15 years agorpc: fix garbage in printk in svc_tcp_accept()
Wolfgang Walter [Thu, 20 Sep 2007 19:51:46 +0000 (15:51 -0400)]
rpc: fix garbage in printk in svc_tcp_accept()

we upgraded the kernel of a nfs-server from to Since
then we get the message

lockd: too many open TCP sockets, consider increasing the number of nfsd threads
lockd: last TCP connect from ^\\236^\É^D

These random characters in the second line are caused by a bug in

(Note: there are two previous __svc_print_addr(sin, buf, sizeof(buf))
calls in this function, either of which would initialize buf correctly;
but both are inside "if"'s and are not necessarily executed.  This is
less obvious in the second case, which is inside a dprintk(), which is a
macro which expands to an if statement.)

Signed-off-by: Wolfgang Walter <>
Signed-off-by: J. Bruce Fields <>
Signed-off-by: Linus Torvalds <>
15 years agoMerge branch 'master' of
Linus Torvalds [Thu, 20 Sep 2007 19:42:47 +0000 (12:42 -0700)]
Merge branch 'master' of /linux/kernel/git/davem/net-2.6

* 'master' of
  [BNX2]: Add PHY workaround for 5709 A1.
  [PPP] L2TP: Fix skb handling in pppol2tp_xmit
  [PPP] L2TP: Fix skb handling in pppol2tp_recv_core
  [PPP] L2TP: Disallow non-UDP datagram sockets
  [PPP] pppoe: Fix double-free on skb after transmit failure
  [PKT_SCHED]: Fix 'SFQ qdisc crashes with limit of 2 packets'
  [NETFILTER]: nfnetlink_log: fix sending of multipart messages

15 years agoMerge branch 'upstream-linus' of
Linus Torvalds [Thu, 20 Sep 2007 19:42:23 +0000 (12:42 -0700)]
Merge branch 'upstream-linus' of /linux/kernel/git/jgarzik/netdev-2.6

* 'upstream-linus' of
  sky2: version 1.18
  sky2: receive FIFO checking
  sky2: fe+ chip support
  sky2: reorganize chip revision features
  sky2: ethtool speed report bug
  sky2: fix VLAN receive processing (resend)
  phy: export phy_mii_ioctl
  myri10ge: Add support for PCI device id 9

15 years agosky2: version 1.18
Stephen Hemminger [Wed, 19 Sep 2007 22:36:47 +0000 (15:36 -0700)]
sky2: version 1.18

Update version number

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agosky2: receive FIFO checking
Stephen Hemminger [Wed, 19 Sep 2007 22:36:46 +0000 (15:36 -0700)]
sky2: receive FIFO checking

A driver writer from another operating system hinted that
the versions of Yukon 2 chip with rambuffer (EC and XL) have
a hardware bug that if the FIFO ever gets completely full it
will hang. Sounds like a classic ring full vs ring empty wrap around

As a workaround, use the existing watchdog timer to check for
ring full lockup.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agosky2: fe+ chip support
Stephen Hemminger [Wed, 19 Sep 2007 22:36:45 +0000 (15:36 -0700)]
sky2: fe+ chip support

Add support for newest Marvell chips.
The Yukon FE plus chip is found in some not yet released laptops.
Tested on hardware evaluation boards.

This version of the patch is for 2.6.23. It supersedes
the two previous patches that are sitting in netdev-2.6 (upstream branch).

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agosky2: reorganize chip revision features
Stephen Hemminger [Wed, 19 Sep 2007 22:36:44 +0000 (15:36 -0700)]
sky2: reorganize chip revision features

This patch should cause no functional changes in driver behaviour.
There are (too) many revisions of the Yukon 2 chip now. Instead of
adding more conditionals based on chip revision; rerganize into a
set of feature flags so adding new versions is less problematic.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agosky2: ethtool speed report bug
Stephen Hemminger [Wed, 19 Sep 2007 22:36:43 +0000 (15:36 -0700)]
sky2: ethtool speed report bug

On 100mbit versions, the driver always reports gigabit speed
available. The correct modes are already computed, then overwritten.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agosky2: fix VLAN receive processing (resend)
Stephen Hemminger [Wed, 19 Sep 2007 22:36:42 +0000 (15:36 -0700)]
sky2: fix VLAN receive processing (resend)

The length check for truncated frames was not correctly handling
the case where VLAN acceleration had already read the tag.
Also, the Yukon EX has some features that use high bit of status
as security tag.

Signed-off-by: Pierre-Yves Ritschard <>
Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
15 years agoieee1394: ohci1394: fix initialization if built non-modular
Stefan Richter [Thu, 20 Sep 2007 19:17:33 +0000 (21:17 +0200)]
ieee1394: ohci1394: fix initialization if built non-modular

Initialization of ohci1394 was broken according to one reporter if the
driver was statically linked, i.e. not built as loadable module.  Dmesg:

  PCI: Device 0000:02:07.0 not available because of resource collisions
  ohci1394: Failed to enable OHCI hardware.

This was reported for a Toshiba Satellite 5100-503.  The cause is commit
8df4083c5291b3647e0381d3c69ab2196f5dd3b7 in Linux 2.6.19-rc1 which only
served purposes of early remote debugging via FireWire.  This
functionality is better provided by the currently out-of-tree driver
ohci1394_earlyinit.  Reversal of the commit was OK'd by Andi Kleen.

Signed-off-by: Stefan Richter <>
15 years ago[BNX2]: Add PHY workaround for 5709 A1.
Michael Chan [Thu, 20 Sep 2007 18:04:58 +0000 (11:04 -0700)]
[BNX2]: Add PHY workaround for 5709 A1.

Add the DIS_EARLY_DAC PHY workaround for 5709 A1.  Without it, link
sometimes does not come up.

Update version to 1.6.5.

Signed-off-by: Michael Chan <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] L2TP: Fix skb handling in pppol2tp_xmit
Herbert Xu [Wed, 19 Sep 2007 17:46:28 +0000 (10:46 -0700)]
[PPP] L2TP: Fix skb handling in pppol2tp_xmit

This patch makes pppol2tp_xmit call skb_cow_head so that we don't modify
cloned skb data.  It also gets rid of skb2 we only need to preserve the
original skb for congestion notification, which is only applicable for
ppp_async and ppp_sync.

The other semantic change made here is the removal of socket accounting
for data tranmitted out of pppol2tp_xmit.  The original code leaked any
existing socket skb accounting.  We could fix this by dropping the
original skb owner.  However, this is undesirable as the packet has not
physically left the host yet.

In fact, all other tunnels in the kernel do not account skb's passing
through to their own socket.  In partciular, ESP over UDP does not do
so and it is the closest tunnel type to PPPoL2TP.  So this patch simply
removes the socket accounting in pppol2tp_xmit.  The accounting still
applies to control packets of course.

I've also added a reminder that the outgoing checksum here doesn't work.
I suppose existing deployments don't actually enable checksums.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] L2TP: Fix skb handling in pppol2tp_recv_core
Herbert Xu [Tue, 18 Sep 2007 20:18:42 +0000 (13:18 -0700)]
[PPP] L2TP: Fix skb handling in pppol2tp_recv_core

The function pppol2tp_recv_core doesn't handle non-linear packets properly.
It also fails to check the remote offset field.

This patch fixes these problems.  It also removes an unnecessary check on
the UDP header which has already been performed by the UDP layer.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] L2TP: Disallow non-UDP datagram sockets
Herbert Xu [Tue, 18 Sep 2007 20:18:17 +0000 (13:18 -0700)]
[PPP] L2TP: Disallow non-UDP datagram sockets

With the addition of UDP-Lite we need to refine the socket check so
that only genuine UDP sockets are allowed through.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] pppoe: Fix double-free on skb after transmit failure
Herbert Xu [Wed, 19 Sep 2007 17:45:02 +0000 (10:45 -0700)]
[PPP] pppoe: Fix double-free on skb after transmit failure

When I got rid of the second packet in __pppoe_xmit I created
a double-free on the skb because of the goto abort on failure.
This patch removes that.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PKT_SCHED]: Fix 'SFQ qdisc crashes with limit of 2 packets'
Alexey Kuznetsov [Wed, 19 Sep 2007 17:42:03 +0000 (10:42 -0700)]
[PKT_SCHED]: Fix 'SFQ qdisc crashes with limit of 2 packets'

Acked-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
15 years ago[NETFILTER]: MAINTAINERS update
Patrick McHardy [Tue, 18 Sep 2007 20:19:26 +0000 (13:19 -0700)]

Update netfilter list addresses and an old email address of myself.

Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
15 years ago[NETFILTER]: nfnetlink_log: fix sending of multipart messages
Eric Leblond [Tue, 18 Sep 2007 20:07:15 +0000 (13:07 -0700)]
[NETFILTER]: nfnetlink_log: fix sending of multipart messages

The following patch fixes the handling of netlink packets containing
multiple messages.

As exposed during netfilter workshop, nfnetlink_log was overwritten the
message type of the last message (setting it to MSG_DONE) in a multipart
packet. The consequence was libnfnetlink to ignore the last message in the

The following patch adds a supplementary message (with type MSG_DONE) af
the end of the netlink skb.

Signed-off-by: Eric Leblond <>
Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
15 years agoFix CRLF line endings in Documentation/input/iforce-protocol.txt
Linus Torvalds [Thu, 20 Sep 2007 18:33:45 +0000 (11:33 -0700)]
Fix CRLF line endings in Documentation/input/iforce-protocol.txt

Emil Medve points out that this documentation file uses CRLF line
endings, which means that if you use


(which makes sense if you ever develop under Windows, for example, or if
you use other broken tools) in your git config, git will always complain
about the file being dirty.

This removes the bogus DOS line endings, and removes whitespace at the
end of line.

Cc: Emil Medve <>
Signed-off-by: Linus Torvalds <>
15 years ago[x86 setup] Fix typo in arch/i386/boot/header.S
Paul Bolle [Mon, 10 Sep 2007 21:39:02 +0000 (23:39 +0200)]
[x86 setup] Fix typo in arch/i386/boot/header.S

There's an obvious typo in arch/i386/boot/header.S (in your
linux-2.6-x86setup.git) that I noticed by just studying the code.

Signed-off-by: Paul Bolle <>
Signed-off-by: H. Peter Anvin <>
15 years ago[acpi] Correct the decoding of video mode numbers in wakeup.S
H. Peter Anvin [Thu, 13 Sep 2007 21:16:37 +0000 (14:16 -0700)]
[acpi] Correct the decoding of video mode numbers in wakeup.S

wakeup.S looks at the video mode number from the setup header and
looks to see if it is a VESA mode.  Unfortunately, the decoding is
done incorrectly and it will attempt to frob the VESA BIOS for any
mode number 0x0200 or larger.  Correct this, and remove a bunch of #if
0'd code.

Massive thanks to Jeff Chua for reporting the bug, and suffering
though a large number of experiments in order to track this problem

Cc: Pavel Machek <>
Signed-off-by: H. Peter Anvin <>
15 years ago[x86 setup] Present the canonical video mode number to the kernel
H. Peter Anvin [Thu, 13 Sep 2007 21:14:29 +0000 (14:14 -0700)]
[x86 setup] Present the canonical video mode number to the kernel

Canonicalize the video mode number as presented to the kernel.  The
video mode number may be user-entered (e.g. ASK_VGA), an alias
(e.g. NORMAL_VGA), or a size specification, and that confuses the
suspend wakeup code.

Signed-off-by: H. Peter Anvin <>
15 years agophy: export phy_mii_ioctl
Domen Puncer [Mon, 17 Sep 2007 20:21:40 +0000 (22:21 +0200)]
phy: export phy_mii_ioctl

Export phy_mii_ioctl, so network drivers can use it when built
as modules too.

Signed-off-by: Domen Puncer <>
Signed-off-by: Jeff Garzik <>
15 years agoLinux 2.6.23-rc7 v2.6.23-rc7
Linus Torvalds [Wed, 19 Sep 2007 23:01:13 +0000 (16:01 -0700)]
Linux 2.6.23-rc7

15 years agoMerge git://
Linus Torvalds [Wed, 19 Sep 2007 22:47:59 +0000 (15:47 -0700)]
Merge git://git./linux/kernel/git/mingo/linux-2.6-sched

* git://
  sched: fix invalid sched_class use
  sched: add /proc/sys/kernel/sched_compat_yield

15 years agoSELinux: fix array out of bounds when mounting with selinux options
Eric Paris [Wed, 19 Sep 2007 21:19:12 +0000 (17:19 -0400)]
SELinux: fix array out of bounds when mounting with selinux options

Given an illegal selinux option it was possible for match_token to work in
random memory at the end of the match_table_t array.

Note that privilege is required to perform a context mount, so this issue is
effectively limited to root only.

Signed-off-by: Eric Paris <>
Acked-by: Stephen Smalley <>
Signed-off-by: James Morris <>
15 years agosched: fix invalid sched_class use
Hiroshi Shimamoto [Wed, 19 Sep 2007 21:34:46 +0000 (23:34 +0200)]
sched: fix invalid sched_class use

When using rt_mutex, a NULL pointer dereference is occurred at
enqueue_task_rt. Here is a scenario;
1) there are two threads, the thread A is fair_sched_class and
   thread B is rt_sched_class.
2) Thread A is boosted up to rt_sched_class, because the thread A
   has a rt_mutex lock and the thread B is waiting the lock.
3) At this time, when thread A create a new thread C, the thread
   C has a rt_sched_class.
4) When doing wake_up_new_task() for the thread C, the priority
   of the thread C is out of the RT priority range, because the
   normal priority of thread A is not the RT priority. It makes
   data corruption by overflowing the rt_prio_array.
The new thread C should be fair_sched_class.

The new thread should be valid scheduler class before queuing.
This patch fixes to set the suitable scheduler class.

Signed-off-by: Hiroshi Shimamoto <>
Signed-off-by: Ingo Molnar <>
Signed-off-by: Peter Zijlstra <>
15 years agosched: add /proc/sys/kernel/sched_compat_yield
Ingo Molnar [Wed, 19 Sep 2007 21:34:46 +0000 (23:34 +0200)]
sched: add /proc/sys/kernel/sched_compat_yield

add /proc/sys/kernel/sched_compat_yield to make sys_sched_yield()
more agressive, by moving the yielding task to the last position
in the rbtree.

with sched_compat_yield=0:

  2539 mingo     20   0  1576  252  204 R   50  0.0   0:02.03 loop_yield
  2541 mingo     20   0  1576  244  196 R   50  0.0   0:02.05 loop

with sched_compat_yield=1:

  2584 mingo     20   0  1576  248  196 R   99  0.0   0:52.45 loop
  2582 mingo     20   0  1576  256  204 R    0  0.0   0:00.00 loop_yield

Signed-off-by: Ingo Molnar <>
Signed-off-by: Peter Zijlstra <>
15 years agomyri10ge: Add support for PCI device id 9
Brice Goglin [Thu, 13 Sep 2007 22:40:14 +0000 (00:40 +0200)]
myri10ge: Add support for PCI device id 9

Add support for new Myri-10G boards with PCI device id 9.

Signed-off-by: Brice Goglin <>
Signed-off-by: Jeff Garzik <>
15 years agoMerge branch 'upstream' of git://
Linus Torvalds [Wed, 19 Sep 2007 18:45:32 +0000 (11:45 -0700)]
Merge branch 'upstream' of git://

* 'upstream' of git://
  [MIPS] cpu-bugs64.c: GCC 3.3 constraint workaround
  [MIPS] DEC: Initialise ioasic_ssr_lock

15 years agoMerge
Linus Torvalds [Wed, 19 Sep 2007 18:41:15 +0000 (11:41 -0700)]
Merge /pub/scm/linux/kernel/git/mchehab/v4l-dvb

  V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option
  Revert "V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option"

15 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Wed, 19 Sep 2007 18:40:13 +0000 (11:40 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  [XFS] Avoid replaying inode buffer initialisation log items if on-disk version is newer.
  [XFS] Ensure file size updates have been completed before writing inode to disk.
  [XFS] On-demand reaping of the MRU cache

15 years agoMerge
Linus Torvalds [Wed, 19 Sep 2007 18:39:39 +0000 (11:39 -0700)]
Merge /pub/scm/linux/kernel/git/davem/sparc-2.6

  [SUNSAB]: Fix several bugs.

15 years agoMerge
Linus Torvalds [Wed, 19 Sep 2007 18:39:10 +0000 (11:39 -0700)]
Merge /pub/scm/linux/kernel/git/bart/ide-2.6

  ide: remove unused variables from drivers/ide/ppc/pmac.c
  ide: ST320413A has the same problem as ST340823A

15 years agoMerge branch 'merge' of git://
Linus Torvalds [Wed, 19 Sep 2007 18:38:25 +0000 (11:38 -0700)]
Merge branch 'merge' of git://git./linux/kernel/git/paulus/powerpc

* 'merge' of git://
  [POWERPC] Fix timekeeping on PowerPC 601
  [POWERPC] Don't expose clock vDSO functions when CPU has no timebase
  [POWERPC] spusched: Fix null pointer dereference in find_victim

15 years agox86-64: page faults from user mode are always user faults
Linus Torvalds [Wed, 19 Sep 2007 18:37:14 +0000 (11:37 -0700)]
x86-64: page faults from user mode are always user faults

Randy Dunlap noticed an interesting "crashme" behaviour on his dual
Prescott Xeon setup, where he gets page faults with the error code
having a zero "user" bit, but the register state points back to user

This may be a CPU microcode buglet triggered by some strange instruction
pattern that crashme generates, and loading a microcode update seems to
possibly have fixed it.

Regardless, we really should trust the register state more than the
error code, since it's really the register state that determines whether
we can actually send a signal, or whether we're in kernel mode and need
to oops/kill the process in the case of a page fault.

Cc: Randy Dunlap <>
Signed-off-by: Linus Torvalds <>
15 years ago[MIPS] cpu-bugs64.c: GCC 3.3 constraint workaround
Maciej W. Rozycki [Mon, 17 Sep 2007 16:11:07 +0000 (17:11 +0100)]
[MIPS] cpu-bugs64.c: GCC 3.3 constraint workaround

Add a workaround to address warnings generated on the "n" constraint by
GCC 3.3 and below.

Signed-off-by: Maciej W. Rozycki <>
Signed-off-by: Ralf Baechle <>
15 years ago[MIPS] DEC: Initialise ioasic_ssr_lock
Maciej W. Rozycki [Mon, 17 Sep 2007 15:58:18 +0000 (16:58 +0100)]
[MIPS] DEC: Initialise ioasic_ssr_lock

Fix the definition of the ioasic_ssr_lock spinlock to include a proper

Signed-off-by: Maciej W. Rozycki <>
Signed-off-by: Ralf Baechle <>
15 years agoDriver core: fix deprectated sysfs structure for nested class devices
Dmitry Torokhov [Wed, 19 Sep 2007 05:46:50 +0000 (22:46 -0700)]
Driver core: fix deprectated sysfs structure for nested class devices

Nested class devices used to have 'device' symlink point to a real
(physical) device instead of a parent class device.  When converting
subsystems to struct device we need to keep doing what class devices did if
CONFIG_SYSFS_DEPRECATED is Y, otherwise parts of udev break.

Signed-off-by: Dmitry Torokhov <>
Cc: Kay Sievers <>
Acked-by: Greg KH <>
Tested-by: Anssi Hannula <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agouml: fix irqstack crash
Jeff Dike [Wed, 19 Sep 2007 05:46:49 +0000 (22:46 -0700)]
uml: fix irqstack crash

This patch fixes a crash caused by an interrupt coming in when an IRQ stack
is being torn down.  When this happens, handle_signal will loop, setting up
the IRQ stack again because the tearing down had finished, and handling
whatever signals had come in.

However, to_irq_stack returns a mask of pending signals to be handled, plus
bit zero is set if the IRQ stack was already active, and thus shouldn't be
torn down.  This causes a problem because when handle_signal goes around
the loop, sig will be zero, and to_irq_stack will duly set bit zero in the
returned mask, faking handle_signal into believing that it shouldn't tear
down the IRQ stack and return thread_info pointers back to their original

This will eventually cause a crash, as the IRQ stack thread_info will
continue pointing to the original task_struct and an interrupt will look
into it after it has been freed.

The fix is to stop passing a signal number into to_irq_stack.  Rather, the
pending signals mask is initialized beforehand with the bit for sig already
set.  References to sig in to_irq_stack can be replaced with references to
the mask.

[ use UL]
Signed-off-by: Jeff Dike <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoFix NUMA Memory Policy Reference Counting
Lee Schermerhorn [Wed, 19 Sep 2007 05:46:47 +0000 (22:46 -0700)]
Fix NUMA Memory Policy Reference Counting

This patch proposes fixes to the reference counting of memory policy in the
page allocation paths and in show_numa_map().  Extracted from my "Memory
Policy Cleanups and Enhancements" series as stand-alone.

Shared policy lookup [shmem] has always added a reference to the policy,
but this was never unrefed after page allocation or after formatting the
numa map data.

Default system policy should not require additional ref counting, nor
should the current task's task policy.  However, show_numa_map() calls
get_vma_policy() to examine what may be [likely is] another task's policy.
The latter case needs protection against freeing of the policy.

This patch adds a reference count to a mempolicy returned by
get_vma_policy() when the policy is a vma policy or another task's
mempolicy.  Again, shared policy is already reference counted on lookup.  A
matching "unref" [__mpol_free()] is performed in alloc_page_vma() for
shared and vma policies, and in show_numa_map() for shared and another
task's mempolicy.  We can call __mpol_free() directly, saving an admittedly
inexpensive inline NULL test, because we know we have a non-NULL policy.

Handling policy ref counts for hugepages is a bit trickier.
huge_zonelist() returns a zone list that might come from a shared or vma
'BIND policy.  In this case, we should hold the reference until after the
huge page allocation in dequeue_hugepage().  The patch modifies
huge_zonelist() to return a pointer to the mempolicy if it needs to be
unref'd after allocation.

Kernel Build [16cpu, 32GB, ia64] - average of 10 runs:

w/o patch w/ refcount patch
    Avg   Std Devn    Avg   Std Devn
Real:  100.59     0.38  100.63     0.43
User: 1209.60     0.37 1209.91     0.31
System:   81.52     0.42   81.64     0.34

Signed-off-by: Lee Schermerhorn <>
Acked-by: Andi Kleen <>
Cc: Christoph Lameter <>
Acked-by: Mel Gorman <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoFix user namespace exiting OOPs
Pavel Emelyanov [Wed, 19 Sep 2007 05:46:45 +0000 (22:46 -0700)]
Fix user namespace exiting OOPs

It turned out, that the user namespace is released during the do_exit() in
exit_task_namespaces(), but the struct user_struct is released only during the
put_task_struct(), i.e.  MUCH later.

On debug kernels with poisoned slabs this will cause the oops in
uid_hash_remove() because the head of the chain, which resides inside the
struct user_namespace, will be already freed and poisoned.

Since the uid hash itself is required only when someone can search it, i.e.
when the namespace is alive, we can safely unhash all the user_struct-s from
it during the namespace exiting.  The subsequent free_uid() will complete the
user_struct destruction.

For example simple program

   #include <sched.h>

   char stack[2 * 1024 * 1024];

   int f(void *foo)
    return 0;

   int main(void)
    clone(f, stack + 1 * 1024 * 1024, 0x10000000, 0);
    return 0;

run on kernel with CONFIG_USER_NS turned on will oops the
kernel immediately.

This was spotted during OpenVZ kernel testing.

Signed-off-by: Pavel Emelyanov <>
Signed-off-by: Alexey Dobriyan <>
Acked-by: "Serge E. Hallyn" <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoConvert uid hash to hlist
Pavel Emelyanov [Wed, 19 Sep 2007 05:46:44 +0000 (22:46 -0700)]
Convert uid hash to hlist

Surprisingly, but (spotted by Alexey Dobriyan) the uid hash still uses
list_heads, thus occupying twice as much place as it could.  Convert it to

Signed-off-by: Pavel Emelyanov <>
Signed-off-by: Alexey Dobriyan <>
Acked-by: Serge Hallyn <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agokernel/user.c: Use list_for_each_entry instead of list_for_each
Matthias Kaehlcke [Wed, 19 Sep 2007 05:46:43 +0000 (22:46 -0700)]
kernel/user.c: Use list_for_each_entry instead of list_for_each

kernel/user.c: Convert list_for_each to list_for_each_entry in

Signed-off-by: Matthias Kaehlcke <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoext34: ensure do_split leaves enough free space in both blocks
Eric Sandeen [Wed, 19 Sep 2007 05:46:42 +0000 (22:46 -0700)]
ext34: ensure do_split leaves enough free space in both blocks

The do_split() function for htree dir blocks is intended to split a leaf
block to make room for a new entry.  It sorts the entries in the original
block by hash value, then moves the last half of the entries to the new
block - without accounting for how much space this actually moves.  (IOW,
it moves half of the entry *count* not half of the entry *space*).  If by
chance we have both large & small entries, and we move only the smallest
entries, and we have a large new entry to insert, we may not have created
enough space for it.

The patch below stores each record size when calculating the dx_map, and
then walks the hash-sorted dx_map, calculating how many entries must be
moved to more evenly split the existing entries between the old block and
the new block, guaranteeing enough space for the new entry.

The dx_map "offs" member is reduced to u16 so that the overall map size
does not change - it is temporarily stored at the end of the new block, and
if it grows too large it may be overwritten.  By making offs and size both
u16, we won't grow the map size.

Also add a few comments to the functions involved.

This fixes the testcase reported by on the
linux-ext4 list, "ext3 dir_index causes an error"

Thanks to Andreas Dilger for discussing the problem & solution with me.

Signed-off-by: Eric Sandeen <>
Signed-off-by: Andreas Dilger <>
Tested-by: Junjiro Okajima <>
Cc: Theodore Ts'o <>
Cc: <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agodisable sys_timerfd() for 2.6.23
Andrew Morton [Wed, 19 Sep 2007 05:46:41 +0000 (22:46 -0700)]
disable sys_timerfd() for 2.6.23

There is still some confusion and disagreement over what this interface should
actually do.  So it is best that we disable it in 2.6.23 until we get that
fully sorted out.

(sys_timerfd() was present in 2.6.22 but it was apparently broken, so here we
assume that nobody is using it yet).

Cc: Michael Kerrisk <>
Cc: Davide Libenzi <>
Acked-by: Linus Torvalds <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agonfs: fix oops re sysctls and V4 support
Alexey Dobriyan [Wed, 19 Sep 2007 05:46:40 +0000 (22:46 -0700)]
nfs: fix oops re sysctls and V4 support

NFS unregisters sysctls only if V4 support is compiled in.  However, sysctl
table is not V4 specific, so unregister it always.

Steps to reproduce:

[build nfs.ko with CONFIG_NFS_V4=n]
modrobe nfs
rmmod nfs
ls /proc/sys

Unable to handle kernel paging request at ffffffff880661c0 RIP:
 [<ffffffff802af8e3>] proc_sys_readdir+0xd3/0x350
PGD 203067 PUD 207063 PMD 7e216067 PTE 0
Oops: 0000 [1] SMP
Modules linked in: lockd nfs_acl sunrpc
Pid: 3335, comm: ls Not tainted 2.6.23-rc3-bloat #2
RIP: 0010:[<ffffffff802af8e3>]  [<ffffffff802af8e3>] proc_sys_readdir+0xd3/0x350
RSP: 0018:ffff81007fd93e78  EFLAGS: 00010286
RAX: ffffffff880661c0 RBX: ffffffff80466370 RCX: ffffffff880661c0
RDX: 00000000000014c0 RSI: ffff81007f3ad020 RDI: ffff81007efd8b40
RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff802a8570 R12: ffffffff880661c0
R13: ffff81007e219640 R14: ffff81007efd8b40 R15: ffff81007ded7280
FS:  00002ba25ef03060(0000) GS:ffff81007ff81258(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffff880661c0 CR3: 000000007dfaf000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process ls (pid: 3335, threadinfo ffff81007fd92000, task ffff81007d8a0000)
Stack:  ffff81007f3ad150 ffffffff80283f30 ffff81007fd93f48 ffff81007efd8b40
 ffff81007ee00440 0000000422222222 0000000200035593 ffffffff88037e9a
 2222222222222222 ffffffff80466500 ffff81007e416400 ffff81007e219640
Call Trace:
 [<ffffffff80283f30>] filldir+0x0/0xf0
 [<ffffffff80283f30>] filldir+0x0/0xf0
 [<ffffffff802840c7>] vfs_readdir+0xa7/0xc0
 [<ffffffff80284376>] sys_getdents+0x96/0xe0
 [<ffffffff8020bb3e>] system_call+0x7e/0x83

Code: 41 8b 14 24 85 d2 74 dc 49 8b 44 24 08 48 85 c0 74 e7 49 3b
RIP  [<ffffffff802af8e3>] proc_sys_readdir+0xd3/0x350
 RSP <ffff81007fd93e78>
CR2: ffffffff880661c0
Kernel panic - not syncing: Fatal exception

Signed-off-by: Alexey Dobriyan <>
Acked-by: Trond Myklebust <>
Cc: "J. Bruce Fields" <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agodir_index: error out instead of BUG on corrupt dx dirs
Eric Sandeen [Wed, 19 Sep 2007 05:46:38 +0000 (22:46 -0700)]
dir_index: error out instead of BUG on corrupt dx dirs

Convert asserts (BUGs) in dx_probe from bad on-disk data to recoverable
errors with helpful warnings.  With help catching other asserts from Duane
Griffin <>

Signed-off-by: Eric Sandeen <>
Acked-by: Duane Griffin <>
Acked-by: Theodore Ts'o <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agointel-agp: Fix i830 mask variable that changed with G33 support
Dave Airlie [Wed, 19 Sep 2007 05:46:35 +0000 (22:46 -0700)]
intel-agp: Fix i830 mask variable that changed with G33 support

The mask on i830 should be 0x70 always, later chips 0xF0 should be okay.

Signed-off-by: Dave Airlie <>
Acked-by: Zhenyu Wang <>
Cc: Michael Haas <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agointelfb: Fix bug in DPLL disable
Antonino A. Daplas [Wed, 19 Sep 2007 05:46:34 +0000 (22:46 -0700)]
intelfb: Fix bug in DPLL disable

Reported in Kernel Bugzilla 9006

Fix an obvious bug in DPLL disable.

Signed-off-by: Antonino Daplas <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoxen: don't bother trying to set cr4
Jeremy Fitzhardinge [Wed, 19 Sep 2007 05:46:33 +0000 (22:46 -0700)]
xen: don't bother trying to set cr4

Xen ignores all updates to cr4, and some versions will kill the domain if
you try to change its value.  Just ignore all changes.

Signed-off-by: Jeremy Fitzhardinge <>
Cc: Andi Kleen <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agopci: fix unterminated pci_device_id lists
Kees Cook [Wed, 19 Sep 2007 05:46:32 +0000 (22:46 -0700)]
pci: fix unterminated pci_device_id lists

Fix a couple drivers that do not correctly terminate their pci_device_id
lists.  This results in garbage being spewed into modules.pcimap when the
module happens to not have 28 NULL bytes following the table, and/or the
last PCI ID is actually truncated from the table when calculating the
modules.alias PCI aliases, cause those unfortunate device IDs to not

Signed-off-by: Kees Cook <>
Acked-by: Corey Minyard <>
Cc: David Woodhouse <>
Acked-by: Jeff Garzik <>
Cc: Greg KH <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agomspec: handle shrinking virtual memory areas
Cliff Wickman [Wed, 19 Sep 2007 05:46:31 +0000 (22:46 -0700)]
mspec: handle shrinking virtual memory areas

The shrinking of a virtual memory area that is mmap(2)'d to a memory
special file (device drivers/char/mspec.c) can cause a panic.

If the mapped size of the vma (vm_area_struct) is very large, mspec allocates
a large vma_data structure with vmalloc(). But such a vma can be shrunk by
an munmap(2).  The current driver uses the current size of each vma to
deduce whether its vma_data structure was allocated by kmalloc() or vmalloc().
So if the vma was shrunk it appears to have been allocated by kmalloc(),
and mspec attempts to free it with kfree().  This results in a panic.

This patch avoids the panic (by preserving the type of the allocation) and
also makes mspec work correctly as the vma is split into pieces by the

All vma's derived from such a split vma share the same vma_data structure that
represents all the pages mapped into this set of vma's.  The mpec driver
must be made capable of using the right portion of the structure for each
member vma.  In other words, it must index into the array of page addresses
using the portion of the array that represents the current vma. This is
enabled by storing the vma group's vm_start in the vma_data structure.

The shared vma_data's are not protected by mm->mmap_sem in the fork() case
so the reference count is left as atomic_t.

Signed-off-by: Cliff Wickman <>
Acked-by: Jes Sorensen <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agortc: rtc-ds1553.c should use resource_size_t for base address
Atsushi Nemoto [Wed, 19 Sep 2007 05:46:30 +0000 (22:46 -0700)]
rtc: rtc-ds1553.c should use resource_size_t for base address

Currently the rtc driver, rtc-ds1552.c uses an unsigned long to store the
base mmio address of the NVRAM/RTC.  This breaks on 32-bit systems with
larger physical addresses.

Signed-off-by: Atsushi Nemoto <>
Cc: David Brownell <>
Cc: Alessandro Zummo <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agortc-ds1742.c should use resource_size_t for base address
David Gibson [Wed, 19 Sep 2007 05:46:28 +0000 (22:46 -0700)]
rtc-ds1742.c should use resource_size_t for base address

Currently the rtc driver, rtc-ds1742.c uses an unsigned long to store the
base mmio address of the NVRAM/RTC.  This breaks on systems like PowerPC
440, which is a 32-bit core with 36-bit physical addresses: IO on the
system, including the RTC, is typically above the 4GB point, and cannot fit
into an unsigned long.

This patch fixes the problem by replacing the unsigned long with a
resource_size_t.  Tested on Ebony (PPC440) (with additional patches to
instantiate the ds1742 platform device appropriately).

Signed-off-by: David Gibson <>
Acked-by: Atsushi Nemoto <>
Cc: Alessandro Zummo <>
Cc: David Brownell <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoFix UTS corruption during clone(CLONE_NEWUTS)
Alexey Dobriyan [Wed, 19 Sep 2007 05:46:27 +0000 (22:46 -0700)]
Fix UTS corruption during clone(CLONE_NEWUTS)

struct utsname is copied from master one without any exclusion.

Here is sample output from one proggie doing


and another

clone(,, CLONE_NEWUTS, ...)

hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaabbbbb'
hostname = 'bbbaaaaaaaaaaaaaaaaaaaaaaaaaaa'
hostname = 'aaaaaaaabbbbbbbbbbbbbbbbbbbbbb'
hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaabbbb'
hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaabb'
hostname = 'aaabbbbbbbbbbbbbbbbbbbbbbbbbbb'
hostname = 'bbbbbbbbbbbbbbbbaaaaaaaaaaaaaa'

Hostname is sometimes corrupted.

Yes, even _the_ simplest namespace activity had bug in it. :-(

Signed-off-by: Alexey Dobriyan <>
Acked-by: Serge Hallyn <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoFix failure to resume from initrds
Nigel Cunningham [Wed, 19 Sep 2007 05:46:25 +0000 (22:46 -0700)]
Fix failure to resume from initrds

Commit 831441862956fffa17b9801db37e6ea1650b0f69 (Freezer: make kernel
threads nonfreezable by default) breaks freezing when attempting to resume
from an initrd, because the init (which is freezeable) spins while waiting
for another thread to run /linuxrc, but doesn't check whether it has been
told to enter the refrigerator.  The original patch replaced a call to
try_to_freeze() with a call to yield().  I believe a simple reversion is
wrong because if !CONFIG_PM_SLEEP, try_to_freeze() is a noop.  It should
still yield.

Signed-off-by: Nigel Cunningham <>
Acked-by: Rafael J. Wysocki <>
Acked-by: Pavel Machek <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agouml: use correct type in BLKGETSIZE ioctl
Nicolas George [Wed, 19 Sep 2007 05:46:21 +0000 (22:46 -0700)]
uml: use correct type in BLKGETSIZE ioctl

I found a type mismatch in UML that makes host block devices unusable as ubd
devices on x86_64 and other 64 bits systems (segfault of the mm subsystem):

In block/ioctl.c, the following lines show that the BLKGETSIZE ioctl expects
a pointer to a long:

if ((bdev->bd_inode->i_size >> 9) > ~0UL)
return -EFBIG;
return put_ulong(arg, bdev->bd_inode->i_size >> 9);

In arch/um/os-Linux/file.c, os_file_size calls it with an int.

The ioctl_list man page should be fixed as well.

Cc: Jeff Dike <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years agoFix "Fix DAC960 driver on machines which don't support 64-bit DMA"
Andrew Morton [Wed, 19 Sep 2007 05:46:19 +0000 (22:46 -0700)]
Fix "Fix DAC960 driver on machines which don't support 64-bit DMA"


drivers/block/DAC960.c: In function 'DAC960_V1_EnableMemoryMailboxInterface':
drivers/block/DAC960.c:1168: error: 'DMA_32BIT_MASK' undeclared (first use in this function)
drivers/block/DAC960.c:1168: error: (Each undeclared identifier is reported only

Cc: <>
Cc: <>
Cc: Alessandro Polverini <>
Cc: Jeff Garzik <>
Cc: Matthew Wilcox <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
15 years ago[POWERPC] Fix timekeeping on PowerPC 601
Benjamin Herrenschmidt [Wed, 19 Sep 2007 04:21:56 +0000 (14:21 +1000)]
[POWERPC] Fix timekeeping on PowerPC 601

Recent changes to the timekeeping code broke support for the PowerPC 601
processor which doesn't have the usual timebase facility but a slightly
different thing called (yuck) the RTC.

This fixes it, boot tested on an old 601 based PowerMac 7200.

Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Paul Mackerras <>
15 years ago[POWERPC] Don't expose clock vDSO functions when CPU has no timebase
Benjamin Herrenschmidt [Wed, 19 Sep 2007 04:21:56 +0000 (14:21 +1000)]
[POWERPC] Don't expose clock vDSO functions when CPU has no timebase

We forgot to remove the clock_gettime, clock_getres and get_tbfreq vDSO
calls on CPUs that have no timebase such as 601 or 403 (old CPUs that have
different mechanisms and for which the vDSO code will not work properly).
This fixes it.

Signed-off-by: Benjamin Herrenschmidt <>
Signed-off-by: Paul Mackerras <>
15 years ago[POWERPC] spusched: Fix null pointer dereference in find_victim
Christoph Hellwig [Wed, 19 Sep 2007 04:38:12 +0000 (14:38 +1000)]
[POWERPC] spusched: Fix null pointer dereference in find_victim

find_victim can dereference a NULL pointer when iterating over the list
of victim spus because list_mutex only guarantees spu->ct to be stable,
but of course not to be non-NULL.

Also fix find_victim to not call spu_unbind_context without list_mutex
because that violates the above guarantee.

Signed-off-by: Christoph Hellwig <>
Signed-off-by: Arnd Bergmann <>
Signed-off-by: Jeremy Kerr <>
Signed-off-by: Paul Mackerras <>
15 years ago[XFS] Avoid replaying inode buffer initialisation log items if on-disk version is...
Lachlan McIlroy [Fri, 14 Sep 2007 05:23:04 +0000 (15:23 +1000)]
[XFS] Avoid replaying inode buffer initialisation log items if on-disk version is newer.

SGI-PV: 969656
SGI-Modid: xfs-linux-melb:xfs-kern:29676a

Signed-off-by: Lachlan McIlroy <>
Signed-off-by: David Chinner <>
Signed-off-by: Tim Shimmin <>
15 years ago[XFS] Ensure file size updates have been completed before writing inode to disk.
Lachlan McIlroy [Fri, 14 Sep 2007 05:22:50 +0000 (15:22 +1000)]
[XFS] Ensure file size updates have been completed before writing inode to disk.

SGI-PV: 968767
SGI-Modid: xfs-linux-melb:xfs-kern:29675a

Signed-off-by: Lachlan McIlroy <>
Signed-off-by: David Chinner <>
Signed-off-by: Tim Shimmin <>
15 years ago[SUNSAB]: Fix several bugs.
Al Viro [Mon, 17 Sep 2007 23:47:07 +0000 (16:47 -0700)]
[SUNSAB]: Fix several bugs.

* don't register irq until ->startup() (and release in ->shutdown()).
That avoids oopsen with the current tree when interrupt comes before we'd
set up the data structures for ttyb.
* handle console=ttyS... even when OBP talks to screen/keyboard
* register irq handler for each port, let kernel/irq/handle.c
call it for both if needed.  Kills code duplication in sunsab_interrupt().
BTW, there'd been bitrot in it - ttya handling had stopped calling
check_status() on BRK (correctly), ttyb copy of that code had kept the
bogus call in that case.

Signed-off-by: Al Viro <>
Signed-off-by: David S. Miller <>
15 years agoV4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option
Robert P. J. Day [Mon, 3 Sep 2007 12:35:04 +0000 (09:35 -0300)]
V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option

Since this boot-time option was removed in commit
9ab7e323af9f9efad3e20a14faa4d947adfac381, delete the reference to it.

Signed-off-by: Robert P. J. Day <>
Signed-off-by: Mauro Carvalho Chehab <>
15 years agoRevert "V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot...
Mauro Carvalho Chehab [Sat, 15 Sep 2007 10:38:47 +0000 (07:38 -0300)]
Revert "V4L/DVB (6173a): Documentation: Remove reference to dead "cpia_pp=" boot-time option"

This reverts commit 4730d3af625b532e3df5f091b5c8edb08f512fbf.

Unfortunately, patch got mangled by a whitespace removal script.

Signed-off-by: Mauro Carvalho Chehab <>
15 years agoide: remove unused variables from drivers/ide/ppc/pmac.c
Stephen Rothwell [Mon, 17 Sep 2007 10:35:30 +0000 (12:35 +0200)]
ide: remove unused variables from drivers/ide/ppc/pmac.c

Removes these warnings:

/home/sfr/kernels/linus/drivers/ide/ppc/pmac.c: In function 'pmac_ide_dma_check':
/home/sfr/kernels/linus/drivers/ide/ppc/pmac.c:1807: warning: unused variable 'map'
/home/sfr/kernels/linus/drivers/ide/ppc/pmac.c:1805: warning: unused variable 'pmif'

Signed-off-by: Stephen Rothwell <>
Signed-off-by: Bartlomiej Zolnierkiewicz <>
15 years agoide: ST320413A has the same problem as ST340823A
Jorge Juan Chico [Mon, 17 Sep 2007 10:35:30 +0000 (12:35 +0200)]
ide: ST320413A has the same problem as ST340823A

ST320413A has the same problem as ST340823A.  Please see

From: "Jorge Juan Chico" <>
Signed-off-by: Bartlomiej Zolnierkiewicz <>
15 years ago[XFS] On-demand reaping of the MRU cache
David Chinner [Thu, 16 Aug 2007 05:21:11 +0000 (15:21 +1000)]
[XFS] On-demand reaping of the MRU cache

Instead of running the mru cache reaper all the time based on a timeout,
we should only run it when the cache has active objects. This allows CPUs
to sleep when there is no activity rather than be woken repeatedly just to
check if there is anything to do.

SGI-PV: 968554
SGI-Modid: xfs-linux-melb:xfs-kern:29305a

Signed-off-by: David Chinner <>
Signed-off-by: Donald Douwsma <>
Signed-off-by: Tim Shimmin <>
15 years agoMerge branch 'release' of git://
Linus Torvalds [Mon, 17 Sep 2007 05:24:49 +0000 (22:24 -0700)]
Merge branch 'release' of git://git./linux/kernel/git/lenb/linux-acpi-2.6

* 'release' of git://
  ACPI: thinkpad-acpi: bump up version to 0.16
  ACPI: thinkpad-acpi: revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED option
  ACPI: fix CONFIG_NET=n acpi_bus_generate_netlink_event build failure
  msi-laptop: replace ',' with ';'
  ACPI: (more) delete CONFIG_ACPI_PROCFS_SLEEP (again)

15 years agoPull thinkpad into release branch
Len Brown [Mon, 17 Sep 2007 04:58:40 +0000 (00:58 -0400)]
Pull thinkpad into release branch

15 years agoACPI: thinkpad-acpi: bump up version to 0.16
Henrique de Moraes Holschuh [Tue, 4 Sep 2007 14:13:16 +0000 (11:13 -0300)]
ACPI: thinkpad-acpi: bump up version to 0.16

Name it thinkpad-acpi version 0.16 to avoid any confusion with some 0.15
thinkpad-acpi development snapshots and backports that had input layer
support, but no hotkey_report_mode support.

Signed-off-by: Henrique de Moraes Holschuh <>
Signed-off-by: Len Brown <>
15 years agoACPI: thinkpad-acpi: revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED option
Henrique de Moraes Holschuh [Tue, 4 Sep 2007 14:13:15 +0000 (11:13 -0300)]
ACPI: thinkpad-acpi: revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED option

Revert new 2.6.23 CONFIG_THINKPAD_ACPI_INPUT_ENABLED Kconfig option because
it would create a legacy we don't want to support.

CONFIG_THINKPAD_ACPI_INPUT_ENABLED was added to try to fix an issue that is
now moot with the addition of the netlink ACPI event report interface to
the ACPI core.

Now that ACPI core can send events over netlink, we can use a different
strategy to keep backwards compatibility with older userspace, without the
need for the CONFIG_THINKPAD_ACPI_INPUT_ENABLED games.  And it arrived
before CONFIG_THINKPAD_ACPI_INPUT_ENABLED made it to a stable mainline
kernel, even, which is Good.

This patch is in sync with some changes to thinkpad-acpi backports, that
will keep things sane for userspace across different combinations of kernel
versions, thinkpad-acpi backports (or the lack thereof), and userspace

Unless a module parameter is used, thinkpad-acpi will now behave in such a
way that it will work well (by default) with userspace that still uses only
the old ACPI procfs event interface and doesn't care for thinkpad-acpi
input devices.

It will also always work well with userspace that has been updated to use
both the thinkpad-acpi input devices, and ACPI core netlink event
interface, regardless of any module parameter.

The module parameter was added to allow thinkpad-acpi to work with
userspace that has been partially updated to use thinkpad-acpi input
devices, but not the new ACPI core netlink event interface.  To use this
mode of hot key reporting, one has to specify the hotkey_report_mode=2
module parameter.

The thinkpad-acpi driver exports the value of hotkey_report_mode through
sysfs, as well.  thinkpad-acpi backports to older kernels, that do not
support the new ACPI core netlink interface, have code to allow userspace
to switch hotkey_report_mode at runtime through sysfs.  This capability
will not be provided in mainline thinkpad-acpi as it is not needed there.

Signed-off-by: Henrique de Moraes Holschuh <>
Cc: Michael S. Tsirkin <>
Cc: Hugh Dickins <>
Cc: Richard Hughes <>
Signed-off-by: Len Brown <>
15 years agoPull misc into release branch
Len Brown [Mon, 17 Sep 2007 04:28:58 +0000 (00:28 -0400)]
Pull misc into release branch

15 years agoMerge branch 'master' of
Linus Torvalds [Mon, 17 Sep 2007 04:15:36 +0000 (21:15 -0700)]
Merge branch 'master' of /linux/kernel/git/davem/sparc-2.6

* 'master' of
  [SPARC64]: Warn user if cpu is ignored.
  [SPARC64]: Fix lockdep, particularly on SMP.
  [SPARC64]: Update defconfig.

15 years agoMerge branch 'master' of
Linus Torvalds [Mon, 17 Sep 2007 04:14:54 +0000 (21:14 -0700)]
Merge branch 'master' of /linux/kernel/git/davem/net-2.6

* 'master' of
  [VLAN]: Fix net_device leak.
  [PPP] generic: Fix receive path data clobbering & non-linear handling
  [PPP] generic: Call skb_cow_head before scribbling over skb
  [NET] skbuff: Add skb_cow_head
  [BRIDGE]: Kill clone argument to br_flood_*
  [PPP] pppoe: Fill in header directly in __pppoe_xmit
  [PPP] pppoe: Fix data clobbering in __pppoe_xmit and return value
  [PPP] pppoe: Fix skb_unshare_check call position
  [SCTP]: Convert bind_addr_list locking to RCU
  [SCTP]: Add RCU synchronization around sctp_localaddr_list
  [PKT_SCHED]: sch_cbq.c: Shut up uninitialized variable warning
  [PKTGEN]: srcmac fix
  [IPV6]: Fix source address selection.
  [IPV4]: Just increment OutDatagrams once per a datagram.
  [IPV6]: Just increment OutDatagrams once per a datagram.
  [IPV6]: Fix unbalanced socket reference with MSG_CONFIRM.
  [NET_SCHED] protect action config/dump from irqs
  [NET]: Fix two issues wrt. SO_BINDTODEVICE.

15 years agoFix non-ISA link error in drivers/scsi/advansys.c
Matthew Wilcox [Sun, 16 Sep 2007 23:01:26 +0000 (17:01 -0600)]
Fix non-ISA link error in drivers/scsi/advansys.c

When CONFIG_ISA is disabled, the isa_driver support will not be compiled
in.  Define stubs so that we don't get link-time errors.

Signed-off-by: Matthew Wilcox <>
Signed-off-by: Linus Torvalds <>
15 years ago[VLAN]: Fix net_device leak.
Al Viro [Sun, 16 Sep 2007 23:43:04 +0000 (16:43 -0700)]
[VLAN]: Fix net_device leak.

In "[VLAN]: Move device registation to seperate function" (commit
e89fe42cd03c8fd3686df82d8390a235717a66de), a pile of code got moved
to register_vlan_dev(), including grabbing a reference to underlying
device.  However, original dev_hold() had been left behind, so we
leak a reference to net_device now...

Signed-off-by: Al Viro <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] generic: Fix receive path data clobbering & non-linear handling
Herbert Xu [Sun, 16 Sep 2007 23:22:13 +0000 (16:22 -0700)]
[PPP] generic: Fix receive path data clobbering & non-linear handling

This patch adds missing pskb_may_pull calls to deal with non-linear
packets that may arrive from pppoe or pppol2tp.

It also copies cloned packets before writing over them.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] generic: Call skb_cow_head before scribbling over skb
Herbert Xu [Sun, 16 Sep 2007 23:21:42 +0000 (16:21 -0700)]
[PPP] generic: Call skb_cow_head before scribbling over skb

It's rude to write over data that other people are still using.  So call
skb_cow_head before PPP proceeds to modify the skb data.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[NET] skbuff: Add skb_cow_head
Herbert Xu [Sun, 16 Sep 2007 23:21:16 +0000 (16:21 -0700)]
[NET] skbuff: Add skb_cow_head

This patch adds an optimised version of skb_cow that avoids the copy if
the header can be modified even if the rest of the payload is cloned.

This can be used in encapsulating paths where we only need to modify the
header.  As it is, this can be used in PPPOE and bridging.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[BRIDGE]: Kill clone argument to br_flood_*
Herbert Xu [Sun, 16 Sep 2007 23:20:48 +0000 (16:20 -0700)]
[BRIDGE]: Kill clone argument to br_flood_*

The clone argument is only used by one caller and that caller can clone
the packet itself.  This patch moves the clone call into the caller and
kills the clone argument.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] pppoe: Fill in header directly in __pppoe_xmit
Herbert Xu [Sun, 16 Sep 2007 23:20:21 +0000 (16:20 -0700)]
[PPP] pppoe: Fill in header directly in __pppoe_xmit

This patch removes the hdr variable (which is copied into the skb)
and instead sets the header directly in the skb.

It also uses __skb_push instead of skb_push since we've just checked
using skb_cow for enough head room.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] pppoe: Fix data clobbering in __pppoe_xmit and return value
Herbert Xu [Sun, 16 Sep 2007 23:19:50 +0000 (16:19 -0700)]
[PPP] pppoe: Fix data clobbering in __pppoe_xmit and return value

The function __pppoe_xmit modifies the skb data and therefore it needs
to copy and skb data if it's cloned.

In fact, it currently allocates a new skb so that it can return 0 in
case of error without freeing the original skb.  This is totally wrong
because returning zero is meant to indicate congestion whereupon pppoe
is supposed to wake up the upper layer once the congestion subsides.

This makes sense for ppp_async and ppp_sync but is out-of-place for
pppoe.  This patch makes it always return 1 and free the skb.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[PPP] pppoe: Fix skb_unshare_check call position
Herbert Xu [Sun, 16 Sep 2007 23:19:20 +0000 (16:19 -0700)]
[PPP] pppoe: Fix skb_unshare_check call position

The skb_unshare_check call needs to be made before pskb_may_pull,
not after.

Signed-off-by: Herbert Xu <>
Signed-off-by: David S. Miller <>
15 years ago[SCTP]: Convert bind_addr_list locking to RCU
Vlad Yasevich [Sun, 16 Sep 2007 23:03:28 +0000 (16:03 -0700)]
[SCTP]: Convert bind_addr_list locking to RCU

Since the sctp_sockaddr_entry is now RCU enabled as part of
the patch to synchronize sctp_localaddr_list, it makes sense to
change all handling of these entries to RCU.  This includes the
sctp_bind_addrs structure and it's list of bound addresses.

This list is currently protected by an external rw_lock and that
looks like an overkill.  There are only 2 writers to the list:
bind()/bindx() calls, and BH processing of ASCONF-ACK chunks.
These are already seriealized via the socket lock, so they will
not step on each other.  These are also relatively rare, so we
should be good with RCU.

The readers are varied and they are easily converted to RCU.

Signed-off-by: Vlad Yasevich <>
Acked-by: Paul E. McKenney <>
Acked-by: Sridhar Samdurala <>
Signed-off-by: David S. Miller <>
15 years ago[SCTP]: Add RCU synchronization around sctp_localaddr_list
Vlad Yasevich [Sun, 16 Sep 2007 23:02:12 +0000 (16:02 -0700)]
[SCTP]: Add RCU synchronization around sctp_localaddr_list

sctp_localaddr_list is modified dynamically via NETDEV_UP
and NETDEV_DOWN events, but there is not synchronization
between writer (even handler) and readers.  As a result,
the readers can access an entry that has been freed and
crash the sytem.

Signed-off-by: Vlad Yasevich <>
Acked-by: Paul E. McKenney <>
Acked-by: Sridhar Samdurala <>
Signed-off-by: David S. Miller <>
15 years ago[PKT_SCHED]: sch_cbq.c: Shut up uninitialized variable warning
Satyam Sharma [Sun, 16 Sep 2007 21:54:05 +0000 (14:54 -0700)]
[PKT_SCHED]: sch_cbq.c: Shut up uninitialized variable warning

net/sched/sch_cbq.c: In function 'cbq_enqueue':
net/sched/sch_cbq.c:383: warning: 'ret' may be used uninitialized in this function

has been verified to be a bogus case. So let's shut it up.

Signed-off-by: Satyam Sharma <>
Acked-by: Patrick McHardy <>
Signed-off-by: Andrew Morton <>
Signed-off-by: David S. Miller <>
15 years ago[PKTGEN]: srcmac fix
Adit Ranadive [Sun, 16 Sep 2007 21:52:15 +0000 (14:52 -0700)]
[PKTGEN]: srcmac fix

From: Adit Ranadive <>

Signed-off-by: Andrew Morton <>
Signed-off-by: David S. Miller <>
15 years ago[IPV6]: Fix source address selection.
Jiri Kosina [Sun, 16 Sep 2007 21:48:21 +0000 (14:48 -0700)]
[IPV6]: Fix source address selection.

The commit 95c385 broke proper source address selection for cases in which
there is a address which is makred 'deprecated'. The commit mistakenly
changed ifa->flags to ifa_result->flags (probably copy/paste error from a
few lines above) in the 'Rule 3' address selection code.

The patch restores the previous RFC-compliant behavior.

Signed-off-by: Jiri Kosina <>
Signed-off-by: David S. Miller <>
15 years ago[SPARC64]: Warn user if cpu is ignored.
David S. Miller [Sun, 16 Sep 2007 21:45:06 +0000 (14:45 -0700)]
[SPARC64]: Warn user if cpu is ignored.

When NR_CPUS is smaller than the cpu probed, let the user
know that the cpu won't be used.

Suggested by Al Viro.

Signed-off-by: David S. Miller <>
15 years ago[SPARC64]: Fix lockdep, particularly on SMP.
David S. Miller [Sun, 16 Sep 2007 18:51:15 +0000 (11:51 -0700)]
[SPARC64]: Fix lockdep, particularly on SMP.

As noted by Al Viro, when we try to call prom_set_trap_table()
in the SMP trampoline code we try to take the PROM call spinlock
which doesn't work because the current thread pointer isn't
valid yet and lockdep depends upon that being correct.

Furthermore, we cannot set the current thread pointer register
because it can't be properly dereferenced until we return from
prom_set_trap_table().  Kernel TLB misses only work after that

So do the PROM call to set the trap table directly instead of
going through the OBP library C code, and thus avoid the lock

These calls are guarenteed to be serialized fully.

Since there are now no calls to the prom_set_trap_table{_sun4v}()
library functions, they can be deleted.

Signed-off-by: David S. Miller <>
15 years ago[SPARC64]: Update defconfig.
David S. Miller [Sun, 16 Sep 2007 16:52:36 +0000 (09:52 -0700)]
[SPARC64]: Update defconfig.

Signed-off-by: David S. Miller <>
15 years agoclockevents: prevent stale tick update on offline cpu
Thomas Gleixner [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
clockevents: prevent stale tick update on offline cpu

Taking a cpu offline removes the cpu from the online mask before the
CPU_DEAD notification is done. The clock events layer does the cleanup
of the dead CPU from the CPU_DEAD notifier chain. tick_do_timer_cpu is
used to avoid xtime lock contention by assigning the task of jiffies
xtime updates to one CPU. If a CPU is taken offline, then this
assignment becomes stale. This went unnoticed because most of the time
the offline CPU went dead before the online CPU reached __cpu_die(),
where the CPU_DEAD state is checked. In the case that the offline CPU did
not reach the DEAD state before we reach __cpu_die(), the code in there
goes to sleep for 100ms. Due to the stale time update assignment, the
system is stuck forever.

Take the assignment away when a cpu is not longer in the cpu_online_mask.
We do this in the last call to tick_nohz_stop_sched_tick() when the offline
CPU is on the way to the final play_dead() idle entry.

Signed-off-by: Thomas Gleixner <>
15 years agoclockevents: do not shutdown the oneshot broadcast device
Thomas Gleixner [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
clockevents: do not shutdown the oneshot broadcast device

When a cpu goes offline it is removed from the broadcast masks. If the
mask becomes empty the code shuts down the broadcast device. This is
wrong, because the broadcast device needs to be ready for the online
cpu going idle (into a c-state, which stops the local apic timer).

Signed-off-by: Thomas Gleixner <>
15 years agoclockevents: Enforce oneshot broadcast when broadcast mask is set on resume
Thomas Gleixner [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
clockevents: Enforce oneshot broadcast when broadcast mask is set on resume

The jinxed VAIO refuses to resume without hitting keys on the keyboard
when this is not enforced. It is unclear why the cpu ends up in a lower
C State without notifying the clock events layer, but enforcing the
oneshot broadcast here is safe.

Signed-off-by: Thomas Gleixner <>
15 years agoACPI: Reevaluate C/P/T states when a cpu becomes online
Venkatesh Pallipadi [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
ACPI: Reevaluate C/P/T states when a cpu becomes online

Reevaluate C/P/T states when a cpu becomes online. This avoids
the caching of the broadcast information in the clockevents layer.

Signed-off-by: Venkatesh Pallipadi <>
Signed-off-by: Thomas Gleixner <>
Cc: Len Brown <>
15 years agotimekeeping: Prevent time going backwards on resume
Thomas Gleixner [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
timekeeping: Prevent time going backwards on resume

Timekeeping resume adjusts xtime by adding the slept time in seconds and
resets the reference value of the clock source (clock->cycle_last).
clock->cycle last is used to calculate the delta between the last xtime
update and the readout of the clock source in __get_nsec_offset(). xtime
plus the offset is the current time. The resume code ignores the delta
which had already elapsed between the last xtime update and the actual
time of suspend. If the suspend time is short, then we can see time
going backwards on resume.

offs_s = clock->read() - clock->cycle_last;
now = xtime + offs_s;
timekeeping_suspend_time = read_rtc();

sleep_time = read_rtc() - timekeeping_suspend_time;
xtime.tv_sec += sleep_time;
clock->cycle_last = clock->read();
offs_r = clock->read() - clock->cycle_last;
now = xtime + offs_r;

if sleep_time_seconds == 0 and offs_r < offs_s, then time goes

Fix this by storing the offset from the last xtime update and add it to
xtime during resume, when we reset clock->cycle_last:

sleep_time = read_rtc() - timekeeping_suspend_time;
xtime.tv_sec += sleep_time;
xtime += offs_s; /* Fixup xtime offset at suspend time */
clock->cycle_last = clock->read();
offs_r = clock->read() - clock->cycle_last;
now = xtime + offs_r;

Thanks to Marcelo for tracking this down on the OLPC and providing the
necessary details to analyze the root cause.

Signed-off-by: Thomas Gleixner <>
Cc: John Stultz <>
Cc: Tosatti <>
15 years agotimekeeping: access rtc outside of xtime lock
Thomas Gleixner [Sun, 16 Sep 2007 13:36:43 +0000 (15:36 +0200)]
timekeeping: access rtc outside of xtime lock

Lockdep complains about the access of rtc in timekeeping_suspend
inside the interrupt disabled region of the write locked xtime lock.
Move the access outside.

Signed-off-by: Thomas Gleixner <>
Cc: John Stultz <>