386/kernel/setup.c unconditionally adds a "pcspkr" device, but the x86_64 kernel has no code at all related to the PC Speaker. The patch below copies the relevant code from i386 to x86_64, which makes the PC Speaker work for me on x86_64. Cc: Dmitry Torokhov Acked-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f3537ea7b9c2f10397a8b68cd006981d7c615431 Author: Atsushi Nemoto Date: Mon May 1 12:16:17 2006 -0700 [PATCH] genrtc: fix read on 64-bit platforms Fix genrtc's read() routine for 64-bit platforms. Current gen_rtc_read() stores 64bit integer and returns 8 even if an user tried to read a 32bit integer. Signed-off-by: Atsushi Nemoto Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 3418ff76119da52f808eb496191d1fd380f53f3d Author: Atsushi Nemoto Date: Mon May 1 12:16:16 2006 -0700 [PATCH] RTC: rtc-dev tweak for 64-bit kernel Make rtc-dev work well on 64-bit platforms with 32-bit userland. On those platforms, users might try to read 32-bit integer value. This patch make rtc-dev's read() work well for both "int" and "long" size. This tweak is came from genrtc driver. Signed-off-by: Atsushi Nemoto Cc: Alessandro Zummo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b44df334a7e909d88cf5c54cc0481b4e2eaeca23 Author: Heiko Carstens Date: Mon May 1 12:16:15 2006 -0700 [PATCH] s390: bug in setup_rt_frame Consider return value of __put_user() when setting up a signal frame instead of ignoring it. Cc: Martin Schwidefsky Signed-off-by: Heiko Carstens Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 022e4fc0fb2e4e179aaba4ee139dcb8fded0cba2 Author: Heiko Carstens Date: Mon May 1 12:16:14 2006 -0700 [PATCH] s390: fix ipd handling As pointed out by Paulo Marques MAX_IPD_TIME is by a factor of ten too small. Since this means that we allow ten times more IPDs in the intended time frame this could result in a cpu check stop of a physical cpu. Cc: Martin Schwidefsky Signed-off-by: Heiko Carstens Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 8261aa600943046a5305564a1cd7432009971799 Author: Jeremy Kerr Date: Mon May 1 12:16:13 2006 -0700 [PATCH] powerpc: cell: Add numa id to struct spu Add an nid member to the spu structure, and store the numa id of the spu there on creation. Signed-off-by: Arnd Bergmann Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 953039c8df7beb2694814e20e2707a77d335a2e3 Author: Jeremy Kerr Date: Mon May 1 12:16:12 2006 -0700 [PATCH] powerpc: Allow devices to register with numa topology Change of_node_to_nid() to traverse the device tree, looking for a numa id. Cell uses this to assign ids to SPUs, which are children of the CPU node. Existing users of of_node_to_nid() are altered to use of_node_to_nid_single(), which doesn't do the traversal. Export an attach_sysdev_to_node() function, allowing system devices (eg. SPUs) to link themselves into the numa topology in sysfs. Signed-off-by: Arnd Bergmann Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bed120c64eb07b6838bb758109811484af8cebba Author: Joel H Schopp Date: Mon May 1 12:16:11 2006 -0700 [PATCH] spufs: fix for CONFIG_NUMA Based on an older patch from Mike Kravetz We need to have a mem_map for high addresses in order to make fops->no_page work on spufs mem and register files. So far, we have used the memory_present() function during early bootup, but that did not work when CONFIG_NUMA was enabled. We now use the __add_pages() function to add the mem_map when loading the spufs module, which is a lot nicer. Signed-off-by: Arnd Bergmann Cc: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 46a66eecdf7bc12562ecb492297447ed0e1ecf59 Author: Mike Kravetz Date: Mon May 1 12:16:09 2006 -0700 [PATCH] sparsemem interaction with memory add bug fixes This patch fixes two bugs with the way sparsemem interacts with memory add. They are: - memory leak if memmap for section already exists - calling alloc_bootmem_node() after boot These bugs were discovered and a first cut at the fixes were provided by Arnd Bergmann and Joel Schopp . Signed-off-by: Mike Kravetz Signed-off-by: Joel Schopp Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2c43630fb0ff3f01c29367248ffa4a851e2c9b34 Author: Pat Gefre Date: Mon May 1 12:16:08 2006 -0700 [PATCH] Altix: correct ioc3 port order Currently loading the ioc3 as a module will cause the ports to be numbered in reverse order. This mod maintains the proper order of cards for port numbering. Signed-off-by: Patrick Gefre Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 4c28f81193b6778f7b49090930d88e6d12bcb928 Author: Christoph Lameter Date: Mon May 1 12:16:08 2006 -0700 [PATCH] page migration: Fix fallback behavior for dirty pages Currently we check PageDirty() in order to make the decision to swap out the page. However, the dirty information may be only be contained in the ptes pointing to the page. We need to first unmap the ptes before checking for PageDirty(). If unmap is successful then the page count of the page will also be decreased so that pageout() works properly. This is a fix necessary for 2.6.17. Without this fix we may migrate dirty pages for filesystems without migration functions. Filesystems may keep pointers to dirty pages. Migration of dirty pages can result in the filesystem keeping pointers to freed pages. Unmapping is currently not be separated out from removing all the references to a page and moving the mapping. Therefore try_to_unmap will be called again in migrate_page() if the writeout is successful. However, it wont do anything since the ptes are already removed. The coming updates to the page migration code will restructure the code so that this is no longer necessary. Signed-off-by: Christoph Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit a4b741e380cb56045ccea36f2dbc10e42af21f24 Author: Jeff Dike Date: Mon May 1 12:16:06 2006 -0700 [PATCH] uml: uml-makefile-nicer uses SYMLINK incorrectly Blaisorblade's uml-makefile-nicer makes a V=0 build say SYMLINK where what's happening is really a LINK. Signed-off-by: Jeff Dike Acked-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cead61a6717a9873426b08d73a34a325e3546f5d Author: Paolo 'Blaisorblade' Giarrusso Date: Mon May 1 12:16:06 2006 -0700 [PATCH] uml: export symbols added by GCC hardened GCC hardened introduces additional symbol refererences (for the canary and friends), also in modules - add weak export_symbols for them. We already tested that the weak declaration creates no problem on both GCC's providing the function definition and on GCC's which don't provide it. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 7b12b9137930eb821b68e1bfa11e9de692208620 Author: Paolo 'Blaisorblade' Giarrusso Date: Mon May 1 12:16:05 2006 -0700 [PATCH] uml: cleanup unprofile expression and build infrastructure *) Rather than duplicate in various buggy ways the application of CFLAGS_NO_HARDENING and UNPROFILE (which apply to the same files), centralize it in Makefile.rules. UNPROFILE_OBJS mustn't be listed in USER_OBJS but are compiled as such. I've also verified that unprofile didn't work in the current form, because we set _c_flags directly (using CFLAGS and not USER_CFLAGS, which is wrong), which is normally used by c_flags, but we also override c_flags for all USER_OBJS, and there we don't call unprofile. Instead it only worked for unmap.o, the only one which wasn't a USER_OBJ. We need to set c_flags (which is not a public Kbuild API) to clear a lot of compilation flags like -nostdinc which Kbuild forces on everything. *) Rather than $(CFLAGS_$(notdir $@)), which expands to CFLAGS_anObj.s when building "anObj.s", use $(CFLAGS_$(*F).o) which always accesses CFLAGS_anObj.o, like done by Kbuild. *) Make c_flags apply to all targets having the same basename, rather than listing .s, .i, .lst and .o, with the use (which I tested) of $(USER_OBJS:.o=.%): c_flags = ... and of - $(obj)/unmap.c: _c_flags = ... + $(obj)/unmap.%: _c_flags = ... Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 275e6e1ee2bafde77e9390b27e876fa83f24cb60 Author: Paolo 'Blaisorblade' Giarrusso Date: Mon May 1 12:16:04 2006 -0700 [PATCH] uml: fix compilation and execution with hardened GCC To make some half-assembly stubs compile, disable various "hardened" GCC features: *) we can't make it build PIC code as we need %ebx to do syscalls and GCC wants it free for PIC *) we can't leave stack protection as the stub is moved (not relocated!) in memory so the RIP-relative access to the canary tries reading from an unmapped address and causes a segfault, since we move the stub of various megabytes (the exact amount will be decided at runtime) away from the link-time address. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb8aa3d29b562e4c16fdfa4ecc8170ddc55397f4 Author: Paolo 'Blaisorblade' Giarrusso Date: Mon May 1 12:16:03 2006 -0700 [PATCH] uml: use Kbuild tracking for all files and fix compilation output Move the build of user-offsets to arch/um/sys-$(SUBARCH), where it's located. So we can also build it via Kbuild with its dependency tracking rather than by hand. While hacking here, fix also a lot of little cosmetic things. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit cb98cdcd0dd892dcaec7dabd57c3b00890006b61 Author: Mattia Dongili Date: Mon May 1 12:16:01 2006 -0700 [PATCH] uml: search from uml_net in a more reasonable PATH Append /usr/lib/uml to the existing PATH environment variable to let execvp() search uml_net in FHS compliant locations. Signed-off-by: Mattia Dongili Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit b15fb6b157b83ce983e42130ab7d1a866020d8f5 Author: Paolo 'Blaisorblade' Giarrusso Date: Mon May 1 12:16:01 2006 -0700 [PATCH] uml: fix patch mismerge I sent a patch, it was applied as cda402b283c34a24b091f78eee116963e9494762, then it was applied again as 181ae4005d0a4010802be534d929b38c42b9ac06 by mistake. But while the 1st time it modified (correctly) cow_header_v3, the 2nd it modified cow_header_v3_broken. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Acked-by: Jeff Dike Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 2ace87b9502d922397cabaf07d73e0b60c480ecf Author: Jeff Dike Date: Mon May 1 12:16:00 2006 -0700 [PATCH] uml: error handling fixes Blairsorblade noticed some confusion between our use of a system call's return value and errno. This patch fixes a number of related bugs - using errno instead of a return value using a return value instead of errno forgetting to negate a error return to get a positive error code Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 347b3dc2faf34d63a96b41e3244b743cc72a2aa0 Author: Jeff Dike Date: Mon May 1 12:15:59 2006 -0700 [PATCH] uml: update defconfig Bring defconfig up to date. Also disable CONFIG_BLK_DEV_UBD_SYNC by default. By performing synchronous I/O to the host, it slows things down, only protects against host crashes, and can make a UML appear to hang while it waits for the host's disk. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e3104f50d89b1fffe1fd973e32248a5c7f1bb41e Author: Jeff Dike Date: Mon May 1 12:15:58 2006 -0700 [PATCH] uml: clean up after MADVISE_REMOVE The MADVISE_REMOVE-checking code didn't clean up after itself. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 191ef966ac164a1ce3e06290ca52296744a4aee2 Author: Jesper Juhl Date: Mon May 1 12:15:57 2006 -0700 [PATCH] uml: remove NULL checks and add some CodingStyle Remove redundant NULL checks before [kv]free + small CodingStyle cleanup for arch/ Signed-off-by: Jesper Juhl Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 893bb96a29bee4a5cf2486720ac79412aaee5066 Author: Joris van Rantwijk Date: Mon May 1 12:15:56 2006 -0700 [PATCH] uml: skas0 support for 2G/2G hosts A quick hack to allow skas0 mode to run on 2G/2G hosts. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit c39e50b4bada27102306d7fa68ea35dc4e61bd68 Author: Victor V. Vengerov Date: Mon May 1 12:15:53 2006 -0700 [PATCH] uml: fix iomem list traversal We need to walk the region list properly. Signed-off-by: Jeff Dike Cc: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f3a19cb45f4730c4ce09ca9bccf197efd010dc3b Author: Andrew Morton Date: Mon May 1 12:15:52 2006 -0700 [PATCH] silence initcall warnings Suppress the initcall-return-value warnings unless initcall_debug was specified. They do find bugs, but they're extremely small ones and as Andi points out, people get distressed. Cc: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 42e4c8585f8cbbfac3b70aa2d0a4f869509a0354 Author: Andi Kleen Date: Mon May 1 12:15:51 2006 -0700 [PATCH] i386: Remove apic= warning The apic= option can be used to set the APIC driver too. When that is done this code would always produce bogus warnings. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5871aa6d5a98f315016d1deee07425c269c37f29 Author: Andi Kleen Date: Mon May 1 12:15:50 2006 -0700 [PATCH] i386: Fix overflow in e820_all_mapped The 32bit version of e820_all_mapped() needs to use u64 to avoid overflows on PAE systems. Pointed out by Jan Beulich Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 32828546b32a96d550b85eab25609bc4ba3942ab Author: Andi Kleen Date: Mon May 1 12:15:49 2006 -0700 [PATCH] i386/x86-64: Fix ACPI disabled LAPIC handling mismerge The patch I submitted earlier to fix disabled LAPIC handling in ACPI was mismerged for some reason I still don't quite understand. Parts of it was applied to the wrong function. This patch fixes it up. Cc: Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit d2610202290b4924b71747314a0f88f28807702e Author: Andi Kleen Date: Mon May 1 12:15:48 2006 -0700 [PATCH] x86_64: Add compat_sys_vmsplice and use it in x86-64 Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 5e7dd2ab6b9bdfa60e19b8739e6b2a204fd4f477 Author: NeilBrown Date: Mon May 1 12:15:47 2006 -0700 [PATCH] md: Fix 'rdev->nr_pending' count when retrying barrier requests When retrying a failed BIO_RW_BARRIER request, we need to keep the reference in ->nr_pending over the whole retry. Currently, we only hold the reference if the failed request is the *last* one to finish - which is silly, because it would normally be the first to finish. So move the rdev_dec_pending call up into the didn't-fail branch. As the rdev isn't used in the later code, calling rdev_dec_pending earlier doesn't hurt. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 62de608da0b0ab17d81a233b50d1e952b9816f69 Author: NeilBrown Date: Mon May 1 12:15:47 2006 -0700 [PATCH] md: Improve detection of lack of barrier support in raid1 Move the test for 'do barrier work' down a bit so that if the first write to a raid1 is a BIO_RW_BARRIER write, the checking done by superblock writes will cause the right thing to happen. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit bea2771871ed1084c9a85ed0c86340f188505702 Author: NeilBrown Date: Mon May 1 12:15:46 2006 -0700 [PATCH] md: Change ENOTSUPP to EOPNOTSUPP Because that is what you get if a BIO_RW_BARRIER isn't supported! Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit e0a33270ed0e8e00cbb882a33d21e1f92aac0ceb Author: NeilBrown Date: Mon May 1 12:15:45 2006 -0700 [PATCH] md: Fixed refcounting/locking when attempting read error correction in raid10 We need to hold a reference to rdevs while reading and writing to attempt to correct read errors. This reference must be taken under an rcu lock. Signed-off-by: Neil Brown Cc: "Paul E. McKenney" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit df30d0f4ca3c41b60068232d6de9d58be88436f0 Author: NeilBrown Date: Mon May 1 12:15:44 2006 -0700 [PATCH] md: Avoid oops when attempting to fix read errors on raid10 We should add to the counter for the rdev *after* checking if the rdev is NULL!!! Signed-off-by: Neil Brown Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit 235acec78e87a60ace01d1ecb4b87ad1d689715a Author: Bastian Blank Date: Mon May 1 12:15:42 2006 -0700 [PATCH] s390: make qeth buildable Signed-off-by: Bastian Blank Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: "David S. Miller" Acked-by: Jeff Garzik Acked-by: Frank Pavlic Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds commit f6f0413e10b76440fb82efebc63120f3b6d42adb Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:09 2006 -0700 IB/ipath: tidy up white space in a few files Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit d562a5ae69bd5643d777788117d02acb22fab347 Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:08 2006 -0700 IB/ipath: fix label name in interrupt handler Names that are the opposite of their intended meanings are not so helpful. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit ae15f540cc52acbcbfdf4b902d214a5db5c835d2 Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:07 2006 -0700 IB/ipath: improve sparse annotation Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 9b2017f1e1c95625b2ca2a1ec5317097117d7078 Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:06 2006 -0700 IB/ipath: simplify IB timer usage Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 76f0dd141b477094b026206c0d8c21beac6069f5 Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:05 2006 -0700 IB/ipath: simplify RC send posting Remove some unnecessarily complicated tests. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit c71c30dcba142f16bc5f651812b1bc0b9f70f02d Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:03 2006 -0700 IB/ipath: prevent hardware from being accessed during reset The reset code now turns off the PRESENT flag during a reset, so that other code won't attempt to access a device that's in mid-reset. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit fccea663643cedfa310c5254da30e1e35e09199b Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:02 2006 -0700 IB/ipath: fix verbs registration Remember when the verbs layer unregisters from the lower-level code. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 52e7fad825c47fb86801f23b9f793da1d2774f18 Author: Bryan O'Sullivan Date: Mon Apr 24 14:23:00 2006 -0700 IB/ipath: change handling of PIO buffers Different ipath hardware types have different numbers of buffers available, so we decide on the counts ourselves unless we are specifically overridden with a module parameter. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 23e86a4584606a08393e0ad3a5ca27b19a3de374 Author: Bryan O'Sullivan Date: Mon Apr 24 14:22:59 2006 -0700 IB/ipath: iterate over correct number of ports during reset Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 68dd43a162b43218d2e5ac1d139c1d53da965f54 Author: Bryan O'Sullivan Date: Mon Apr 24 14:22:58 2006 -0700 IB/ipath: set up 32-bit DMA mask if 64-bit setup fails Some systems do not set up 64-bit maps on systems with 2GB or less of memory installed, so we have to fall back to trying a 32-bit setup. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 755e4ca4a9885b79a14169ab5b615920eb38a32a Author: Bryan O'Sullivan Date: Mon Apr 24 14:22:57 2006 -0700 IB/ipath: fix race with exposing reset file We were accidentally exposing the "reset" sysfs file more than once per device. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier commit 7afa6fd037e51e95d322990cb127bb2b1217251a Author: Jens Axboe Date: Mon May 1 20:02:33 2006 +0200 [PATCH] vmsplice: allow user to pass in gift pages If SPLICE_F_GIFT is set, the user is basically giving this pages away to the kernel. That means we can steal them for eg page cache uses instead of copying it. The data must be properly page aligned and also a multiple of the page size in length. Signed-off-by: Jens Axboe commit f6762b7ad8edd6abc802542ce845d3bc8adcb92f Author: Jens Axboe Date: Mon May 1 20:02:05 2006 +0200 [PATCH] pipe: enable atomic copying of pipe data to/from user space The pipe ->map() method uses kmap() to virtually map the pages, which is both slow and has known scalability issues on SMP. This patch enables atomic copying of pipe pages, by pre-faulting data and using kmap_atomic() instead. lmbench bw_pipe and lat_pipe measurements agree this is a Good Thing. Here are results from that on a UP machine with highmem (1.5GiB of RAM), running first a UP kernel, SMP kernel, and SMP kernel patched. Vanilla-UP: Pipe bandwidth: 1622.28 MB/sec Pipe bandwidth: 1610.59 MB/sec Pipe bandwidth: 1608.30 MB/sec Pipe latency: 7.3275 microseconds Pipe latency: 7.2995 microseconds Pipe latency: 7.3097 microseconds Vanilla-SMP: Pipe bandwidth: 1382.19 MB/sec Pipe bandwidth: 1317.27 MB/sec Pipe bandwidth: 1355.61 MB/sec Pipe latency: 9.6402 microseconds Pipe latency: 9.6696 microseconds Pipe latency: 9.6153 microseconds Patched-SMP: Pipe bandwidth: 1578.70 MB/sec Pipe bandwidth: 1579.95 MB/sec Pipe bandwidth: 1578.63 MB/sec Pipe latency: 9.1654 microseconds Pipe latency: 9.2266 microseconds Pipe latency: 9.1527 microseconds Signed-off-by: Jens Axboe commit e27dedd84c119e2f7af54fcde3293be5ad812103 Author: Jens Axboe Date: Mon May 1 19:59:54 2006 +0200 [PATCH] splice: call handle_ra_miss() on failure to lookup page Notify the readahead logic of the missing page. Suggested by Oleg Nesterov. Signed-off-by: Jens Axboe commit 7f9c51f0d9783c78db5c2aa16806d0c256ac667f Author: Jens Axboe Date: Mon May 1 19:59:32 2006 +0200 [PATCH] Add ->splice_read/splice_write to def_blk_fops It can use the generic handlers. Signed-off-by: Jens Axboe commit f84d751994441292593523c7069ed147176f6cab Author: Jens Axboe Date: Mon May 1 19:59:03 2006 +0200 [PATCH] pipe: introduce ->pin() buffer operation The ->map() function is really expensive on highmem machines right now, since it has to use the slower kmap() instead of kmap_atomic(). Splice rarely needs to access the virtual address of a page, so it's a waste of time doing it. Introduce ->pin() to take over the responsibility of making sure the page data is valid. ->map() is then reduced to just kmap(). That way we can also share a most of the pipe buffer ops between pipe.c and splice.c Signed-off-by: Jens Axboe commit 0568b409c74f7a125d92a09a3f386785700ef688 Author: Jens Axboe Date: Mon May 1 19:50:48 2006 +0200 [PATCH] splice: fix bugs in pipe_to_file() Found by Oleg Nesterov , fixed by me. - Only allow full pages to go to the page cache. - Check page != buf->page instead of using PIPE_BUF_FLAG_STOLEN. - Remember to clear 'stolen' if add_to_page_cache() fails. And as a cleanup on that: - Make the bottom fall-through logic a little less convoluted. Also make the steal path hold an extra reference to the page, so we don't have to differentiate between stolen and non-stolen at the end. Signed-off-by: Jens Axboe commit 254abfd33a214617deb916585b306faee834c97f Author: Roland Dreier Date: Mon May 1 10:40:23 2006 -0700 IB/mthca: Fix offset in query_gid method GuidInfo records have 8 byte GUIDs in them, so an index should be multiplied by 8 to get an offset. mthca_query_gid() was incorrectly multiplying by 16. Noticed by Leonid Keller . Signed-off-by: Roland Dreier commit 2ad312d2093ae506ae0fa184d8d026b559083087 Author: Steve Grubb Date: Tue Apr 11 08:50:56 2006 -0400 [PATCH] Audit Filter Performance While testing the watch performance, I noticed that selinux_task_ctxid() was creeping into the results more than it should. Investigation showed that the function call was being called whether it was needed or not. The below patch fixes this. Signed-off-by: Steve Grubb Signed-off-by: Al Viro commit 073115d6b29c7910feaa08241c6484637f5ca958 Author: Steve Grubb Date: Sun Apr 2 17:07:33 2006 -0400 [PATCH] Rework of IPC auditing 1) The audit_ipc_perms() function has been split into two different functions: - audit_ipc_obj() - audit_ipc_set_perm() There's a key shift here... The audit_ipc_obj() collects the uid, gid, mode, and SElinux context label of the current ipc object. This audit_ipc_obj() hook is now found in several places. Most notably, it is hooked in ipcperms(), which is called in various places around the ipc code permforming a MAC check. Additionally there are several places where *checkid() is used to validate that an operation is being performed on a valid object while not necessarily having a nearby ipcperms() call. In these locations, audit_ipc_obj() is called to ensure that the information is captured by the audit system. The audit_set_new_perm() function is called any time the permissions on the ipc object changes. In this case, the NEW permissions are recorded (and note that an audit_ipc_obj() call exists just a few lines before each instance). 2) Support for an AUDIT_IPC_SET_PERM audit message type. This allows for separate auxiliary audit records for normal operations on an IPC object and permissions changes. Note that the same struct audit_aux_data_ipcctl is used and populated, however there are separate audit_log_format statements based on the type of the message. Finally, the AUDIT_IPC block of code in audit_free_aux() was extended to handle aux messages of this new type. No more mem leaks I hope ;-) Signed-off-by: Al Viro commit ce29b682e228c70cdc91a1b2935c5adb2087bab8 Author: Steve Grubb Date: Sat Apr 1 18:29:34 2006 -0500 [PATCH] More user space subject labels Hi, The patch below builds upon the patch sent earlier and adds subject label to all audit events generated via the netlink interface. It also cleans up a few other minor things. Signed-off-by: Steve Grubb Signed-off-by: Al Viro commit e7c3497013a7e5496ce3d5fd3c73b5cf5af7a56e Author: Steve Grubb Date: Mon Apr 3 09:08:13 2006 -0400 [PATCH] Reworked patch for labels on user space messages The below patch should be applied after the inode and ipc sid patches. This patch is a reworking of Tim's patch that has been updated to match the inode and ipc patches since its similar. [updated: > Stephen Smalley also wanted to change a variable from isec to tsec in the > user sid patch. ] Signed-off-by: Steve Grubb Signed-off-by: Al Viro commit 9c7aa6aa74fa8a5cda36e54cbbe4fffe0214497d Author: Steve Grubb Date: Fri Mar 31 15:22:49 2006 -0500 [PATCH] change lspp ipc auditing Hi, The patch below converts IPC auditing to collect sid's and convert to context string only if it needs to output an audit record. This patch depends on the inode audit change patch already being applied. Signed-off-by: Steve Grubb Signed-off-by: Al Viro commit 1b50eed9cac0e8e5e4d3a522d8aa267f7f8f8acb Author: Steve Grubb Date: Mon Apr 3 14:06:13 2006 -0400 [PATCH] audit inode patch Previously, we were gathering the context instead of the sid. Now in this patch, we gather just the sid and convert to context only if an audit event is being output. This patch brings the performance hit from 146% down to 23% Signed-off-by: Al Viro commit 3dc7e3153eddfcf7ba8b50628775ba516e5f759f Author: Darrel Goeddel Date: Fri Mar 10 18:14:06 2006 -0600 [PATCH] support for context based audit filtering, part 2 This patch provides the ability to filter audit messages based on the elements of the process' SELinux context (user, role, type, mls sensitivity, and mls clearance). It uses the new interfaces from selinux to opaquely store information related to the selinux context and to filter based on that information. It also uses the callback mechanism provided by selinux to refresh the information when a new policy is loaded. Signed-off-by: Al Viro commit 376bd9cb357ec945ac893feaeb63af7370a6e70b Author: Darrel Goeddel Date: Fri Feb 24 15:44:05 2006 -0600 [PATCH] support for context based audit filtering The following patch provides selinux interfaces that will allow the audit system to perform filtering based on the process context (user, role, type, sensitivity, and clearance). These interfaces will allow the selinux module to perform efficient matches based on lower level selinux constructs, rather than relying on context retrievals and string comparisons within the audit module. It also allows for dominance checks on the mls portion of the contexts that are impossible with only string comparisons. Signed-off-by: Darrel Goeddel Signed-off-by: Al Viro commit 97e94c453073a2aba4bb5e0825ddc5e923debf11 Author: Al Viro Date: Wed Mar 29 20:26:24 2006 -0500 [PATCH] no need to wank with task_lock() and pinning task down in audit_syscall_exit() Signed-off-by: Al Viro commit 5411be59db80333039386f3b1ccfe5eb9023a916 Author: Al Viro Date: Wed Mar 29 20:23:36 2006 -0500 [PATCH] drop task argument of audit_syscall_{entry,exit} ... it's always current, and that's a good thing - allows simpler locking. Signed-off-by: Al Viro commit e495149b173d8e133e1f6f2eb86fd97be7e92010 Author: Al Viro Date: Wed Mar 29 20:17:10 2006 -0500 [PATCH] drop gfp_mask in audit_log_exit() now we can do that - all callers are process-synchronous and do not hold any locks. Signed-off-by: Al Viro commit fa84cb935d4ec601528f5e2f0d5d31e7876a5044 Author: Al Viro Date: Wed Mar 29 20:30:19 2006 -0500 [PATCH] move call of audit_free() into do_exit() Signed-off-by: Al Viro commit d6fe3945b42d09a1eca7ad180a1646e585b8594f Author: Steve Grubb Date: Thu Mar 30 12:20:22 2006 -0500 [PATCH] sockaddr patch On Thursday 23 March 2006 09:08, John D. Ramsdell wrote: > I noticed that a socketcall(bind) and socketcall(connect) event contain a > record of type=SOCKADDR, but I cannot see one for a system call event > associated with socketcall(accept). Recording the sockaddr of an accepted > socket is important for cross platform information flow analys Thanks for pointing this out. The following patch should address this. Signed-off-by: Steve Grubb Signed-off-by: Al Viro commit 45d9bb0e37668b7c64d1e49e98fbc4733c23b334 Author: Al Viro Date: Wed Mar 29 20:02:55 2006 -0500 [PATCH] deal with deadlocks in audit_free() Don't assume that audit_log_exit() et.al. are called for the context of current; pass task explictly. Signed-off-by: Al Viro commit c9f2946fbec88d4baa3a6d47eb3a8e6b08b05cd9 Author: David S. Miller Date: Sun Apr 30 22:54:27 2006 -0700 [SPARC64]: Disable preemption during flush_tlb_pending(). A context switch will force a call to flush_tlb_pending() (via switch_to()), so if we test tlb_nr to be non-zero, then sleep, it would become zero and later back at the original context we'll pass zero down into the TLB flushing code which should never see a nr argument of zero. Signed-off-by: David S. Miller commit 1241140f5183db38393556832198a3b109bf9085 Author: David S. Miller Date: Sun Apr 30 21:40:13 2006 -0700 [SPARC64]: Kill __flush_tlb_page() prototype. This function no longer exists. Signed-off-by: David S. Miller commit cc873e1aa1fa916a485294117a9846e668505671 Author: Sam Ravnborg Date: Sun Apr 30 23:59:16 2006 +0200 kbuild: drivers/video/logo/ - fix ident glitch Jan Engelhardt wrote: while compiling 2.6.17-rc2