Michael Buesch [Tue, 25 Mar 2008 17:04:46 +0000 (18:04 +0100)]
b44: Truncate PHY address
Some ROMs on embedded devices store incorrect values for
the PHY address of the ethernet device.
It looks like the number is sign-extended.
Truncate the value by applying the PHY-address mask to it.
The patch was tested on a bcm47xx embedded system (where the bug
triggers) and a bcm4400 PCI card.
Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Jussi Kivilinna [Sun, 23 Mar 2008 10:45:44 +0000 (12:45 +0200)]
rndis_host: fix oops when query for OID_GEN_PHYSICAL_MEDIUM fails
When query for OID_GEN_PHYSICAL_MEDIUM fails, uninitialized pointer
'phym' is being accessed in generic_rndis_bind(), resulting OOPS.
Patch fixes phym to be initialized and setup correctly when
rndis_query() for physical medium fails.
Bug was introduced by following commit:
commit 039ee17d1baabaa21783a0d5ab3e8c6d8c794bdf
Author: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Date: Sun Jan 27 23:34:33 2008 +0200
Reported-by: Dmitri Monakhov <dmonakhov@openvz.org> Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi> Acked-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Jeff Garzik <jeff@garzik.org>
The problem is that reg_lock is used with plain spin_lock() in
drivers/net/cxgb3/sge.c but is used with spin_lock_irqsave() in
drivers/net/cxgb3/cxgb3_offload.c. This is technically a false
positive, since the uses in sge.c are only in the initialization and
cleanup paths and cannot overlap with any use in interrupt context.
The best fix is probably just to use spin_lock_irq() with reg_lock in
sge.c. Even though it's not strictly required for correctness, it
avoids triggering lockdep and the extra overhead of disabling
interrupts is not important at all in the initialization and cleanup
slow paths.
Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Alexandr Smirnov [Tue, 18 Mar 2008 21:37:24 +0000 (00:37 +0300)]
Marvell PHY m88e1111 driver fix
Marvell PHY m88e1111 (not sure about other models, but think they too)
works in two modes: fiber and copper. In Marvell PHY driver (that we
have in current community kernels) code supported only copper mode,
and this is not configurable, bits for copper mode are simply written
in registers during PHY initialization.
This patch adds support for both modes.
Signed-off-by: Alexandr Smirnov <asmirnov@ru.mvista.com> Acked-by: Andy Fleming <afleming@freescale.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Dhananjay Phadke [Tue, 18 Mar 2008 02:59:50 +0000 (19:59 -0700)]
netxen: remove low level tx lock
o eliminate tx lock in netxen adapter struct, instead pound on netdev
tx lock appropriately.
o remove old "concurrent transmit" code that unnecessarily drops and
reacquires tx lock in hard_xmit_frame(), this is already serialized
the netdev xmit lock.
o reduce scope of tx lock in tx cleanup. tx cleanup operates on
different section of the ring than transmitting cpus and is
guarded by producer and consumer indices. This fixes a race
caused by rx softirq preemption on realtime kernels.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Tested-by: Vernon Mauery <mauery@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Dhananjay Phadke [Tue, 18 Mar 2008 02:59:49 +0000 (19:59 -0700)]
netxen: napi and irq cleanup
o separate and simpler irq handler for msi interrupts, avoids few checks
than legacy mode.
o avoid redudant tx_has_work() and rx_has_work() checks in interrupt
and napi, which can uncork irq based on racy (lockless) access to tx
and rx ring indices. If we get interrupt, there's sufficient reason to
schedule napi.
o replenish rx ring more often, remove self-imposed threshold rcv_free
that prevents posting rx desc to card. This improves performance in
low memory.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Tested-by: Vernon Mauery <mauery@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Dhananjay Phadke [Tue, 18 Mar 2008 02:59:48 +0000 (19:59 -0700)]
netxen: improve msi support
Recent netxen firmware has new scheme of generating MSI interrupts, it
raises interrupt and blocks itself, waiting for driver to unmask. This
reduces chance of spurious interrupts.
The driver will be able to deal with older firmware as well.
Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com> Tested-by: Vernon Mauery <mauery@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Bryan Wu [Mon, 17 Mar 2008 21:18:31 +0000 (14:18 -0700)]
smc91x: fix build breakage from the SMC_GET_MAC_ADDR API upgrade
Cc: Jeff Garzik <jeff@garzik.org> Cc: Deepak Saxena <dsaxena@plexity.net> Cc: Nicolas Pitre <nico@cam.org> Cc: Russell King <rmk+kernel@arm.linux.org.uk> Cc: Paul Mundt <lethal@linux-sh.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Libor Pechacek [Sat, 22 Mar 2008 05:29:35 +0000 (22:29 -0700)]
bonding: Fix sysfs attribute handling
For bonding interfaces any attempt to read the sysfs directory contents after
module removal results in an oops. The fix is to release sysfs attributes
for the interfaces upon module unload.
Signed-off-by: Libor Pechacek <lpechacek@suse.cz> Acked-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Jay Vosburgh [Sat, 22 Mar 2008 05:29:34 +0000 (22:29 -0700)]
bonding: fix two compiler warnings
Fix two compiler warnings that are new with recent versions of gcc
(apparently 4.2 and up). One is fixed by refactoring; this change was
supplied by Stephen Hemminger. The other was fixed by labelling the
variable as uninitialized_var() after confirming via inspection that it
cannot actually be used uninitialized.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Stephen Hemminger <shemminger@vyatta.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Jay Vosburgh [Sat, 22 Mar 2008 05:29:33 +0000 (22:29 -0700)]
bonding: Fix locking in 802.3ad mode
The 802.3ad state machine lock can be acquired in both softirq and
not softirq context, but was not held at _bh to prevent a deadlock (which
could occur if a LACPDU arrived and was processed while the lock was
held).
Corrected this, now hold the state machine lock at _bh to prevent
deadlock.
Bug reported by Todd Fleisher <todd@fleish.org>.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Zhang Rui [Thu, 20 Mar 2008 08:40:32 +0000 (16:40 +0800)]
ACPI: fix a regression of ACPI device driver autoloading
commit 3620f2f2f39e7870cf1a4fb2e34063a142f28716 sets the cid of
ACPI video/dock/bay device and leaves the hid empty.
As a result, "modalias" should export the cid for
devices which don't have a hid.
ACPI Video driver is not autoloaded with
commit 3620f2f2f39e7870cf1a4fb2e34063a142f28716 applied.
"cat /sys/.../device:03(acpi video bus)/modalias" shows nothing.
ACPI Video driver is autoloaded after revert that commit.
"cat /sys/.../LNXVIDEO:0x/modalias" shows "acpi:LNXVIDEO:"
ACPI Video driver is autoloaded with commit 3620f2f2f39e7870cf1a4fb2e34063a142f28716 and this patch applied.
"cat /sys/.../device:03(acpi video bus)/modalias"
shows "acpi:LNXVIDEO:"
Signed-off-by: Zhang Rui <rui.zhang@intel.com> Acked-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Len Brown <len.brown@intel.com>
Bjorn Helgaas [Tue, 25 Mar 2008 17:21:11 +0000 (11:21 -0600)]
ACPI: fix Medion _PRT quirk (use "ISA_", not "ISA")
This fixes the builtin RTL8139 NIC on the Medion MD9580-F laptop. The
BIOS reports the interrupt routing incorrectly. I recently added a
quirk to work around this, and this patch fixes a typo in the quirk.
We pad every ACPI pathname component to four characters, so ".ISA." will
never match anything. We need ".ISA_." instead.
Thank you Johann-Nikolaus Andreae <johann-nikolaus.andreae@nacs.de>
for patiently testing this patch.
See http://bugzilla.kernel.org/show_bug.cgi?id=4773
Linus Torvalds [Tue, 25 Mar 2008 16:06:44 +0000 (09:06 -0700)]
Merge branch 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6
* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
i2c: Fix docbook problem
ASoC/TLV320AIC3X: Stop I2C driver ID abuse
i2c-omap: Fix unhandled fault
i2c-bfin-twi: Disable BF54x support for now
Linus Torvalds [Tue, 25 Mar 2008 15:57:47 +0000 (08:57 -0700)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
[PATCH] get stack footprint of pathname resolution back to relative sanity
[PATCH] double iput() on failure exit in hugetlb
[PATCH] double dput() on failure exit in tiny-shmem
[PATCH] fix up new filp allocators
[PATCH] check for null vfsmount in dentry_open()
[PATCH] reiserfs: eliminate private use of struct file in xattr
[PATCH] sanitize hppfs
hppfs pass vfsmount to dentry_open()
[PATCH] restore export of do_kern_mount()
Avi Kivity [Sun, 23 Mar 2008 12:21:08 +0000 (14:21 +0200)]
KVM: MMU: Fix memory leak on guest demand faults
While backporting 72dc67a69690288538142df73a7e3ac66fea68dc, a gfn_to_page()
call was duplicated instead of moved (due to an unrelated patch not being
present in mainline). This caused a page reference leak, resulting in a
fairly massive memory leak.
Fix by removing the extraneous gfn_to_page() call.
Avi Kivity [Sun, 16 Mar 2008 16:48:26 +0000 (18:48 +0200)]
KVM: VMX: Restore tss even on x86_64
The vmx hardware state restore restores the tss selector and base address, but
not its length. Usually, this does not matter since most of the tss contents
is within the default length of 0x67. However, if a process is using ioperm()
to grant itself I/O port permissions, an additional bitmap within the tss,
but outside the default length is consulted. The effect is that the process
will receive a SIGSEGV instead of transparently accessing the port.
Fix by restoring the tss length. Note that i386 had this working already.
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: Fix cut-and-paste error in rtl8150.c
USB: ehci: stop vt6212 bus hogging
USB: sierra: add another device id
USB: sierra: dma fixes
USB: add support for Motorola ROKR Z6 cellphone in mass storage mode
USB: isd200: fix memory leak in isd200_get_inquiry_data
USB: pl2303: another product ID
USB: new quirk flag to avoid Set-Interface
USB: fix gadgetfs class request delegation
PCIE has a mechanism to wait for Non-Posted request to complete. I think
pci_disable_device is a good place to do this.
Signed-off-by: Shaohua Li <shaohua.li@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Due to the regression reported at
http://bugzilla.kernel.org/show_bug.cgi?id=10065
Cc: Shaohua Li <shaohua.li@intel.com> Cc: Soeren Sonnenburg <kernel@nn7.de> Cc: "Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Mark Gross [Tue, 4 Mar 2008 22:59:31 +0000 (14:59 -0800)]
PCI: iova: lockdep false alarm fix
lockdep goes off on the iova copy_reserved_iova() because it and a function
it calls grabs locks in the from, and the to of the copy operation.
The function grab locks of the same lock classes triggering the warning. The
first lock grabbed is for the constant reserved areas that is never accessed
after early boot. Technically you could do without grabbing the locks for the
"from" structure its copying reserved areas from.
But dropping the from locks to me looks wrong, even though it would be ok.
The affected code only runs in early boot as its setting up the DMAR
engines.
This patch gives the reserved_ioval_list locks special lockdep classes.
Signed-off-by: Mark Gross <mgross@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Mapping of physical memory in UIO needs pgprot_noncached() to ensure
that IO memory is not cached. Without pgprot_noncached(), it (accidentally)
works on x86 and arm, but fails on PPC.
Rene Herman [Thu, 20 Mar 2008 07:58:16 +0000 (00:58 -0700)]
USB: ehci: stop vt6212 bus hogging
The VIA VT6212 defaults to only waiting 1us between passes over EHCI's
async ring, which hammers PCI badly ... and by preventing other devices
from accessing the bus, causes problems like drops in IDE throughput,
a problem that's been bugging users of those chips for several years.
A (partial) datasheet for this chip eventually turned up, letting us
see how to make it use a VIA-specific register to switch over to the
the normal 10us value instead, as suggested by the EHCI specification
Solution noted by Lev A. Melnikovsky.
It's not clear whether this register exists on other VIA chips; we
know that it's ineffective on the vt8235. So this patch only applies
to chips that seem to be incarnations of the (discrete) vt6212.
Signed-off-by: Rene Herman <rene.herman@gmail.com> Tested-by: Lev A. Melnikovsky <melnikovsky@mail.ru> Tested-by: Alessandro Suardi <alessandro.suardi@gmail.com> Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Oliver Neukum [Fri, 14 Mar 2008 07:53:24 +0000 (00:53 -0700)]
USB: sierra: dma fixes
while I was adding autosuspend to that driver I noticed a few issues.
You were having DMAed buffers as a part of a structure.
This will fail on platforms that are not DMA-coherent (arm, sparc, ppc, ...)
Please test this patch to fix it.
Signed-off-by: Kevin Lloyd <klloyd@sierrawireless.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
USB: add support for Motorola ROKR Z6 cellphone in mass storage mode
Motorola ROKR Z6 cellphone has bugs in its USB, so it is impossible to use
it as mass storage. Patch describes new "unusual" USB device for it with
FIX_INQUIRY and FIX_CAPACITY flags and new BULK_IGNORE_TAG flag.
Last flag relaxes check for equality of bcs->Tag and us->tag in
usb_stor_Bulk_transport routine.
Signed-off-by: Constantin Baranov <const@tltsu.ru> Signed-off-by: Matthew Dharm <mdharm-usb@one-eyed-alien.net> Signed-off-by: Daniel Drake <dsd@gentoo.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Max Arnold [Thu, 20 Mar 2008 09:43:56 +0000 (16:43 +0700)]
USB: pl2303: another product ID
Device like this http://aldiga.com/english/A-100-USB-EDGE10.htm
contains Prolific 2303 chip.
Actually their site a bit outdated - I have AlDiga AL-11U
GSM/GPRS/EDGE modem and it works with pl2303 module after adding
corresponding product ID.
By default modem uses baud rate 460800. GSM chipset - SIMCom SIM600,
quad band 850/900/1800/1900 MHz
Alan Stern [Tue, 11 Mar 2008 14:20:12 +0000 (10:20 -0400)]
USB: new quirk flag to avoid Set-Interface
This patch (as1057) fixes a problem with the X-Rite/Gretag-Macbeth
Eye-One Pro display colorimeter; the device crashes when it receives a
Set-Interface request. A new quirk (USB_QUIRK_NO_SET_INTF) is
introduced and a quirks entry is created for this device.
Roy Hashimoto [Wed, 12 Mar 2008 21:55:31 +0000 (13:55 -0800)]
USB: fix gadgetfs class request delegation
gadgetfs (drivers/usb/gadget/inode.c) was not delegating all
non-device requests to userspace. This patch makes the handling of
all request cases consistent.
Signed-off-by: Roy Hashimoto <hashimot@alumni.caltech.edu> Acked-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Linus Torvalds [Tue, 25 Mar 2008 03:35:48 +0000 (20:35 -0700)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] mpc5200: Fix incorrect compatible string for the mdio node
[POWERPC] Update some defconfigs
David S. Miller [Tue, 25 Mar 2008 03:06:24 +0000 (20:06 -0700)]
[SPARC64]: Make save_stack_trace() more efficient.
Doing a 'flushw' every stack trace capture creates so much overhead
that it makes lockdep next to unusable.
We only care about the frame pointer chain and the function caller
program counters, so flush those by hand to the stack frame.
This is significantly more efficient than a 'flushw' because:
1) We only save 16 bytes per active register window to the stack.
2) This doesn't push the entire register window context of the current
call chain out of the cpu, forcing register window fill traps as we
return back down.
Note that we can't use 'restore' and 'save' instructions to move
around the register windows because that wouldn't work on Niagara
processors. They optimize 'save' into a new register window by
simply clearing out the registers instead of pulling them in from
the on-chip register window backing store.
Based upon a report by Tom Callaway.
Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Tue, 25 Mar 2008 03:02:32 +0000 (20:02 -0700)]
Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
[libata] ahci: SB600 workaround is suspect... play it safe for now
sata_promise: fix hardreset hotplug events, take 2
libata: improve HPA error handling
libata: assume no device is attached if both IDENTIFYs are aborted
pata_it821x: use raw nbytes in check_atapi_dma
libata: implement ata_qc_raw_nbytes()
sata_promise: fix hardreset hotplug events, take 2
A Promise SATA controller will signal hotplug events when a hard
reset (COMRESET) is done on a port. These events aren't masked by
the driver, and the unexpected interrupts will cause a sequence
of failed reset attempts util libata's EH finally gives up.
This has not been a common problem so far, but the pending libata
hardreset-by-default changes makes it a critical issue.
The solution is to disable hotplug events before a reset, and to
reenable them afterwards. (Promise's driver does this too.)
This patch adds SATA-specific versions of ->freeze() and ->thaw()
that also disable and enable hotplug events. PATA ports continue
to use the old versions of ->freeze() and ->thaw().
Accesses to the hotplug register must be serialised via host->lock.
We rely on ap->lock == &ap->host->lock and that libata takes this
lock before ->freeze() and ->thaw(). Document this requirement.
The interrupt handler is adjusted so its hotplug register accesses
are inside the region protected by host->lock.
Tested on various chips (SATA300TX4, SATA300TX2plus, SATAII150TX4,
FastTrack TX4000) with various combinations of SATA and PATA disks,
with and without the pending hardreset-by-default changes.
Signed-off-by: Mikael Pettersson <mikpe@it.uu.se> Acked-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Linus Torvalds [Tue, 25 Mar 2008 02:25:08 +0000 (19:25 -0700)]
Make printk() console semaphore accesses sensible
The printk() logic on when/how to get the console semaphore was
unreadable, this splits the code up into a few helper functions and
makes it easier to follow what is going on.
Pavel Emelyanov [Mon, 24 Mar 2008 19:29:52 +0000 (12:29 -0700)]
bsd_acct: plain current->real_parent access is not always safe
This is minor, but dereferencing even current real_parent is not safe on debug
kernels, since the memory, this points to, can be unmapped - RCU protection is
required.
Besides, the tgid field is deprecated and is to be replaced with task_tgid_xxx
call (the 2nd patch), so RCU will be required anyway.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Cc: Oleg Nesterov <oleg@tv-sign.ru> Cc: "Paul E. McKenney" <paulmck@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Author: Rik van Riel <riel@redhat.com>
Date: Thu Feb 7 00:14:08 2008 -0800
kswapd should only wait on IO if there is IO
The current kswapd (and try_to_free_pages) code has an oddity where the
code will wait on IO, even if there is no IO in flight. This problem is
notable especially when the system scans through many unfreeable pages,
causing unnecessary stalls in the VM.
Additionally, tasks without __GFP_FS or __GFP_IO in the direct reclaim path
will sleep if a significant number of pages are encountered that should be
written out. This gives kswapd a chance to write out those pages, while
the direct reclaim task sleeps.
Signed-off-by: Rik van Riel <riel@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Because of large latencies and interactivity problems reported by Carlos,
here: http://lkml.org/lkml/2008/3/22/211
Cc: Rik van Riel <riel@redhat.com> Cc: "Carlos R. Mafra" <crmafra2@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Brownell [Mon, 24 Mar 2008 19:29:51 +0000 (12:29 -0700)]
hw_random doc updates
Update documentation for the hw_random support to be current:
- Documentation/hw_random.txt has been updated to reflect the
current code: it's a framework now, a "core" with a small
sysfs interface, that hardware-specific drivers plug in to.
Text specific to Intel hardware is now at the end.
- Kconfig now references the Documentation/hw_random.txt file
and better explains what this really does.
Both chunks of documentation now higlight the fact that the kernel entropy
pool is maintained by "rngd", and this driver has nothing directly to do with
that important task.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ahmed S. Darwish [Mon, 24 Mar 2008 19:29:49 +0000 (12:29 -0700)]
smackfs: remove redundant lock, fix open(,O_RDWR)
Older smackfs was parsing MAC rules by characters, thus a need of locking
write sessions on open() was needed. This lock is no longer useful now since
each rule is handled by a single write() call.
This is also a bugfix since seq_open() was not called if an open() O_RDWR flag
was given, leading to a seq_read() without an initialized seq_file, thus an
Oops.
Signed-off-by: Ahmed S. Darwish <darwish.07@gmail.com> Reported-by: Jonathan Corbet <corbet@lwn.net> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Yinghai Lu [Mon, 24 Mar 2008 19:29:45 +0000 (12:29 -0700)]
mm: fix boundary checking in free_bootmem_core
With numa enabled, some callers could have a range of memory on one node
but try to free that on other node. This can cause some pages to be
freed wrongly.
For example: when we try to allocate 128g boot ram early for
gart/swiotlb, and free that range later so gart/swiotlb can get some
range afterwards.
With this patch, we don't need to care which node holds the range, just
loop to call free_bootmem_node for all online nodes.
This patch makes free_bootmem_core() more robust by trimming the sidx
and eidx according the ram range that the node has.
And make the free_bootmem_core handle this out of range case. We could
use bdata_list to make sure the range can be freed for sure. So next
time, we don't need to loop online nodes and could use free_bootmem
directly.
Ingo van Lil [Mon, 24 Mar 2008 19:29:44 +0000 (12:29 -0700)]
mtd: memory corruption in block2mtd.c
The block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack
pointer when handling an invalid argument line (e.g.
block2mtd=/dev/loop0,xxx).
The kfree was added some time ago when "name" was dynamically allocated.
Signed-off-by: Ingo van Lil <inguin@gmx.de> Acked-by: Joern Engel <joern@lazybastard.org> Cc: David Woodhouse <dwmw2@infradead.org> Cc: <stable@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Tejun Heo [Sun, 23 Mar 2008 12:05:15 +0000 (21:05 +0900)]
libata: improve HPA error handling
There's no point in retrying and eventually failing device detection
when the device rejects READ_NATIVE_MAX[_EXT]. Disable HPA unlocking
if READ_NATIVE_MAX[_EXT] is rejected as done when SET_MAX[_EXT] is
rejected.
This allows some old drives to work even if they aren't blacklisted.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Sun, 23 Mar 2008 06:16:53 +0000 (15:16 +0900)]
libata: assume no device is attached if both IDENTIFYs are aborted
This is to fix bugzilla #10254. QSI cdrom attached to pata_sis as
secondary master appears as phantom device for the slave.
Interestingly, instead of not setting DRQ after IDENTIFY which
triggers NODEV_HINT, it aborts both IDENTIFY and IDENTIFY PACKET which
makes EH retry.
Modify EH such that it assumes no device is attached if both flavors
of IDENTIFY are aborted by the device. There really isn't much point
in retrying when the device actively aborts the commands.
While at it, convert NODEV detection message to ata_dev_printk() to
help debugging obscure detection problems.
This problem was reported by Jan Bücken.
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Jan Bücken <jb.faq@gmx.de> Acked-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Michael Buesch [Sat, 22 Mar 2008 21:04:45 +0000 (22:04 +0100)]
b43: Fix DMA mapping leakage
This fixes a DMA mapping leakage in the case where we reject a DMA
buffer because of its address.
Signed-off-by: Michael Buesch <mb@bu3sch.de> Cc: Christian Casteyde <casteyde.christian@free.fr> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reinette Chatre [Fri, 21 Mar 2008 20:53:41 +0000 (13:53 -0700)]
iwlwifi: fix __devexit_p points to __devexit functions
The iwlxxxx_pci_remove functions are not needed when drivers are not
compiled as modules - they can thus be discarded at kernel link time.
This is already captured by having them as __devexit_p in the pci_driver
struct - these are supposed to be pointers to __devexit functions, but was not.
This is now fixed.
This problem was reported by Toralf Forster when testing the compilation of
2.6.25-rc6.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> CC: Toralf Forster <toralf.foerster@gmx.de> Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Rick Farrington [Tue, 18 Mar 2008 21:57:49 +0000 (14:57 -0700)]
iwlwifi: mac start synchronization issue
This patch fixes a synchronization problem on the 4965 and 3945 with the
mac start callback routine. The problem is that this function exits BEFORE the
'xxx_alive_start' has completed. This can lead to a problem if a
subsequent MAC callback attempts to issue a firmware command.
Signed-off-by: Rick Farrington <rickdic@hotmail.com> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Masakazu Mokuno [Sat, 15 Mar 2008 20:38:29 +0000 (21:38 +0100)]
rt2x00: Add id for Corega CG-WLUSB2GPX
This adds the id for Corega CG-WLUSB2GPX.
Signed-off-by: Masakazu Mokuno <mokuno@sm.sony.co.jp> Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Pavel Emelyanov [Mon, 24 Mar 2008 21:48:59 +0000 (14:48 -0700)]
[NEIGH]: Fix race between pneigh deletion and ipv6's ndisc_recv_ns (v3).
Proxy neighbors do not have any reference counting, so any caller
of pneigh_lookup (unless it's a netlink triggered add/del routine)
should _not_ perform any actions on the found proxy entry.
There's one exception from this rule - the ipv6's ndisc_recv_ns()
uses found entry to check the flags for NTF_ROUTER.
This creates a race between the ndisc and pneigh_delete - after
the pneigh is returned to the caller, the nd_tbl.lock is dropped
and the deleting procedure may proceed.
One of the fixes would be to add a reference counting, but this
problem exists for ndisc only. Besides such a patch would be too
big for -rc4.
So I propose to introduce a __pneigh_lookup() which is supposed
to be called with the lock held and use it in ndisc code to check
the flags on alive pneigh entry.
Changes from v2:
As David noticed, Exported the __pneigh_lookup() to ipv6 module.
The checkpatch generates a warning on it, since the EXPORT_SYMBOL
does not follow the symbol itself, but in this file all the
exports come at the end, so I decided no to break this harmony.
Changes from v1:
Fixed comments from YOSHIFUJI - indentation of prototype in header
and the pndisc_check_router() name - and a compilation fix, pointed
by Daniel - the is_routed was (falsely) considered as uninitialized
by gcc.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Linus Torvalds [Mon, 24 Mar 2008 20:09:34 +0000 (13:09 -0700)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] Fix Oops with TQM5200 on TQM5200
[POWERPC] mpc5200: Fix null dereference if bestcomm fails to initialize
[POWERPC] mpc5200-fec: Fix possible NULL dereference in mdio driver
[POWERPC] Fix crash in init_ipic_sysfs on efika
[POWERPC] Don't use 64k pages for ioremap on pSeries
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
[SPARC64]: exec PT_DTRACE
[SPARC64]: Use shorter list_splice_init() for brevity.
[SPARC64]: Remove most limitations to kernel image size.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
sch_htb: fix "too many events" situation
connector: convert to single-threaded workqueue
[ATM]: When proc_create() fails, do some error handling work and return -ENOMEM.
[SUNGEM]: Fix NAPI assertion failure.
BNX2X: prevent ethtool from setting port type
[9P] net/9p/trans_fd.c: remove unused variable
[IPV6] net/ipv6/ndisc.c: remove unused variable
[IPV4] fib_trie: fix warning from rcu_assign_poinger
[TCP]: Let skbs grow over a page on fast peers
[DLCI]: Fix tiny race between module unload and sock_ioctl.
[SCTP]: Fix build warnings with IPV6 disabled.
[IPV4]: Fix null dereference in ip_defrag
Roland Dreier [Mon, 24 Mar 2008 16:03:03 +0000 (12:03 -0400)]
SVCRDMA: Use only 1 RDMA read scatter entry for iWARP adapters
The iWARP protocol limits RDMA read requests to a single scatter
entry. NFS/RDMA has code in rdma_read_max_sge() that is supposed to
limit the sge_count for RDMA read requests to 1, but the code to do
that is inside an #ifdef RDMA_TRANSPORT_IWARP block. In the mainline
kernel at least, RDMA_TRANSPORT_IWARP is an enum and not a
preprocessor #define, so the #ifdef'ed code is never compiled.
In my test of a kernel build with -j8 on an NFS/RDMA mount, this
problem eventually leads to trouble starting with:
The trivial fix is to delete the #ifdef guard. The check seems to be
a remnant of when the NFS/RDMA code was not merged and needed to
compile against multiple kernel versions, although I don't think it
ever worked as intended. In any case now that the code is upstream
there's no need to test whether the RDMA_TRANSPORT_IWARP constant is
defined or not.
Without this patch, my kernel build on an NFS/RDMA mount using NetEffect
adapters quickly and 100% reproducibly failed with an error like:
ld: final link failed: Software caused connection abort
With the patch applied I was able to complete a kernel build on the
same setup.
(Tom Tucker says this is "actually an _ancient_ remnant when it had to
compile against iWARP vs. non-iWARP enabled OFA trees.")
Signed-off-by: Roland Dreier <rolandd@cisco.com> Acked-by: Tom Tucker <tom@opengridcomputing.com> Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 24 Mar 2008 18:22:39 +0000 (11:22 -0700)]
x86-32: Pass the full resource data to ioremap()
It appears that 64-bit PCI resources cannot possibly ever have worked on
x86-32 even when the RESOURCES_64BIT config option was set, because any
driver that tried to [pci_]ioremap() the resource would have been unable
to do so because the high 32 bits would have been silently dropped on
the floor by the ioremap() routines that only used "unsigned long".
Change them to use "resource_size_t" instead, which properly encodes the
whole 64-bit resource data if RESOURCES_64BIT is enabled.
Acked-by: H. Peter Anvin <hpa@kernel.org> Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
so while registering the driver, the driver's probe function won't be
called, because the device tree node doesn't have a device_type
property. Thus the driver's bcom_engine structure won't be allocated.
Referencing this structure later causes observed Oops.
Checking bcom_eng pointer for NULL before referencing data pointed
by it prevents oopsing, but fec driver still doesn't work (because
of the lost bestcomm match and resulted task allocation failure).
Actually the compatible property exists and should match and so
the fec driver should work.
This removes .type = "dma-controller" from the bestcomm driver's
mpc52xx_bcom_of_match table to solve the problem.
Signed-off-by: Anatolij Gustschin <agust@denx.de> Acked-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Paul Mackerras <paulus@samba.org>
Grant Likely [Sat, 22 Mar 2008 03:20:29 +0000 (14:20 +1100)]
[POWERPC] mpc5200-fec: Fix possible NULL dereference in mdio driver
If the reg property is missing from the phy node (unlikely, but possible),
then the kernel will oops with a NULL pointer dereference. This fixes
it by checking the pointer first.
Signed-off-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Paul Mackerras <paulus@samba.org>
Olaf Hering [Mon, 17 Mar 2008 19:53:05 +0000 (06:53 +1100)]
[POWERPC] Fix crash in init_ipic_sysfs on efika
The global primary_ipic in arch/powerpc/sysdev/ipic.c can remain NULL
if ipic_init() fails, which will happen on machines that don't have an
ipic interrupt controller. init_ipic_sysfs() will crash in that case.
Acked-by: Grant Likely <grant.likely@secretlab.ca> Signed-off-by: Paul Mackerras <paulus@samba.org>
Paul Mackerras [Mon, 24 Mar 2008 06:41:22 +0000 (17:41 +1100)]
[POWERPC] Don't use 64k pages for ioremap on pSeries
On pSeries, the hypervisor doesn't let us map in the eHEA ethernet
adapter using 64k pages, and thus the ehea driver will fail if 64k
pages are configured. This works around the problem by always
using 4k pages for ioremap on pSeries (but not on other platforms).
A better fix would be to check whether the partition could ever
have an eHEA adapter, and only force 4k pages if it could, but this
will do for 2.6.25.
Martin Devera [Mon, 24 Mar 2008 05:00:38 +0000 (22:00 -0700)]
sch_htb: fix "too many events" situation
HTB is event driven algorithm and part of its work is to apply
scheduled events at proper times. It tried to defend itself from
livelock by processing only limited number of events per dequeue.
Because of faster computers some users already hit this hardcoded
limit.
This patch limits processing up to 2 jiffies (why not 1 jiffie ?
because it might stop prematurely when only fraction of jiffie
remains).
Signed-off-by: Martin Devera <devik@cdi.cz> Signed-off-by: David S. Miller <davem@davemloft.net>