14 years agomm: sparsemem memory_present() fix
Ingo Molnar [Tue, 15 Apr 2008 23:40:00 +0000 (01:40 +0200)]
mm: sparsemem memory_present() fix

Fix memory corruption and crash on 32-bit x86 systems.

If a !PAE x86 kernel is booted on a 32-bit system with more than 4GB of
RAM, then we call memory_present() with a start/end that goes outside
the scope of MAX_PHYSMEM_BITS.

That causes this loop to happily walk over the limit of the sparse
memory section map:

    for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION) {
                unsigned long section = pfn_to_section_nr(pfn);
                struct mem_section *ms;

                sparse_index_init(section, nid);
                set_section_nid(section, nid);

                ms = __nr_to_section(section);
                if (!ms->section_mem_map)
                        ms->section_mem_map = sparse_encode_early_nid(nid) |

'ms' will be out of bounds and we'll corrupt a small amount of memory by
encoding the node ID and writing SECTION_MARKED_PRESENT (==0x1) over it.

The corruption might happen when encoding a non-zero node ID, or due to
the SECTION_MARKED_PRESENT which is 0x1:

mmzone.h:#define SECTION_MARKED_PRESENT (1UL<<0)

The fix is to sanity check anything the architecture passes to

This bug seems to be rather old (as old as sparsemem support itself),
but the exact incarnation depended on random details like configs, which
made this bug more prominent in v2.6.25-to-be.

An additional enhancement might be to print a warning about ignored or
trimmed memory ranges.

Signed-off-by: Ingo Molnar <>
Tested-by: Christoph Lameter <>
Cc: Pekka Enberg <>
Cc: Mel Gorman <>
Cc: Nick Piggin <>
Cc: Andrew Morton <>
Cc: Rafael J. Wysocki <>
Cc: Yinghai Lu <>
Cc: KAMEZAWA Hiroyuki <>
Signed-off-by: Linus Torvalds <>
14 years ago[PARISC] fix signal trampoline cache flushing
Kyle McMartin [Tue, 15 Apr 2008 22:36:38 +0000 (18:36 -0400)]
[PARISC] fix signal trampoline cache flushing

The signal trampolines were accidently flushing the kernel I$ instead of
the users.  Fix that up, and also add a missing user D$ flush while
we're at it.

Signed-off-by: Kyle McMartin <>
Signed-off-by: Linus Torvalds <>
14 years agoFix locking bug in "acquire_console_semaphore_for_printk()"
Linus Torvalds [Tue, 15 Apr 2008 20:09:54 +0000 (13:09 -0700)]
Fix locking bug in "acquire_console_semaphore_for_printk()"

When I cleaned up printk() and split up the printk locking logic in
commit 266c2e0abeca649fa6667a1a427ad1da507c6375 ("Make printk() console
semaphore accesses sensible") I had incorrectly moved the call to
have_callable_console() outside of the console semaphore.

That was buggy.  The console semaphore protects the console_drivers list
that is used by have_callable_console().

Thanks go to Bongani Hlope who saw this as a hang on shutdown and reboot
and bisected the bug to the right commit, and tested this patch. See

Bisected-and-tested-by: Bongani Hlope <>
Cc: Alexey Dobriyan <>
Signed-off-by: Linus Torvalds <>
14 years agoMerge git://
Linus Torvalds [Tue, 15 Apr 2008 18:00:05 +0000 (11:00 -0700)]
Merge git://git./linux/kernel/git/lethal/sh-2.6.25

* git://
  sh: export empty_zero_page
  sh: arch/sh/kernel/traps_32.c needs asm/fpu.h
  sh: fix compressed kernel build
  sh64: add missing #include <asm/fpu.h>'s

14 years agosh: export empty_zero_page
Andrew Morton [Tue, 15 Apr 2008 17:21:47 +0000 (02:21 +0900)]
sh: export empty_zero_page

ERROR: "empty_zero_page" [fs/ext4/ext4dev.ko] undefined!

Signed-off-by: Andrew Morton <>
Signed-off-by: Paul Mundt <>
14 years agosh: arch/sh/kernel/traps_32.c needs asm/fpu.h
Andrew Morton [Tue, 15 Apr 2008 17:03:51 +0000 (02:03 +0900)]
sh: arch/sh/kernel/traps_32.c needs asm/fpu.h

arch/sh/kernel/traps_32.c: In function `do_reserved_inst':
arch/sh/kernel/traps_32.c:667: error: implicit declaration of function `do_fpu_inst'

Signed-off-by: Andrew Morton <>
Signed-off-by: Paul Mundt <>
14 years agosh: fix compressed kernel build
Manuel Lauss [Tue, 15 Apr 2008 17:01:55 +0000 (02:01 +0900)]
sh: fix compressed kernel build

commit 54a015104136974262afa4b8ddd943ea70dec8a2 broke zImage build on sh arch:

 LD      vmlinux
  AS      arch/sh/boot/compressed/head_32.o
In file included from /k/arch/sh/boot/compressed/head_32.S:11:
/k/include/linux/linkage.h:34: error: syntax error in macro parameter list

Fix it for both sh and sh64.

Signed-off-by: Manuel Lauss <>
Signed-off-by: Paul Mundt <>
14 years agosh64: add missing #include <asm/fpu.h>'s
Adrian Bunk [Sun, 13 Apr 2008 18:15:38 +0000 (21:15 +0300)]
sh64: add missing #include <asm/fpu.h>'s

This patch fixes some compile errors due to missing save_fpu()
prototypes on sh64 caused by
commit 9bbafce2eec190ef7e44b0eb1095ba17ce6ad3af
(sh: Fix occasional FPU register corruption under preempt).

Signed-off-by: Adrian Bunk <>
Signed-off-by: Paul Mundt <>
14 years agoJFFS2 Fix of panics caused by wrong condition for hole frag creation in write_begin
Alexey Korolev [Mon, 14 Apr 2008 19:45:06 +0000 (20:45 +0100)]
JFFS2 Fix of panics caused by wrong condition for hole frag creation in write_begin

This fixes a regression introduced in commit
205c109a7a96d9a3d8ffe64c4068b70811fef5e8 when switching to
write_begin/write_end operations in JFFS2.

The page offset is miscalculated, leading to corruption of the fragment
lists and subsequently to memory corruption and panics.

[ Side note: the bug is a fairly direct result of the naming.  Nick was
  likely misled by the use of "offs", since we tend to use the notion of
  "offset" not as an absolute position, but as an offset _within_ a page
  or allocation.

  Alternatively, a "pgoff_t" is a page index, but not a byte offset -
  our VM naming can be a bit confusing.

  So in this case, a VM person would likely have called this a "pos",
  not an "offs", or perhaps talked about byte offsets rather than page
  offsets (since it's counted in bytes, not pages).    - Linus ]

Signed-off-by: Alexey Korolev <>
Signed-off-by: Vasiliy Leonenko <>
Signed-off-by: David Woodhouse <>
Signed-off-by: Linus Torvalds <>
14 years agolocks: fix possible infinite loop in fcntl(F_SETLKW) over nfs
J. Bruce Fields [Mon, 14 Apr 2008 19:03:02 +0000 (15:03 -0400)]
locks: fix possible infinite loop in fcntl(F_SETLKW) over nfs

Miklos Szeredi found the bug:

"Basically what happens is that on the server nlm_fopen() calls
nfsd_open() which returns -EACCES, to which nlm_fopen() returns

"On the client this will turn into a -EAGAIN (nlm_stat_to_errno()),
which in will cause fcntl_setlk() to retry forever."

So, for example, opening a file on an nfs filesystem, changing
permissions to forbid further access, then trying to lock the file,
could result in an infinite loop.

And Trond Myklebust identified the culprit, from Marc Eshel and I:

7723ec9777d9832849b76475b1a21a2872a40d20 "locks: factor out
generic/filesystem switch from setlock code"

That commit claimed to just be reshuffling code, but actually introduced
a behavioral change by calling the lock method repeatedly as long as it
returned -EAGAIN.

We assumed this would be safe, since we assumed a lock of type SETLKW
would only return with either success or an error other than -EAGAIN.
However, nfs does can in fact return -EAGAIN in this situation, and
independently of whether that behavior is correct or not, we don't
actually need this change, and it seems far safer not to depend on such
assumptions about the filesystem's ->lock method.

Therefore, revert the problematic part of the original commit.  This
leaves vfs_lock_file() and its other callers unchanged, while returning
fcntl_setlk and fcntl_setlk64 to their former behavior.

Signed-off-by: J. Bruce Fields <>
Tested-by: Miklos Szeredi <>
Cc: Trond Myklebust <>
Cc: Marc Eshel <>
Signed-off-by: Linus Torvalds <>
14 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Mon, 14 Apr 2008 15:10:27 +0000 (08:10 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/mingo/linux-2.6-sched-devel

* 'for-linus' of git://
  revert "sched: fix fair sleepers"

14 years agoMerge branch 'upstream-linus' of git://
Linus Torvalds [Mon, 14 Apr 2008 14:57:07 +0000 (07:57 -0700)]
Merge branch 'upstream-linus' of git://git./linux/kernel/git/jgarzik/libata-dev

* 'upstream-linus' of git://
  [libata] make ali_atapi_dma static
  [libata] sata_svw: fix reversed port count

14 years agoMerge git://
Linus Torvalds [Mon, 14 Apr 2008 14:56:24 +0000 (07:56 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git:// (31 commits)
  [BRIDGE]: Fix crash in __ip_route_output_key with bridge netfilter
  [NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
  [IPV6] ADDRCONF: Don't generate temporary address for ip6-ip6 interface.
  [IPV6] ADDRCONF: Ensure disabling multicast RS even if privacy extensions are disabled.
  [IPV6]: Use appropriate sock tclass setting for routing lookup.
  [IPV6]: IPv6 extension header structures need to be packed.
  [IPV6]: Fix ipv6 address fetching in raw6_icmp_error().
  [NET]: Return more appropriate error from eth_validate_addr().
  [ISDN]: Do not validate ISDN net device address prior to interface-up
  [NET]: Fix kernel-doc for skb_segment
  [SOCK] sk_stamp: should be initialized to ktime_set(-1L, 0)
  net: check for underlength tap writes
  net: make struct tun_struct private to tun.c
  [SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.
  [SCTP]: Fix compiler warning about const qualifiers
  [SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK
  [SCTP]: Add check for hmac_algo parameter in sctp_verify_param()
  [NET_SCHED] cls_u32: refcounting fix for u32_delete()
  [DCCP]: Fix skb->cb conflicts with IP
  [AX25]: Potential ax25_uid_assoc-s leaks on module unload.

14 years agoFRV: Correctly determine the address of an illegal instruction
David Howells [Mon, 14 Apr 2008 10:20:59 +0000 (11:20 +0100)]
FRV: Correctly determine the address of an illegal instruction

Correctly determine the address of an illegal instruction.  The EPCR0 register
holds this value (masked by EPCR0_PC) if the validity bit is set (masked by
EPCR0_V).  So the test as to whether the contents of the register are usable
should be involve checking the _V bit, not the _PC bits.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agorevert "sched: fix fair sleepers"
Ingo Molnar [Mon, 14 Apr 2008 06:50:02 +0000 (08:50 +0200)]
revert "sched: fix fair sleepers"

revert "sched: fix fair sleepers" (e22ecef1d2658ba54ed7d3fdb5d60829fb434c23),
because it is causing audio skipping, see:

the patch is correct and the real cause of the skipping is not
understood (tracing makes it go away), but time has run out so we'll
revert it and re-try in 2.6.26.

Signed-off-by: Ingo Molnar <>
14 years ago[BRIDGE]: Fix crash in __ip_route_output_key with bridge netfilter
Patrick McHardy [Mon, 14 Apr 2008 07:46:01 +0000 (00:46 -0700)]
[BRIDGE]: Fix crash in __ip_route_output_key with bridge netfilter

The bridge netfilter code attaches a fake dst_entry with a pointer to a
fake net_device structure to skbs it passes up to IPv4 netfilter. This
leads to crashes when the skb is passed to __ip_route_output_key when
dereferencing the namespace pointer.

Since bridging can currently only operate in the init_net namespace,
the easiest fix for now is to initialize the nd_net pointer of the
fake net_device struct to &init_net.

Should fix bugzilla 10323:

Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
14 years ago[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put
Pavel Emelyanov [Mon, 14 Apr 2008 07:44:52 +0000 (00:44 -0700)]
[NETFILTER]: ipt_CLUSTERIP: fix race between clusterip_config_find_get and _entry_put

Consider we are putting a clusterip_config entry with the "entries"
count == 1, and on the other CPU there's a clusterip_config_find_get
in progress:

clusterip_config_entry_put: clusterip_config_find_get:
if (atomic_dec_and_test(&c->entries)) {
/* true */
c = __clusterip_config_find(clusterip);
/* found - it's still in list */


Oops! We have an entry returned by the clusterip_config_find_get,
which is a) not in list b) has a stale dev pointer.

The problems will happen when the CPU2 will release the entry - it
will remove it from the list for the 2nd time, thus spoiling it, and
will put a stale dev pointer.

The fix is to make atomic_dec_and_test under the clusterip_lock.

Signed-off-by: Pavel Emelyanov <>
Signed-off-by: Patrick McHardy <>
14 years ago[IPV6] ADDRCONF: Don't generate temporary address for ip6-ip6 interface.
YOSHIFUJI Hideaki [Mon, 14 Apr 2008 06:47:11 +0000 (23:47 -0700)]
[IPV6] ADDRCONF: Don't generate temporary address for ip6-ip6 interface.

As far as I can remember, I was going to disable privacy extensions
on all "tunnel" interfaces.  Disable it on ip6-ip6 interface as well.

Also, just remove ifdefs for SIT for simplicity.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
14 years ago[IPV6] ADDRCONF: Ensure disabling multicast RS even if privacy extensions are disabled.
YOSHIFUJI Hideaki [Mon, 14 Apr 2008 06:42:18 +0000 (23:42 -0700)]
[IPV6] ADDRCONF: Ensure disabling multicast RS even if privacy extensions are disabled.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
14 years ago[IPV6]: Use appropriate sock tclass setting for routing lookup.
YOSHIFUJI Hideaki [Mon, 14 Apr 2008 06:40:51 +0000 (23:40 -0700)]
[IPV6]: Use appropriate sock tclass setting for routing lookup.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
14 years ago[IPV6]: IPv6 extension header structures need to be packed.
YOSHIFUJI Hideaki [Mon, 14 Apr 2008 06:33:52 +0000 (23:33 -0700)]
[IPV6]: IPv6 extension header structures need to be packed.

struct ipv6_opt_hdr is the common structure for IPv6 extension
headers, and it is common to increment the pointer to get
the real content.  On the other hand, since the structure
consists only of 1-byte next-header field and 1-byte length
field, size of that structure depends on architecture; 2 or 4.
Add "packed" attribute to get 2.

Signed-off-by: YOSHIFUJI Hideaki <>
Signed-off-by: David S. Miller <>
14 years ago[IPV6]: Fix ipv6 address fetching in raw6_icmp_error().
David S. Miller [Mon, 14 Apr 2008 06:14:15 +0000 (23:14 -0700)]
[IPV6]: Fix ipv6 address fetching in raw6_icmp_error().

Fixes kernel bugzilla 10437

Based almost entirely upon a patch by Dmitry Butskoy.

When deciding what raw sockets to deliver the ICMPv6
to, we should use the addresses in the ICMPv6 quoted
IPV6 header, not the top-level one.

Signed-off-by: David S. Miller <>
14 years ago[NET]: Return more appropriate error from eth_validate_addr().
Patrick McHardy [Mon, 14 Apr 2008 05:45:40 +0000 (22:45 -0700)]
[NET]: Return more appropriate error from eth_validate_addr().

Paul Bolle wrote:
> would have been much easier to
> track down if eth_validate_addr() would somehow complain aloud if an address
> is invalid. Shouldn't it make at least some noise?

I guess it should return -EADDRNOTAVAIL similar to eth_mac_addr()
when validation fails.

Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>
14 years ago[ISDN]: Do not validate ISDN net device address prior to interface-up
Paul Bolle [Mon, 14 Apr 2008 05:44:20 +0000 (22:44 -0700)]
[ISDN]: Do not validate ISDN net device address prior to interface-up

Commit bada339 (Validate device addr prior to interface-up) caused a regression
in the ISDN network code, see:
The trivial fix is to remove the pointer to eth_validate_addr() in the
net_device struct in isdn_net_init().

Signed-off-by: Paul Bolle <>
Signed-off-by: David S. Miller <>
14 years ago[NET]: Fix kernel-doc for skb_segment
Ben Hutchings [Mon, 14 Apr 2008 04:52:48 +0000 (21:52 -0700)]
[NET]: Fix kernel-doc for skb_segment

The kernel-doc comment for skb_segment is clearly wrong.  This states
what it actually does.

Signed-off-by: Ben Hutchings <>
Signed-off-by: David S. Miller <>
14 years ago[SOCK] sk_stamp: should be initialized to ktime_set(-1L, 0)
Eric Dumazet [Mon, 14 Apr 2008 04:39:26 +0000 (21:39 -0700)]
[SOCK] sk_stamp: should be initialized to ktime_set(-1L, 0)

Problem spotted by Andrew Brampton

Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
14 years agonet: check for underlength tap writes
Rusty Russell [Sun, 13 Apr 2008 01:49:30 +0000 (18:49 -0700)]
net: check for underlength tap writes

If the user gives a packet under 14 bytes, we'll end up reading off the end
of the skb (not oopsing, just reading off the end).

Signed-off-by: Rusty Russell <>
Acked-by: Max Krasnyanskiy <>
Signed-off-by: David S. Miller <>
14 years agonet: make struct tun_struct private to tun.c
Rusty Russell [Sun, 13 Apr 2008 01:48:58 +0000 (18:48 -0700)]
net: make struct tun_struct private to tun.c

There's no reason for this to be in the header, and it just hurts
recompile time.

Signed-off-by: Rusty Russell <>
Acked-by: Max Krasnyanskiy <>
Signed-off-by: David S. Miller <>
14 years ago[SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.
Pavel Emelyanov [Sun, 13 Apr 2008 01:40:38 +0000 (18:40 -0700)]
[SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.

All IP addresses that are present in a system are duplicated on
struct sctp_sockaddr_entry. They are linked in the global list
called sctp_local_addr_list. And this struct unions IPv4 and IPv6

So, there can be rare case, when a sockaddr_in.sin_addr coincides
with the corresponding part of the sockaddr_in6 and the notifier
for IPv4 will carry away an IPv6 entry.

The fix is to check the family before comparing the addresses.

Signed-off-by: Pavel Emelyanov <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
14 years ago[SCTP]: Fix compiler warning about const qualifiers
Vlad Yasevich [Sun, 13 Apr 2008 01:40:06 +0000 (18:40 -0700)]
[SCTP]: Fix compiler warning about const qualifiers

Fix 3 warnings about discarding const qualifiers:

net/sctp/ulpevent.c:862: warning: passing argument 1 of 'sctp_event2skb' discards qualifiers from pointer target type
net/sctp/sm_statefuns.c:4393: warning: passing argument 1 of 'SCTP_ASOC' discards qualifiers from pointer target type
net/sctp/socket.c:5874: warning: passing argument 1 of 'cmsg_nxthdr' discards qualifiers from pointer target type

Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
14 years ago[SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK
Gui Jianfeng [Sun, 13 Apr 2008 01:39:34 +0000 (18:39 -0700)]
[SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK

When receiving an error length INIT-ACK during COOKIE-WAIT,
a 0-vtag ABORT will be responsed. This action violates the
protocol apparently. This patch achieves the following things.
1 If the INIT-ACK contains all the fixed parameters, use init-tag
  recorded from INIT-ACK as vtag.
2 If the INIT-ACK doesn't contain all the fixed parameters,
  just reflect its vtag.

Signed-off-by: Gui Jianfeng <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
14 years ago[SCTP]: Add check for hmac_algo parameter in sctp_verify_param()
Wei Yongjun [Sun, 13 Apr 2008 01:39:19 +0000 (18:39 -0700)]
[SCTP]: Add check for hmac_algo parameter in sctp_verify_param()

RFC 4890 has the following text:

  The HMAC algorithm based on SHA-1 MUST be supported and
  included in the HMAC-ALGO parameter.

As a result, we need to check in sctp_verify_param() that HMAC_SHA1 is
present in the list.  If not, we should probably treat this as a
protocol violation.

It should also be a protocol violation if the HMAC parameter is empty.

Signed-off-by: Wei Yongjun <>
Signed-off-by: Vlad Yasevich <>
Signed-off-by: David S. Miller <>
14 years ago[NET_SCHED] cls_u32: refcounting fix for u32_delete()
Jarek Poplawski [Sun, 13 Apr 2008 01:37:13 +0000 (18:37 -0700)]
[NET_SCHED] cls_u32: refcounting fix for u32_delete()

Deleting of nonroot hnodes mostly doesn't work in u32_delete():
refcnt == 1 is expected, but such hnodes' refcnts are initialized
with 0 and charged only with "link" nodes. Now they'll start with
1 like usual. Thanks to Patrick McHardy for an improving suggestion.

Signed-off-by: Jarek Poplawski <>
Acked-by: Jamal Hadi Salim <>
Signed-off-by: David S. Miller <>
14 years ago[DCCP]: Fix skb->cb conflicts with IP
Patrick McHardy [Sun, 13 Apr 2008 01:35:41 +0000 (18:35 -0700)]
[DCCP]: Fix skb->cb conflicts with IP

dev_queue_xmit() and the other IP output functions expect to get a skb
with clear or properly initialized skb->cb. Unlike TCP and UDP, the
dccp_skb_cb doesn't contain a struct inet_skb_parm at the beginning,
so the DCCP-specific data is interpreted by the IP output functions.
This can cause false negatives for the conditional POST_ROUTING hook
invocation, making the packet bypass the hook.

Add a inet_skb_parm/inet6_skb_parm union to the beginning of
dccp_skb_cb to avoid clashes. Also add a BUILD_BUG_ON to make
sure it fits in the cb.

[ Combined with patch from Gerrit Renker to remove two now unnecessary
  memsets of IPCB(skb)->opt ]

Signed-off-by: Patrick McHardy <>
Acked-by: Arnaldo Carvalho de Melo <>
Signed-off-by: David S. Miller <>
14 years ago[AX25]: Potential ax25_uid_assoc-s leaks on module unload.
Pavel Emelyanov [Sun, 13 Apr 2008 01:33:50 +0000 (18:33 -0700)]
[AX25]: Potential ax25_uid_assoc-s leaks on module unload.

The ax25_uid_free call walks the ax25_uid_list and releases entries
from it. The problem is that after the fisrt call to hlist_del_init
the hlist_for_each_entry (which hides behind the ax25_uid_for_each)
will consider the current position to be the last and will return.

Thus, the whole list will be left not freed.

Signed-off-by: Pavel Emelyanov <>
Signed-off-by: David S. Miller <>
14 years agotg3: fix MMIO for PPC 44x platforms
Sergei Shtylyov [Sun, 13 Apr 2008 01:30:58 +0000 (18:30 -0700)]
tg3: fix MMIO for PPC 44x platforms

The driver stores the PCI resource addresses into 'unsigned long' variable
before calling ioremap_nocache() on them. This warrants kernel oops when the
registers are accessed on PPC 44x platforms which (being 32-bit) have PCI
memory space mapped beyond 4 GB.

The arch/ppc/ kernel has a fixup in ioremap() that creates an illusion that
the PCI memory resource is mapped below 4 GB, but arch/powerpc/ code got rid
of this trick, having instead CONFIG_RESOURCES_64BIT enabled.

[ Bump driver version and release date -DaveM ]

Signed-off-by: Sergei Shtylyov <>
Signed-off-by: David S. Miller <>
14 years agoMark generic HDLC + PPP as broken.
Krzysztof Halasa [Sat, 12 Apr 2008 08:10:40 +0000 (10:10 +0200)]
Mark generic HDLC + PPP as broken.

PPP support in generic HDLC in Linux 2.6.25 is broken and will cause
a kernel panic when a device configured in PPP mode is activated.

It will be replaced by new PPP implementation after Linux 2.6.25 is

This affects only PPP support in generic HDLC (mostly Hitachi SCA
and SCA-II based drivers, wanxl, and few others). Standalone syncppp
and async PPP support are not affected.

Signed-off-by: Krzysztof Halasa <>
Signed-off-by: Jeff Garzik <>
14 years agoehea: Fix DLPAR memory add support
Thomas Klein [Fri, 4 Apr 2008 13:04:53 +0000 (15:04 +0200)]
ehea: Fix DLPAR memory add support

This patch fixes two weaknesses in send/receive packet handling which may
lead to kernel panics during DLPAR memory add operations.

Signed-off-by: Thomas Klein <>
Signed-off-by: Jeff Garzik <>
14 years agosc92031: sysfs link missing
Stephen Hemminger [Fri, 11 Apr 2008 04:30:38 +0000 (21:30 -0700)]
sc92031: sysfs link missing

Add missing sysfs device association. Compile tested only -ENOHW.


Signed-off-by: Stephen Hemminger <>
Cc: Cesar Eduardo Barros <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Jeff Garzik <>
14 years agosmc91x driver: fix bug: print warning only in interrupt mode
Sonic Zhang [Fri, 11 Apr 2008 04:30:37 +0000 (21:30 -0700)]
smc91x driver: fix bug: print warning only in interrupt mode

Signed-off-by: Sonic Zhang <>
Signed-off-by: Bryan Wu <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Jeff Garzik <>
14 years agoforcedeth: mac address fix
Ayaz Abdulla [Fri, 11 Apr 2008 04:30:35 +0000 (21:30 -0700)]
forcedeth: mac address fix

This critical patch fixes a mac address issue recently introduced.  If the
device's mac address was in correct order and the flag
NVREG_TRANSMITPOLL_MAC_ADDR_REV was set, during nv_remove the flag would get
cleared.  During next load, the mac address would get reversed because the
flag is missing.

As it has been indicated previously, the flag is cleared across a low power
transition.  Therefore, the driver should set the mac address back into the
reversed order when clearing the flag.

Also, the driver should set back the flag after a low power transition to
protect against kexec command calling nv_probe a second time.

Signed-off-by: Ayaz Abdulla <>
Cc: "Yinghai Lu" <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Jeff Garzik <>
14 years agomacb: Use semicolon instead of comma for statement
Atsushi Nemoto [Fri, 11 Apr 2008 15:58:14 +0000 (00:58 +0900)]
macb: Use semicolon instead of comma for statement

It seems no good reason to use comma here.

Signed-off-by: Atsushi Nemoto <>
Signed-off-by: Jeff Garzik <>
14 years agomacb: Call phy_disconnect on removing
Atsushi Nemoto [Thu, 10 Apr 2008 14:30:07 +0000 (23:30 +0900)]
macb: Call phy_disconnect on removing

Call phy_disconnect() on remove routine.  Otherwise the phy timer
causes a kernel crash when unloading.

Signed-off-by: Atsushi Nemoto <>
Signed-off-by: Jeff Garzik <>
14 years agoucc_geth: fix non-functional fixed phy support
Joakim Tjernlund [Thu, 10 Apr 2008 22:54:43 +0000 (00:54 +0200)]
ucc_geth: fix non-functional fixed phy support

The new Fixed PHY method, fixed-link property, isn't
impl. for ucc_geth which makes fixed PHYs non functional.
Add support for the new method to restore the Fixed PHY

Signed-off-by: Joakim Tjernlund <>
Signed-off-by: Li Yang <>
Signed-off-by: Jeff Garzik <>
14 years agofs_enet: Don't call NAPI functions when NAPI is not used.
Laurent Pinchart [Fri, 11 Apr 2008 12:05:50 +0000 (14:05 +0200)]
fs_enet: Don't call NAPI functions when NAPI is not used.

fs_enet_close() calls napi_disable() unconditionally. This patch skips the
call when use_napi isn't set.

Signed-off-by: Laurent Pinchart <>
Signed-off-by: Jeff Garzik <>
14 years agosky2: missing chip name for Yukon Supreme
Stephen Hemminger [Thu, 10 Apr 2008 20:06:14 +0000 (15:06 -0500)]
sky2: missing chip name for Yukon Supreme

Any usage of sky2 on new Yukon Supreme would cause a NULL dereference.
The chip is very new, so the support is still untested; vendor has
not sent any eval hardware.

Signed-off-by: Stephen Hemminger <>
Signed-off-by: Jeff Garzik <>
14 years ago[libata] make ali_atapi_dma static
Adrian Bunk [Fri, 11 Apr 2008 17:28:27 +0000 (20:28 +0300)]
[libata] make ali_atapi_dma static

This patch makes the needlessly global ali_atapi_dma static.

Signed-off-by: Adrian Bunk <>
Signed-off-by: Jeff Garzik <>
14 years ago[libata] sata_svw: fix reversed port count
Jeff Garzik [Sat, 12 Apr 2008 04:11:35 +0000 (00:11 -0400)]
[libata] sata_svw: fix reversed port count

According to Broadcom, two chips have their port counts flipped.  The proper
count is:

0x241 is 8 ports
0x242 is 4 ports

Reported by Yohei Honda on kernel bz 10424.

Signed-off-by: Jeff Garzik <>
14 years agoLinux 2.6.25-rc9 v2.6.25-rc9
Linus Torvalds [Fri, 11 Apr 2008 20:32:29 +0000 (13:32 -0700)]
Linux 2.6.25-rc9

14 years agoMerge branch 'docs' of git://
Linus Torvalds [Fri, 11 Apr 2008 20:24:16 +0000 (13:24 -0700)]
Merge branch 'docs' of git://

* 'docs' of git://
  Add additional examples in Documentation/spinlocks.txt
  Move sched-rt-group.txt to scheduler/
  Documentation: move rpc-cache.txt to filesystems/
  Documentation: move nfsroot.txt to filesystems/
  Spell out behavior of atomic_dec_and_lock() in kerneldoc
  Fix a typo in highres.txt
  Fixes to the seq_file document
  Fill out information on patch tags in SubmittingPatches
  Add the seq_file documentation

14 years agoAdd additional examples in Documentation/spinlocks.txt
Mark Fasheh [Thu, 10 Apr 2008 20:55:21 +0000 (13:55 -0700)]
Add additional examples in Documentation/spinlocks.txt

Checkpatch will throw an error if code doesn't use the correct initializers
for static spinlocks:

ERROR: Use of SPIN_LOCK_UNLOCKED is deprecated: see Documentation/spinlocks.txt

This is fine, but Documentation/spinlocks.txt isn't very clear on how to
_use_ the new initializers for static variables. To save people time in the
future, I added two small examples of how to fix old-style static
initializers to be more lockdep friendly.

Signed-off-by: Mark Fasheh <>
Signed-off-by: Jonathan Corbet <>
14 years agoMove sched-rt-group.txt to scheduler/
J. Bruce Fields [Mon, 7 Apr 2008 20:39:38 +0000 (16:39 -0400)]
Move sched-rt-group.txt to scheduler/

Signed-off-by: J. Bruce Fields <>
Signed-off-by: Jonathan Corbet <>
14 years agoDocumentation: move rpc-cache.txt to filesystems/
J. Bruce Fields [Mon, 7 Apr 2008 19:59:04 +0000 (15:59 -0400)]
Documentation: move rpc-cache.txt to filesystems/

This file is nfs-related.  (Maybe Documentation/filesystems/ would
benefit from a separate nfs/ directory at some point.)

Signed-off-by: J. Bruce Fields <>
Signed-off-by: Jonathan Corbet <>
14 years agoDocumentation: move nfsroot.txt to filesystems/
J. Bruce Fields [Mon, 7 Apr 2008 19:59:03 +0000 (15:59 -0400)]
Documentation: move nfsroot.txt to filesystems/

Documentation/ is a little large, and filesystems/ seems an obvious
place for this file.

Signed-off-by: J. Bruce Fields <>
Signed-off-by: Jonathan Corbet <>
14 years agoSpell out behavior of atomic_dec_and_lock() in kerneldoc
J. Bruce Fields [Mon, 7 Apr 2008 19:59:05 +0000 (15:59 -0400)]
Spell out behavior of atomic_dec_and_lock() in kerneldoc

A little more detail here wouldn't hurt.

Signed-off-by: J. Bruce Fields <>
Signed-off-by: Jonathan Corbet <>
14 years agoFix "$(AS) -traditional" compile breakage caused by asmlinkage_protect
Heiko Carstens [Fri, 11 Apr 2008 11:46:54 +0000 (13:46 +0200)]
Fix "$(AS) -traditional" compile breakage caused by asmlinkage_protect

git commit 54a015104136974262afa4b8ddd943ea70dec8a2 ("asmlinkage_protect
replaces prevent_tail_call") causes this build failure on s390:

    AS      arch/s390/kernel/entry64.o
  In file included from arch/s390/kernel/entry64.S:14:
  include/linux/linkage.h:34: error: syntax error in macro parameter list
  make[1]: *** [arch/s390/kernel/entry64.o] Error 1
  make: *** [arch/s390/kernel] Error 2

and some other architectures.  The reason is that some architectures add
the "-traditional" flag to the invocation of $(AS), which disables
variadic macro argument support.

So just surround the new define with an #ifndef __ASSEMBLY__ to prevent
any side effects on asm code.

Cc: Roland McGrath <>
Cc: Martin Schwidefsky <>
Signed-off-by: Heiko Carstens <>
Signed-off-by: Linus Torvalds <>
14 years agoMerge branch 'i2c-for-linus' of git://
Linus Torvalds [Fri, 11 Apr 2008 15:10:51 +0000 (08:10 -0700)]
Merge branch 'i2c-for-linus' of git://

* 'i2c-for-linus' of git://
  i2c-tiny-usb: New VID/PID pair
  i2c-davinci: Fix lost interrupt
  i2c-ibm_iic: Fast mode parm desc fixup

14 years agoMerge git://
Linus Torvalds [Fri, 11 Apr 2008 15:10:24 +0000 (08:10 -0700)]
Merge git://git./linux/kernel/git/davem/net-2.6

* git://
  [NETNS][IPV6] tcp - assign the netns for timewait sockets
  [IPV4]: Fix byte value boundary check in do_ip_getsockopt().
  BNX2X: Correct bringing chip out of reset
  [NETFILTER]: nf_nat: autoload IPv4 connection tracking
  [NETFILTER]: xt_hashlimit: fix mask calculation
  [XFRM]: xfrm_user: fix selector family initialization
  rt61pci: rt61pci_beacon_update do not free skb twice
  ssb-mipscore: Fix interrupt vectors
  ssb-pcicore: Fix IRQ TPS flag handling
  mac80211: use short_preamble mode from capability if ERP IE not present
  [NET]: Undo code bloat in hot paths due to print_mac().
  [TCP]: Don't allow FRTO to take place while MTU is being probed
  [TCP]: tcp_simple_retransmit can cause S+L
  [TCP]: Fix NewReno's fast rexmit/recovery problems with GSOed skb
  [TCP]: Restore 2.6.24 mark_head_lost behavior for newreno/fack
  nl80211: fix STA AID bug
  b43legacy: fix bcm4303 crash
  iwlwifi: fix n-band association problem
  ipw2200: set MAC address on radiotap interface
  libertas: fix mode initialization problem

14 years agoMerge git://
Linus Torvalds [Fri, 11 Apr 2008 15:09:57 +0000 (08:09 -0700)]
Merge git://git./linux/kernel/git/davem/sparc-2.6

* git://
  [SPARC]: Fix several regset and ptrace bugs.

14 years agosignalfd: fix for incorrect SI_QUEUE user data reporting
Davide Libenzi [Fri, 11 Apr 2008 04:29:29 +0000 (21:29 -0700)]
signalfd: fix for incorrect SI_QUEUE user data reporting

Michael Kerrisk found out that signalfd was not reporting back user data
pushed using sigqueue:

The following patch makes signalfd report back the ssi_ptr and ssi_int members
of the signalfd_siginfo structure.

Signed-off-by: Davide Libenzi <>
Acked-by: Michael Kerrisk <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agopnp: increase number of devices supported per protocol
Bjorn Helgaas [Fri, 11 Apr 2008 04:29:28 +0000 (21:29 -0700)]
pnp: increase number of devices supported per protocol

Increase the PNP "number of devices" limit.  We currently use an unsigned
char, which limits us to 256 devices per protocol.  This patch changes that to
an unsigned int.

Not all backends can take advantage of this: we limit ISAPNP to 10 devices in
isapnp_cfg_begin(), and PNPBIOS is limited to 256 devices because the BIOS
interfaces use a one-byte device node number.

But there is no limit on the number of PNPACPI devices we may have.  Large HP
Integrity machines have more than 256, which causes the current "unsigned char
number" to wrap around.  This causes errors like this:

    pnp: PnP ACPI init
    kobject_add failed for 00:00 with -EEXIST, don't try to register things with the same name in the same directory.

    Call Trace:
     [<a000000100010720>] show_stack+0x40/0xa0
     [<a0000001000107b0>] dump_stack+0x30/0x60
     [<a0000001001dbdf0>] kobject_add+0x290/0x2c0
     [<a0000001002bfd40>] device_add+0x160/0x860
     [<a0000001002c0470>] device_register+0x30/0x60
     [<a00000010026ba70>] __pnp_add_device+0x130/0x180
     [<a00000010026bb70>] pnp_add_device+0xb0/0xe0
     [<a0000001007f2730>] pnpacpi_add_device+0x510/0x5a0
     [<a0000001007f2810>] pnpacpi_add_device_handler+0x50/0x80

This patch increases the limit to fix this PNPACPI problem.  It should not
have any adverse effect on ISAPNP or PNPBIOS because their limits are still
enforced in the backends.

Signed-off-by: Bjorn Helgaas <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agomd: close a livelock window in handle_parity_checks5
Dan Williams [Fri, 11 Apr 2008 04:29:27 +0000 (21:29 -0700)]
md: close a livelock window in handle_parity_checks5

If a failure is detected after a parity check operation has been initiated,
but before it completes handle_parity_checks5 will never quiesce operations on
the stripe.

Explicitly handle this case by "canceling" the parity check, i.e.  clear the
STRIPE_OP_CHECK flags and queue the stripe on the handle list again to refresh
any non-uptodate blocks.

Kernel versions >= 2.6.23 are susceptible.

Cc: <>
Cc: NeilBrown <>
Signed-off-by: Dan Williams <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agocciss: error: implicit declaration of function 'sg_init_table'
Mike Pagano [Fri, 11 Apr 2008 04:29:26 +0000 (21:29 -0700)]
cciss: error: implicit declaration of function 'sg_init_table'

This patch adds the missing include directive <linux/scatterlist.h> to the
cciss.c source file.    This was discovered by our release team when building
the kernel for the Alpha architecture.

Errors were found as references to functions 'sg_init_table' and 'sg_page' do
not exist without the include for Alpha.

Signed-off-by: Mike Pagano <>
Cc: Jens Axboe <>
Cc: <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agortc: fix platform driver hotplug/coldplug
Kay Sievers [Fri, 11 Apr 2008 04:29:25 +0000 (21:29 -0700)]
rtc: fix platform driver hotplug/coldplug

Since 43cc71eed1250755986da4c0f9898f9a635cb3bf, the platform modalias is
prefixed with "platform:".  Add MODULE_ALIAS() to the hotpluggable RTC
platform drivers, to re-enable module auto loading.

[ more drivers, minor fix]
Signed-off-by: Kay Sievers <>
Signed-off-by: David Brownell <>
Cc: Greg KH <>
Cc: Alessandro Zummo <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agowatchdog: fix platform driver hotplug/coldplug
Kay Sievers [Fri, 11 Apr 2008 04:29:23 +0000 (21:29 -0700)]
watchdog: fix platform driver hotplug/coldplug

Since 43cc71eed1250755986da4c0f9898f9a635cb3bf, the platform modalias is
prefixed with "platform:".  Add MODULE_ALIAS() to the hotpluggable watchdog
drivers, to re-enable auto loading.

[ more drivers; registration fixes]
Signed-off-by: Kay Sievers <>
Signed-off-by: David Brownell <>
Cc: Wim Van Sebroeck <>
Cc: Greg KH <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agousb host: fix platform driver hotplug/coldplug
Kay Sievers [Fri, 11 Apr 2008 04:29:22 +0000 (21:29 -0700)]
usb host: fix platform driver hotplug/coldplug

Since 43cc71eed1250755986da4c0f9898f9a635cb3bf, the platform modalias is
prefixed with "platform:".  Add MODULE_ALIAS() to the hotpluggable USB HCDs,
to allow re-enable auto loading.

[ more drivers; registration fixes]
Signed-off-by: Kay Sievers <>
Signed-off-by: David Brownell <>
Cc: Greg KH <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agousb gadget: fix platform driver hotplug/coldplug
Kay Sievers [Fri, 11 Apr 2008 04:29:21 +0000 (21:29 -0700)]
usb gadget: fix platform driver hotplug/coldplug

Since 43cc71eed1250755986da4c0f9898f9a635cb3bf, the platform modalias is
prefixed with "platform:".  Add MODULE_ALIAS() to the hotpluggable usb
peripheral drivers, to re-eable module auto loading.

[ registration fixes]
Signed-off-by: Kay Sievers <>
Signed-off-by: David Brownell <>
Cc: Greg KH <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agospi: fix platform driver hotplug/coldplug
Kay Sievers [Fri, 11 Apr 2008 04:29:20 +0000 (21:29 -0700)]
spi: fix platform driver hotplug/coldplug

Since 43cc71eed1250755986da4c0f9898f9a635cb3bf, the platform modalias is
prefixed with "platform:".  Add MODULE_ALIAS() to the hotpluggable SPI
platform drivers, to allow module auto loading.

[ more drivers: registration fixes]
Signed-off-by: Kay Sievers <>
Signed-off-by: David Brownell <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agoeventfd/kaio integration fix
Davide Libenzi [Fri, 11 Apr 2008 04:29:19 +0000 (21:29 -0700)]
eventfd/kaio integration fix

Jeff Roberson discovered a race when using kaio eventfd based notifications.
When it occurs it can lead tomissed wakeups and hung userspace.

This patch fixes the race by moving the notification inside the spinlocked
section of kaio.  The operation is safe since eventfd spinlock and kaio one
are unrelated.

Signed-off-by: Davide Libenzi <>
Cc: Zach Brown <>
Cc: Jeff Roberson <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agortc: rtc-s35390a.c needs the bitreverse library
Randy Dunlap [Fri, 11 Apr 2008 04:29:18 +0000 (21:29 -0700)]
rtc: rtc-s35390a.c needs the bitreverse library

rtc-s35390a uses BITREVERSE functions so it needs to select that config symbol
to ensure that the functions are built.

  drivers/built-in.o: In function `s35390a_set_datetime':
  linux-2.6.25-rc8-git7/drivers/rtc/rtc-s35390a.c:144: undefined reference to `byte_rev_table'
  drivers/built-in.o: In function `s35390a_get_datetime':
  linux-2.6.25-rc8-git7/drivers/rtc/rtc-s35390a.c:163: undefined reference to `byte_rev_table'

Signed-off-by: Randy Dunlap <>
Acked-by: Alessandro Zummo <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agocgroups: include hierarchy ids in /proc/<pid>/cgroup
Paul Menage [Fri, 11 Apr 2008 04:29:16 +0000 (21:29 -0700)]
cgroups: include hierarchy ids in /proc/<pid>/cgroup

Extend the /proc/<pid>/cgroup file to include the appropriate hierarchy ID on
each line.

Currently this ID isn't really needed since a hierarchy can be completely
identified by the set of subsystems bound to it, but this is likely to change
in the near future in order to support stateless subsystems and
merging/rebinding of subsystems.  Getting this change into 2.6.25 reduces the
need for an API change later.

Signed-off-by: Paul Menage <>
Cc: Balbir Singh <>
Cc: Pavel Emelyanov <>
Cc: KAMEZAWA Hiroyuki <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
14 years agoi2c-tiny-usb: New VID/PID pair
Till Harbaum [Fri, 11 Apr 2008 10:07:05 +0000 (12:07 +0200)]
i2c-tiny-usb: New VID/PID pair

I have recently bought some USB PIDs from EZPrototypes for my USB projects
and one will be for the i2c-tiny-usb. I have not yet started to use the new
one in the official i2c-tiny-usb firmware since i think it makes sense to get
the change into the kernel before releasing a modified firmware.

This patch adds support for the EZPrototypes USB vid/pid pair used in later
i2c-tiny-usb firmware versions (avrusb v1.06 and up, usbtiny v2.06 and up).

Signed-off-by: Till Harbaum <>
Signed-off-by: Jean Delvare <>
14 years agoi2c-davinci: Fix lost interrupt
Troy Kisky [Fri, 11 Apr 2008 10:07:05 +0000 (12:07 +0200)]
i2c-davinci: Fix lost interrupt

DAVINCI_I2C_STR_REG is a write 1 to clear register,
so don't use a read/modify/write cycle.

Signed-off-by: Troy Kisky <>
Acked-by: Dirk Behme <>
Signed-off-by: Kevin Hilman <>
Signed-off-by: Jean Delvare <>
14 years agoi2c-ibm_iic: Fast mode parm desc fixup
Paul Mundt [Fri, 11 Apr 2008 10:07:04 +0000 (12:07 +0200)]
i2c-ibm_iic: Fast mode parm desc fixup

Noticed this when grepping for fast mode module params, the i2c-ibm_iic
driver was using a non-existent variable for MODULE_PARM_DESC. Fix it up
to reflect what it's actually supposed to be describing.

Signed-off-by: Paul Mundt <>
Signed-off-by: Jean Delvare <>
14 years ago[NETNS][IPV6] tcp - assign the netns for timewait sockets
Daniel Lezcano [Fri, 11 Apr 2008 03:53:10 +0000 (20:53 -0700)]
[NETNS][IPV6] tcp - assign the netns for timewait sockets

Copy the network namespace from the socket to the timewait socket.

Signed-off-by: Daniel Lezcano <>
Acked-by: Mark Lord <>
Signed-off-by: David S. Miller <>
14 years agoAdd commentary about the new "asmlinkage_protect()" macro
Linus Torvalds [Fri, 11 Apr 2008 00:35:23 +0000 (17:35 -0700)]
Add commentary about the new "asmlinkage_protect()" macro

It's really a pretty ugly thing to need, and some day it will hopefully
be obviated by teaching gcc about the magic calling conventions for the
low-level system call code, but in the meantime we can at least add big
honking comments about why we need these insane and strange macros.

I took my comments from my version of the macro, but I ended up deciding
to just pick Roland's version of the actual code instead (with his
prettier syntax that uses vararg macros).  Thus the previous two commits
that actually implement it.

Signed-off-by: Linus Torvalds <>
14 years agoasmlinkage_protect sys_io_getevents
Roland McGrath [Thu, 10 Apr 2008 22:38:45 +0000 (15:38 -0700)]
asmlinkage_protect sys_io_getevents

Use asmlinkage_protect in sys_io_getevents, because GCC for i386 with
CONFIG_FRAME_POINTER=n can decide to clobber an argument word on the
stack, i.e. the user struct pt_regs.  Here the problem is not a tail
call, but just the compiler's use of the stack when it inlines and
optimizes the body of the called function.  This seems to avoid it.

Signed-off-by: Roland McGrath <>
Signed-off-by: Linus Torvalds <>
14 years agoasmlinkage_protect replaces prevent_tail_call
Roland McGrath [Thu, 10 Apr 2008 22:37:38 +0000 (15:37 -0700)]
asmlinkage_protect replaces prevent_tail_call

The prevent_tail_call() macro works around the problem of the compiler
clobbering argument words on the stack, which for asmlinkage functions
is the caller's (user's) struct pt_regs.  The tail/sibling-call
optimization is not the only way that the compiler can decide to use
stack argument words as scratch space, which we have to prevent.
Other optimizations can do it too.

Until we have new compiler support to make "asmlinkage" binding on the
compiler's own use of the stack argument frame, we have work around all
the manifestations of this issue that crop up.

More cases seem to be prevented by also keeping the incoming argument
variables live at the end of the function.  This makes their original
stack slots attractive places to leave those variables, so the compiler
tends not clobber them for something else.  It's still no guarantee, but
it handles some observed cases that prevent_tail_call() did not.

Signed-off-by: Roland McGrath <>
Signed-off-by: Linus Torvalds <>
14 years agox86: Simplify cpu_idle_wait
Venki Pallipadi [Thu, 10 Apr 2008 16:49:58 +0000 (09:49 -0700)]
x86: Simplify cpu_idle_wait

This patch also resolves hangs on boot:

The bug was causing once-in-few-reboots 10-15 sec wait during boot on
certain laptops.

Earlier commit 40d6a146629b98d8e322b6f9332b182c7cbff3df added
smp_call_function in cpu_idle_wait() to kick cpus that are in tickless
idle.  Looking at cpu_idle_wait code at that time, code seemed to be
over-engineered for a case which is rarely used (while changing idle

Below is a simplified version of cpu_idle_wait, which just makes a dummy
smp_call_function to all cpus, to make them come out of old idle handler
and start using the new idle handler.  It eliminates code in the idle
loop to handle cpu_idle_wait.

Signed-off-by: Venkatesh Pallipadi <>
Signed-off-by: Linus Torvalds <>
14 years agolzo: fix typo in decompressor
Harvey Harrison [Thu, 10 Apr 2008 20:38:23 +0000 (13:38 -0700)]
lzo: fix typo in decompressor

Shift of a LE value seems strange, probably meant to shift the cpu-order
variable as in the prvious section of the switch statement.

Signed-off-by: Harvey Harrison <>
Acked-by: Richard Purdie <>
Signed-off-by: Linus Torvalds <>
14 years agoFRV: Don't make smp_{r, w, }mb() interpolate MEMBAR when CONFIG_SMP=n [try #2]
David Howells [Thu, 10 Apr 2008 15:11:05 +0000 (16:11 +0100)]
FRV: Don't make smp_{r, w, }mb() interpolate MEMBAR when CONFIG_SMP=n [try #2]

Don't make smp_{r,w,}mb() interpolate a MEMBAR instruction when CONFIG_SMP=n as
SMP memory barries on UP systems should interpolate a compiler barrier only.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agoFRV: Make NOMMU-mode work with base addresses other than 0xC0000000 [try #2]
David Howells [Thu, 10 Apr 2008 15:11:00 +0000 (16:11 +0100)]
FRV: Make NOMMU-mode work with base addresses other than 0xC0000000 [try #2]

Make NOMMU-mode work with base addresses other than 0xC0000000 by:

 (1) Giving the code that sets up the protection registers the right address
     in __sdram_base.  Rather than being hard coded to 0xC0000000, the value
     of __page_offset is obtained from the linker script.

 (2) Eliminate the check in __switch_to() that verifies the current thread
     info is in the 0xCxxxxxxx region.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agoFRV: Add support for emulation of userspace atomic ops [try #2]
David Howells [Thu, 10 Apr 2008 15:10:55 +0000 (16:10 +0100)]
FRV: Add support for emulation of userspace atomic ops [try #2]

Use traps 120-126 to emulate atomic cmpxchg32, xchg32, and XOR-, OR-, AND-, SUB-
and ADD-to-memory operations for userspace.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agoFRV: Move STACK_TOP_MAX up [try #2]
David Howells [Thu, 10 Apr 2008 15:10:50 +0000 (16:10 +0100)]
FRV: Move STACK_TOP_MAX up [try #2]

Move STACK_TOP_MAX up so that we don't try moving the stack above it as that
causes setup_arg_pages() to malfunction.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agoFRV: Handle update_mmu_cache() being called when current->mm is NULL [try #2]
David Howells [Thu, 10 Apr 2008 15:10:45 +0000 (16:10 +0100)]
FRV: Handle update_mmu_cache() being called when current->mm is NULL [try #2]

Handle update_mmu_cache() being called when current->mm is NULL.

We cache static TLB mappings for the current page table in DAMPR4 and DAMPR5
on the theory that the next data lookup is likely to be in the same general
region, and thus is likely to be mapped by the same page table.  However, we
can't get this information if we can't access the appropriate mm_struct.

If current->mm is NULL, we just clear the cache in the knowledge that the TLB
miss handlers will load it.

Signed-off-by: David Howells <>
Signed-off-by: Linus Torvalds <>
14 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 10 Apr 2008 20:39:29 +0000 (13:39 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  [XFS] Ensure "both" features2 slots are consistent
  [XFS] Fix superblock features2 field alignment problem
  [XFS] remove shouting-indirection macros from xfs_sb.h

14 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 10 Apr 2008 20:39:07 +0000 (13:39 -0700)]
Merge branch 'for-linus' of git://

* 'for-linus' of git://
  cfq-iosched: do not leak ioc_data across iosched switches
  splice: fix infinite loop in generic_file_splice_read()

14 years agoHFS+: fix unlink of links
Roman Zippel [Wed, 9 Apr 2008 15:44:07 +0000 (17:44 +0200)]
HFS+: fix unlink of links

Some time ago while attempting to handle invalid link counts, I botched
the unlink of links itself, so this patch fixes this now correctly, so
that only the link count of nodes that don't point to links is ignored.
Thanks to Vlado Plaga <> to notify me of this

Signed-off-by: Roman Zippel <>
Signed-off-by: Linus Torvalds <>
14 years ago[IPV4]: Fix byte value boundary check in do_ip_getsockopt().
David S. Miller [Thu, 10 Apr 2008 08:29:36 +0000 (01:29 -0700)]
[IPV4]: Fix byte value boundary check in do_ip_getsockopt().

This fixes kernel bugzilla 10371.

As reported by, if we try to grab a
char sized socket option value, as in:

  unsigned char ttl = 255;
  socklen_t     len = sizeof(ttl);
  setsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);

  getsockopt(socket, IPPROTO_IP, IP_MULTICAST_TTL, &ttl, &len);

The ttl returned will be wrong on big-endian, and on both little-
endian and big-endian the next three bytes in userspace are written
with garbage.

It's because of this test in do_ip_getsockopt():

if (len < sizeof(int) && len > 0 && val>=0 && val<255) {

It should allow a 'val' of 255 to pass here, but it doesn't so it
copies a full 'int' back to userspace.

On little-endian that will write the correct value into the location
but it spams on the next three bytes in userspace.  On big endian it
writes the wrong value into the location and spams the next three

Signed-off-by: David S. Miller <>
14 years agocfq-iosched: do not leak ioc_data across iosched switches
Fabio Checconi [Thu, 10 Apr 2008 06:28:01 +0000 (08:28 +0200)]
cfq-iosched: do not leak ioc_data across iosched switches

When switching scheduler from cfq, cfq_exit_queue() does not clear
ioc->ioc_data, leaving a dangling pointer that can deceive the following
lookups when the iosched is switched back to cfq.  The pattern that can
trigger that is the following:

    - elevator switch from cfq to something else;
    - module unloading, with elv_unregister() that calls cfq_free_io_context()
      on ioc freeing the cic (via the .trim op);
    - module gets reloaded and the elevator switches back to cfq;
    - reallocation of a cic at the same address as before (with a valid key).

To fix it just assign NULL to ioc_data in __cfq_exit_single_io_context(),
that is called from the regular exit path and from the elevator switching
code.  The only path that frees a cic and is not covered is the error handling
one, but cic's freed in this way are never cached in ioc_data.

Signed-off-by: Fabio Checconi <>
Signed-off-by: Jens Axboe <>
14 years ago[XFS] Ensure "both" features2 slots are consistent
Eric Sandeen [Thu, 10 Apr 2008 02:19:34 +0000 (12:19 +1000)]
[XFS] Ensure "both" features2 slots are consistent

Since older kernels may look in the sb_bad_features2 slot for flags,
rather than zeroing it out on fixup, we should make it equal to the
sb_features2 value.

Also, if the ATTR2 flag was not found prior to features2 fixup, it was not
set in the mount flags, so re-check after the fixup so that the current
session will use the feature.

Also fix up the comments to reflect these changes.

SGI-PV: 980085
SGI-Modid: xfs-linux-melb:xfs-kern:30778a

Signed-off-by: Eric Sandeen <>
Signed-off-by: David Chinner <>
Signed-off-by: Lachlan McIlroy <>
14 years ago[XFS] Fix superblock features2 field alignment problem
David Chinner [Thu, 6 Mar 2008 02:45:50 +0000 (13:45 +1100)]
[XFS] Fix superblock features2 field alignment problem

Due to the xfs_dsb_t structure not being 64 bit aligned, the last field of
the on-disk superblock can vary in location This causes problems when the
filesystem gets moved to a different platform, or there is a 32 bit
userspace and 64 bit kernel.

This patch detects the defect at mount time, logs a warning such as:

XFS: correcting sb_features alignment problem

in dmesg and corrects the problem so that everything is OK. it also
blacklists the bad field in the superblock so it does not get used for
something else later on.

SGI-PV: 977636
SGI-Modid: xfs-linux-melb:xfs-kern:30539a

Signed-off-by: David Chinner <>
Signed-off-by: Christoph Hellwig <>
Signed-off-by: Eric Sandeen <>
Signed-off-by: Lachlan McIlroy <>
14 years ago[XFS] remove shouting-indirection macros from xfs_sb.h
Eric Sandeen [Thu, 6 Mar 2008 02:44:28 +0000 (13:44 +1100)]
[XFS] remove shouting-indirection macros from xfs_sb.h

Remove macro-to-small-function indirection from xfs_sb.h, and remove some
which are completely unused.

SGI-PV: 976035
SGI-Modid: xfs-linux-melb:xfs-kern:30528a

Signed-off-by: Eric Sandeen <>
Signed-off-by: Donald Douwsma <>
Signed-off-by: Lachlan McIlroy <>
14 years agosplice: fix infinite loop in generic_file_splice_read()
Jens Axboe [Thu, 10 Apr 2008 06:24:25 +0000 (08:24 +0200)]
splice: fix infinite loop in generic_file_splice_read()

There's a quirky loop in generic_file_splice_read() that could go
on indefinitely, if the file splice returns 0 permanently (and not
just as a temporary condition). Get rid of the loop and pass
back -EAGAIN correctly from __generic_file_splice_read(), so we
handle that condition properly as well.

Signed-off-by: Jens Axboe <>
14 years ago[SPARC]: Fix several regset and ptrace bugs.
David S. Miller [Thu, 10 Apr 2008 02:39:25 +0000 (19:39 -0700)]
[SPARC]: Fix several regset and ptrace bugs.

1) ptrace should pass 'current' to task_user_regset_view()

2) When fetching general registers using a 64-bit view, and
   the target is 32-bit, we have to convert.

3) Skip the whole register window get/set code block if
   the user isn't asking to access anything in there.

   Otherwise we have problems if the user doesn't have
   an address space setup.  Fetching ptrace register is
   still valid at such a time, and ptrace does not try
   to access the register window area of the regset.

Signed-off-by: David S. Miller <>
14 years agopop previous section in alternative.c
Steven Rostedt [Wed, 9 Apr 2008 23:04:07 +0000 (19:04 -0400)]
pop previous section in alternative.c

gcc expects all toplevel assembly to return to the original section type.
The code in alteranative.c does not do this. This caused some strange bugs
in sched-devel where code would end up in the .rodata section and when
the kernel sets the NX bit on all .rodata, the kernel would crash when
executing this code.

This patch adds a .previous marker to return the code back to the
original section.

Credit goes to Andrew Pinski for telling me it wasn't a gcc bug but a
bug in the toplevel asm code in the kernel.  ;-)

Signed-off-by: Steven Rostedt <>
Signed-off-by: Linus Torvalds <>
14 years agoMerge branch 'for-linus' of git://
Linus Torvalds [Thu, 10 Apr 2008 01:36:12 +0000 (18:36 -0700)]
Merge branch 'for-linus' of git://git./linux/kernel/git/jmorris/selinux-2.6

* 'for-linus' of git://
  SELinux: don't BUG if fs reuses a superblock

14 years agoSELinux: don't BUG if fs reuses a superblock
Eric Paris [Wed, 9 Apr 2008 18:08:35 +0000 (14:08 -0400)]
SELinux: don't BUG if fs reuses a superblock

I (wrongly) assumed that nfs_xdev_get_sb() would not ever share a superblock
and so cloning mount options would always be correct.  Turns out that isn't
the case and we could fall over a BUG_ON() that wasn't a BUG at all.  Since
there is little we can do to reconcile different mount options this patch
just leaves the sb alone and the first set of options wins.

Signed-off-by: Eric Paris <>
Acked-by: Stephen Smalley <>
Acked-by: Trond Myklebust <>
Signed-off-by: James Morris <>
14 years agoBNX2X: Correct bringing chip out of reset
Eliezer Tamir [Wed, 9 Apr 2008 22:25:46 +0000 (15:25 -0700)]
BNX2X: Correct bringing chip out of reset

Fixed bug: Wrong register was written to when bringing the chip out of

[ Bump driver version and release date -DaveM ]

Signed-off-by: Eliezer Tamir <>
Signed-off-by: David S. Miller <>
14 years ago[NETFILTER]: nf_nat: autoload IPv4 connection tracking
Jan Engelhardt [Wed, 9 Apr 2008 22:14:58 +0000 (15:14 -0700)]
[NETFILTER]: nf_nat: autoload IPv4 connection tracking

Without this patch, the generic L3 tracker would kick in
if nf_conntrack_ipv4 was not loaded before nf_nat, which
would lead to translation problems with ICMP errors.

NAT does not make sense without IPv4 connection tracking
anyway, so just add a call to need_ipv4_conntrack().

Signed-off-by: Jan Engelhardt <>
Signed-off-by: Patrick McHardy <>
Signed-off-by: David S. Miller <>