[patch 079/101] RPM: fix double free in portmapper code

2007-03-07 Thread Greg KH

From: Trond Myklebust [EMAIL PROTECTED]

rpc_run_task is guaranteed to always call -rpc_release.

Signed-off-by: Trond Myklebust [EMAIL PROTECTED]
Cc: Neil Brown [EMAIL PROTECTED]
Cc: Jan Yenya Kasprzak [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 net/sunrpc/pmap_clnt.c |8 +---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/net/sunrpc/pmap_clnt.c
+++ linux-2.6.20.1/net/sunrpc/pmap_clnt.c
@@ -62,7 +62,10 @@ static inline void pmap_map_free(struct 
 
 static void pmap_map_release(void *data)
 {
-   pmap_map_free(data);
+   struct portmap_args *map = data;
+
+   xprt_put(map-pm_xprt);
+   pmap_map_free(map);
 }
 
 static const struct rpc_call_ops pmap_getport_ops = {
@@ -133,7 +136,7 @@ void rpc_getport(struct rpc_task *task)
status = -EIO;
child = rpc_run_task(pmap_clnt, RPC_TASK_ASYNC, pmap_getport_ops, map);
if (IS_ERR(child))
-   goto bailout;
+   goto bailout_nofree;
rpc_put_task(child);
 
task-tk_xprt-stat.bind_count++;
@@ -222,7 +225,6 @@ static void pmap_getport_done(struct rpc
child-tk_pid, status, map-pm_port);
 
pmap_wake_portmap_waiters(xprt, status);
-   xprt_put(xprt);
 }
 
 /**

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 080/101] NLM: Fix double free in __nlm_async_call

2007-03-07 Thread Greg KH

From: Trond Myklebust [EMAIL PROTECTED]

rpc_call_async() will always call rpc_release_calldata(), so it is an
error for __nlm_async_call() to do so as well.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=7923

Signed-off-by: Trond Myklebust [EMAIL PROTECTED]
Cc: Jan Yenya Kasprzak [EMAIL PROTECTED]
Cc: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 fs/lockd/clntproc.c |9 +++--
 fs/lockd/svclock.c  |4 +---
 2 files changed, 4 insertions(+), 9 deletions(-)

--- linux-2.6.20.1.orig/fs/lockd/clntproc.c
+++ linux-2.6.20.1/fs/lockd/clntproc.c
@@ -361,7 +361,6 @@ static int __nlm_async_call(struct nlm_r
 {
struct nlm_host *host = req-a_host;
struct rpc_clnt *clnt;
-   int status = -ENOLCK;
 
dprintk(lockd: call procedure %d on %s (async)\n,
(int)proc, host-h_name);
@@ -373,12 +372,10 @@ static int __nlm_async_call(struct nlm_r
msg-rpc_proc = clnt-cl_procinfo[proc];
 
 /* bootstrap and kick off the async RPC call */
-status = rpc_call_async(clnt, msg, RPC_TASK_ASYNC, tk_ops, req);
-   if (status == 0)
-   return 0;
+return rpc_call_async(clnt, msg, RPC_TASK_ASYNC, tk_ops, req);
 out_err:
-   nlm_release_call(req);
-   return status;
+   tk_ops-rpc_release(req);
+   return -ENOLCK;
 }
 
 int nlm_async_call(struct nlm_rqst *req, u32 proc, const struct rpc_call_ops 
*tk_ops)
--- linux-2.6.20.1.orig/fs/lockd/svclock.c
+++ linux-2.6.20.1/fs/lockd/svclock.c
@@ -593,9 +593,7 @@ callback:
 
/* Call the client */
kref_get(block-b_count);
-   if (nlm_async_call(block-b_call, NLMPROC_GRANTED_MSG,
-   nlmsvc_grant_ops)  0)
-   nlmsvc_release_block(block);
+   nlm_async_call(block-b_call, NLMPROC_GRANTED_MSG, nlmsvc_grant_ops);
 }
 
 /*

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 074/101] tty_io: fix race in master pty close/slave pty close path

2007-03-07 Thread Greg KH
From: Aristeu Sergio Rozanski Filho [EMAIL PROTECTED]

[PATCH] tty_io: fix race in master pty close/slave pty close path

This patch fixes a possible race that leads to double freeing an idr index.
 When the master begin to close, release_dev() is called and then
pty_close() is called:

if (tty-driver-close)
tty-driver-close(tty, filp);

This is done without helding any locks other than BKL.  Inside pty_close(),
being a master close, the devpts entry will be removed:

#ifdef CONFIG_UNIX98_PTYS
if (tty-driver == ptm_driver)
devpts_pty_kill(tty-index);
#endif

But devpts_pty_kill() will call get_node() that may sleep while waiting for
devpts_root-d_inode-i_sem.  When this happens and the slave is being
opened, tty_open() just found the driver and index:

driver = get_tty_driver(device, index);
if (!driver) {
mutex_unlock(tty_mutex);
return -ENODEV;
}

This part of the code is already protected under tty_mute.  The problem is
that the slave close already got an index.  Then init_dev() is called and
blocks waiting for the same devpts_root-d_inode-i_sem.

When the master close resumes, it removes the devpts entry, and the
relation between idr index and the tty is gone.  The master then sleeps
waiting for the tty_mutex on release_dev().

Slave open resumes and found no tty for that index.  As result, a NULL tty
is returned and init_dev() doesn't flow to fast_track:

/* check whether we're reopening an existing tty */
if (driver-flags  TTY_DRIVER_DEVPTS_MEM) {
tty = devpts_get_tty(idx);
if (tty  driver-subtype == PTY_TYPE_MASTER)
tty = tty-link;
} else {
tty = driver-ttys[idx];
}
if (tty) goto fast_track;

The result of this, is that a new tty will be created and init_dev() returns
sucessfull. After returning, tty_mutex is dropped and master close may resume.

Master close finds it's the only use and both sides are closing, then releases
the tty and the index. At this point, the idr index is free, but slave still
has it.

Slave open then calls pty_open() and finds that tty-link-count is 0,
because there's no master and returns error.  Then tty_open() calls
release_dev() which executes without any warning, as it was a case of last
slave close when the master is already closed (master-count == 0,
slave-count == 1).  The tty is then released with the already released idr
index.

This normally would only issue a warning on idr_remove() but in case of a
customer's critical application, it's never too simple:

thread1: opens master, gets index X
thread1: begin closing master
thread2: begin opening slave with index X
thread1: finishes closing master, index X released
thread3: opens master, gets index X, just released
thread2: fails opening slave, releases index X 
thread4: opens master, gets index X, init_dev() then find an already in use
 and healthy tty and fails

If no more indexes are released, ptmx_open() will keep failing, as the
first free index available is X, and it will make init_dev() fail because
you're trying to reopen a master which isn't valid.

The patch notices when this race happens and make init_dev() fail
imediately.  The init_dev() function is called with tty_mutex held, so it's
safe to continue with tty till the end of function because release_dev()
won't make any further changes without grabbing the tty_mutex.

Without the patch, on some machines it's possible get easily idr warnings
like this one:

idr_remove called for id=15 which is not allocated.
 [c02555b9] idr_remove+0x139/0x170
 [c02a1b62] release_mem+0x182/0x230
 [c02a28e7] release_dev+0x4b7/0x700
 [c02a0ea7] tty_ldisc_enable+0x27/0x30
 [c02a1e64] init_dev+0x254/0x580
 [c02a0d64] check_tty_count+0x14/0xb0
 [c02a4f05] tty_open+0x1c5/0x340
 [c02a4d40] tty_open+0x0/0x340
 [c017388f] chrdev_open+0xaf/0x180
 [c017c2ac] open_namei+0x8c/0x760
 [c01737e0] chrdev_open+0x0/0x180
 [c0167bc9] __dentry_open+0xc9/0x210
 [c0167e2c] do_filp_open+0x5c/0x70
 [c0167a91] get_unused_fd+0x61/0xd0
 [c0167e93] do_sys_open+0x53/0x100
 [c0167f97] sys_open+0x27/0x30
 [c010303b] syscall_call+0x7/0xb

using this test application available on:
 http://www.ruivo.org/~aris/pty_sodomizer.c

Signed-off-by: Aristeu Sergio Rozanski Filho [EMAIL PROTECTED]
Cc: H. Peter Anvin [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/char/tty_io.c |   14 ++
 1 file changed, 14 insertions(+)

--- linux-2.6.20.1.orig/drivers/char/tty_io.c
+++ linux-2.6.20.1/drivers/char/tty_io.c
@@ -1891,6 +1891,20 @@ static int init_dev(struct tty_driver *d
/* check whether we're reopening an existing tty */
if (driver-flags  TTY_DRIVER_DEVPTS_MEM) {

[patch 083/101] ufs: restore back support of openstep

2007-03-07 Thread Greg KH

From: Evgeniy Dushistov [EMAIL PROTECTED]

This is a fix of regression, which triggered by ~2.6.16.

Patch with name ufs-directory-and-page-cache-from-blocks-to-pages.patch: in
additional to conversation from block to page cache mechanism added new
checks of directory integrity, one of them that directory entry do not
across directory chunks.

But some kinds of UFS: OpenStep UFS and Apple UFS (looks like these are the
same filesystems) have different directory chunk size, then common
UFSes(BSD and Solaris UFS).

So this patch adds ability to works with variable size of directory chunks,
and set it for ufstype=openstep to right size.

Tested on darwin ufs.

Signed-off-by: Evgeniy Dushistov [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 fs/ufs/dir.c   |   21 -
 fs/ufs/super.c |5 -
 include/linux/ufs_fs.h |1 +
 3 files changed, 17 insertions(+), 10 deletions(-)

--- linux-2.6.20.1.orig/fs/ufs/dir.c
+++ linux-2.6.20.1/fs/ufs/dir.c
@@ -106,12 +106,13 @@ static void ufs_check_page(struct page *
char *kaddr = page_address(page);
unsigned offs, rec_len;
unsigned limit = PAGE_CACHE_SIZE;
+   const unsigned chunk_mask = UFS_SB(sb)-s_uspi-s_dirblksize - 1;
struct ufs_dir_entry *p;
char *error;
 
if ((dir-i_size  PAGE_CACHE_SHIFT) == page-index) {
limit = dir-i_size  ~PAGE_CACHE_MASK;
-   if (limit  (UFS_SECTOR_SIZE - 1))
+   if (limit  chunk_mask)
goto Ebadsize;
if (!limit)
goto out;
@@ -126,7 +127,7 @@ static void ufs_check_page(struct page *
goto Ealign;
if (rec_len  UFS_DIR_REC_LEN(ufs_get_de_namlen(sb, p)))
goto Enamelen;
-   if (((offs + rec_len - 1) ^ offs)  ~(UFS_SECTOR_SIZE-1))
+   if (((offs + rec_len - 1) ^ offs)  ~chunk_mask)
goto Espan;
if (fs32_to_cpu(sb, p-d_ino)  (UFS_SB(sb)-s_uspi-s_ipg *
  UFS_SB(sb)-s_uspi-s_ncg))
@@ -310,6 +311,7 @@ int ufs_add_link(struct dentry *dentry, 
int namelen = dentry-d_name.len;
struct super_block *sb = dir-i_sb;
unsigned reclen = UFS_DIR_REC_LEN(namelen);
+   const unsigned int chunk_size = UFS_SB(sb)-s_uspi-s_dirblksize;
unsigned short rec_len, name_len;
struct page *page = NULL;
struct ufs_dir_entry *de;
@@ -342,8 +344,8 @@ int ufs_add_link(struct dentry *dentry, 
if ((char *)de == dir_end) {
/* We hit i_size */
name_len = 0;
-   rec_len = UFS_SECTOR_SIZE;
-   de-d_reclen = cpu_to_fs16(sb, UFS_SECTOR_SIZE);
+   rec_len = chunk_size;
+   de-d_reclen = cpu_to_fs16(sb, chunk_size);
de-d_ino = 0;
goto got_it;
}
@@ -431,7 +433,7 @@ ufs_readdir(struct file *filp, void *dir
unsigned int offset = pos  ~PAGE_CACHE_MASK;
unsigned long n = pos  PAGE_CACHE_SHIFT;
unsigned long npages = ufs_dir_pages(inode);
-   unsigned chunk_mask = ~(UFS_SECTOR_SIZE - 1);
+   unsigned chunk_mask = ~(UFS_SB(sb)-s_uspi-s_dirblksize - 1);
int need_revalidate = filp-f_version != inode-i_version;
unsigned flags = UFS_SB(sb)-s_flags;
 
@@ -511,7 +513,7 @@ int ufs_delete_entry(struct inode *inode
struct super_block *sb = inode-i_sb;
struct address_space *mapping = page-mapping;
char *kaddr = page_address(page);
-   unsigned from = ((char*)dir - kaddr)  ~(UFS_SECTOR_SIZE - 1);
+   unsigned from = ((char*)dir - kaddr)  
~(UFS_SB(sb)-s_uspi-s_dirblksize - 1);
unsigned to = ((char*)dir - kaddr) + fs16_to_cpu(sb, dir-d_reclen);
struct ufs_dir_entry *pde = NULL;
struct ufs_dir_entry *de = (struct ufs_dir_entry *) (kaddr + from);
@@ -556,6 +558,7 @@ int ufs_make_empty(struct inode * inode,
struct super_block * sb = dir-i_sb;
struct address_space *mapping = inode-i_mapping;
struct page *page = grab_cache_page(mapping, 0);
+   const unsigned int chunk_size = UFS_SB(sb)-s_uspi-s_dirblksize;
struct ufs_dir_entry * de;
char *base;
int err;
@@ -563,7 +566,7 @@ int ufs_make_empty(struct inode * inode,
if (!page)
return -ENOMEM;
kmap(page);
-   err = mapping-a_ops-prepare_write(NULL, page, 0, UFS_SECTOR_SIZE);
+   err = mapping-a_ops-prepare_write(NULL, page, 0, chunk_size);
if (err) {
unlock_page(page);
goto fail;
@@ -584,11 +587,11 @@ int ufs_make_empty(struct inode * inode,
((char *)de 

[patch 067/101] Fix %100 cpu spinning on sparc64

2007-03-07 Thread Greg KH
From: David Miller [EMAIL PROTECTED]

[SPARC64] bbc_i2c: Fix kenvctrld eating %100 cpu.

Based almost entirely upon a patch by Joerg Friedrich

Signed-off-by: David S. Miller [EMAIL PROTECTED]

---
 drivers/sbus/char/bbc_i2c.c |   15 ---
 1 file changed, 8 insertions(+), 7 deletions(-)

--- linux-2.6.20.1.orig/drivers/sbus/char/bbc_i2c.c
+++ linux-2.6.20.1/drivers/sbus/char/bbc_i2c.c
@@ -187,19 +187,20 @@ static int wait_for_pin(struct bbc_i2c_b
bp-waiting = 1;
add_wait_queue(bp-wq, wait);
while (limit--  0) {
-   u8 val;
+   unsigned long val;
 
-   set_current_state(TASK_INTERRUPTIBLE);
-   *status = val = readb(bp-i2c_control_regs + 0);
-   if ((val  I2C_PCF_PIN) == 0) {
+   val = wait_event_interruptible_timeout(
+   bp-wq,
+   (((*status = readb(bp-i2c_control_regs + 0))
+  I2C_PCF_PIN) == 0),
+   msecs_to_jiffies(250));
+   if (val  0) {
ret = 0;
break;
}
-   msleep_interruptible(250);
}
remove_wait_queue(bp-wq, wait);
bp-waiting = 0;
-   current-state = TASK_RUNNING;
 
return ret;
 }
@@ -340,7 +341,7 @@ static irqreturn_t bbc_i2c_interrupt(int
 */
if (bp-waiting 
!(readb(bp-i2c_control_regs + 0x0)  I2C_PCF_PIN))
-   wake_up(bp-wq);
+   wake_up_interruptible(bp-wq);
 
return IRQ_HANDLED;
 }

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 068/101] Fix TCP MD5 locking.

2007-03-07 Thread Greg KH
From: David Miller [EMAIL PROTECTED]

[TCP]: Fix MD5 signature pool locking.

The locking calls assumed that these code paths were only
invoked in software interrupt context, but that isn't true.

Therefore we need to use spin_{lock,unlock}_bh() throughout.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/tcp.c |   24 
 1 file changed, 12 insertions(+), 12 deletions(-)

--- linux-2.6.20.1.orig/net/ipv4/tcp.c
+++ linux-2.6.20.1/net/ipv4/tcp.c
@@ -2266,12 +2266,12 @@ void tcp_free_md5sig_pool(void)
 {
struct tcp_md5sig_pool **pool = NULL;
 
-   spin_lock(tcp_md5sig_pool_lock);
+   spin_lock_bh(tcp_md5sig_pool_lock);
if (--tcp_md5sig_users == 0) {
pool = tcp_md5sig_pool;
tcp_md5sig_pool = NULL;
}
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
if (pool)
__tcp_free_md5sig_pool(pool);
 }
@@ -2314,36 +2314,36 @@ struct tcp_md5sig_pool **tcp_alloc_md5si
int alloc = 0;
 
 retry:
-   spin_lock(tcp_md5sig_pool_lock);
+   spin_lock_bh(tcp_md5sig_pool_lock);
pool = tcp_md5sig_pool;
if (tcp_md5sig_users++ == 0) {
alloc = 1;
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
} else if (!pool) {
tcp_md5sig_users--;
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
cpu_relax();
goto retry;
} else
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
 
if (alloc) {
/* we cannot hold spinlock here because this may sleep. */
struct tcp_md5sig_pool **p = __tcp_alloc_md5sig_pool();
-   spin_lock(tcp_md5sig_pool_lock);
+   spin_lock_bh(tcp_md5sig_pool_lock);
if (!p) {
tcp_md5sig_users--;
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
return NULL;
}
pool = tcp_md5sig_pool;
if (pool) {
/* oops, it has already been assigned. */
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
__tcp_free_md5sig_pool(p);
} else {
tcp_md5sig_pool = pool = p;
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
}
}
return pool;
@@ -2354,11 +2354,11 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 struct tcp_md5sig_pool *__tcp_get_md5sig_pool(int cpu)
 {
struct tcp_md5sig_pool **p;
-   spin_lock(tcp_md5sig_pool_lock);
+   spin_lock_bh(tcp_md5sig_pool_lock);
p = tcp_md5sig_pool;
if (p)
tcp_md5sig_users++;
-   spin_unlock(tcp_md5sig_pool_lock);
+   spin_unlock_bh(tcp_md5sig_pool_lock);
return (p ? *per_cpu_ptr(p, cpu) : NULL);
 }
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 075/101] sched: fix SMT scheduler bug

2007-03-07 Thread Greg KH
From: Ingo Molnar [EMAIL PROTECTED]

[PATCH] sched: fix SMT scheduler bug

The SMT scheduler incorrectly skips kernel threads even if they are
runnable (but they are preempted by a higher-prio user-space task which got
SMT-delayed by an even higher-priority task running on a sibling CPU).

Fix this for now by only doing the SMT-nice optimization if the
to-be-delayed task is the only runnable task.  (This should cover most of
the real-life cases anyway.)

This bug has been in the SMT scheduler since 2.6.17 or so, but has only
been noticed now by the active check in the dynticks code.

Signed-off-by: Ingo Molnar [EMAIL PROTECTED]
Cc: Michal Piotrowski [EMAIL PROTECTED]
Cc: Nick Piggin [EMAIL PROTECTED]
Cc: Thomas Gleixner [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]

---
 kernel/sched.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/kernel/sched.c
+++ linux-2.6.20.1/kernel/sched.c
@@ -3528,7 +3528,7 @@ need_resched_nonpreemptible:
}
}
next-sleep_type = SLEEP_NORMAL;
-   if (dependent_sleeper(cpu, rq, next))
+   if (rq-nr_running == 1  dependent_sleeper(cpu, rq, next))
next = rq-idle;
 switch_tasks:
if (next == rq-idle)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 070/101] Fix anycast procfs device leak

2007-03-07 Thread Greg KH
From: David Stevens [EMAIL PROTECTED]

[IPV6]: /proc/net/anycast6 unbalanced inet6_dev refcnt

From: David Stevens [EMAIL PROTECTED]

Reading /proc/net/anycast6 when there is no anycast address
on an interface results in an ever-increasing inet6_dev reference
count, as well as a reference to the netdevice you can't get rid of.

From: David Stevens [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv6/anycast.c |1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.20.1.orig/net/ipv6/anycast.c
+++ linux-2.6.20.1/net/ipv6/anycast.c
@@ -462,6 +462,7 @@ static inline struct ifacaddr6 *ac6_get_
break;
}
read_unlock_bh(idev-lock);
+   in6_dev_put(idev);
}
return im;
 }

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 071/101] Fix reference counting (memory leak) problem in __nfulnl_send() and callers related to packet queueing.

2007-03-07 Thread Greg KH
Signed-off-by: Michał Mirosław [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/netfilter/nfnetlink_log.c |   15 ---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/net/netfilter/nfnetlink_log.c
+++ linux-2.6.20.1/net/netfilter/nfnetlink_log.c
@@ -217,6 +217,11 @@ _instance_destroy2(struct nfulnl_instanc
 
spin_lock_bh(inst-lock);
if (inst-skb) {
+   /* timer holds one reference (we have one more) */
+   if (timer_pending(inst-timer)) {
+   del_timer(inst-timer);
+   instance_put(inst);
+   }
if (inst-qlen)
__nfulnl_send(inst);
if (inst-skb) {
@@ -363,9 +368,6 @@ __nfulnl_send(struct nfulnl_instance *in
 {
int status;
 
-   if (timer_pending(inst-timer))
-   del_timer(inst-timer);
-
if (!inst-skb)
return 0;
 
@@ -392,6 +394,8 @@ static void nfulnl_timer(unsigned long d
UDEBUG(timer function called, flushing buffer\n);
 
spin_lock_bh(inst-lock);
+   if (timer_pending(inst-timer))/* is it always true or false 
here? */
+   del_timer(inst-timer);
__nfulnl_send(inst);
instance_put(inst);
spin_unlock_bh(inst-lock);
@@ -689,6 +693,11 @@ nfulnl_log_packet(unsigned int pf,
 * enough room in the skb left. flush to userspace. */
UDEBUG(flushing old skb\n);
 
+   /* timer holds one reference (we have another one) */
+   if (timer_pending(inst-timer)) {
+   del_timer(inst-timer);
+   instance_put(inst);
+   }
__nfulnl_send(inst);
 
if (!(inst-skb = nfulnl_alloc_skb(nlbufsiz, size))) {

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 073/101] forcedeth: disable msix

2007-03-07 Thread Greg KH
From: Ayaz Abdulla [EMAIL PROTECTED]

forcedeth: disable msix

There seems to be an issue when both MSI-X is enabled and NAPI is
configured. This patch disables MSI-X until the issue is root caused.

Signed-off-by: Ayaz Abdulla [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/forcedeth.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/net/forcedeth.c
+++ linux-2.6.20.1/drivers/net/forcedeth.c
@@ -825,7 +825,7 @@ enum {
NV_MSIX_INT_DISABLED,
NV_MSIX_INT_ENABLED
 };
-static int msix = NV_MSIX_INT_ENABLED;
+static int msix = NV_MSIX_INT_DISABLED;
 
 /*
  * DMA 64bit

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 072/101] export blk_recount_segments

2007-03-07 Thread Greg KH
On Monday February 12, [EMAIL PROTECTED] wrote:
  
  Thanks for the quick response Neil unfortunately the kernel doesn't build 
  with
  this patch due to a missing symbol:
  
  WARNING: blk_recount_segments [drivers/md/raid456.ko] undefined!
  
  Is that in another file that needs patching or within raid5.c?

Yes.  I keep forgetting about that bit. Sorry.

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 block/ll_rw_blk.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/block/ll_rw_blk.c
+++ linux-2.6.20.1/block/ll_rw_blk.c
@@ -1264,7 +1264,7 @@ new_hw_segment:
bio-bi_hw_segments = nr_hw_segs;
bio-bi_flags |= (1  BIO_SEG_VALID);
 }
-
+EXPORT_SYMBOL(blk_recount_segments);
 
 static int blk_phys_contig_segment(request_queue_t *q, struct bio *bio,
   struct bio *nxt)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 054/101] swsusp: Fix possible oops in userland interface

2007-03-07 Thread Greg KH
From: Stefan Seyfried [EMAIL PROTECTED]

Fix the Oops occuring when SNAPSHOT_PMOPS or SNAPSHOT_S2RAM ioctl is called on
a system without pm_ops defined (eg. a non-ACPI kernel on x86 PC).

Signed-off-by: Stefan Seyfried [EMAIL PROTECTED]
Signed-off-by: Rafael J. Wysocki [EMAIL PROTECTED]
Acked-by: Pavel Machek [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 kernel/power/user.c |   19 ---
 1 file changed, 12 insertions(+), 7 deletions(-)

--- linux-2.6.20.1.orig/kernel/power/user.c
+++ linux-2.6.20.1/kernel/power/user.c
@@ -292,7 +292,7 @@ static int snapshot_ioctl(struct inode *
break;
}
 
-   if (pm_ops-prepare) {
+   if (pm_ops  pm_ops-prepare) {
error = pm_ops-prepare(PM_SUSPEND_MEM);
if (error)
goto OutS3;
@@ -311,7 +311,7 @@ static int snapshot_ioctl(struct inode *
device_resume();
}
resume_console();
-   if (pm_ops-finish)
+   if (pm_ops  pm_ops-finish)
pm_ops-finish(PM_SUSPEND_MEM);
 
  OutS3:
@@ -322,20 +322,25 @@ static int snapshot_ioctl(struct inode *
switch (arg) {
 
case PMOPS_PREPARE:
-   if (pm_ops-prepare) {
+   if (pm_ops  pm_ops-prepare)
error = pm_ops-prepare(PM_SUSPEND_DISK);
-   }
+   else
+   error = -ENOSYS;
break;
 
case PMOPS_ENTER:
kernel_shutdown_prepare(SYSTEM_SUSPEND_DISK);
-   error = pm_ops-enter(PM_SUSPEND_DISK);
+   if (pm_ops  pm_ops-enter)
+   error = pm_ops-enter(PM_SUSPEND_DISK);
+   else
+   error = -ENOSYS;
break;
 
case PMOPS_FINISH:
-   if (pm_ops  pm_ops-finish) {
+   if (pm_ops  pm_ops-finish)
pm_ops-finish(PM_SUSPEND_DISK);
-   }
+   else
+   error = -ENOSYS;
break;
 
default:

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 056/101] fix umask when noACL kernel meets extN tuned for ACLs

2007-03-07 Thread Greg KH
From: Hugh Dickins [EMAIL PROTECTED]

Fix insecure default behaviour reported by Tigran Aivazian: if an ext2
or ext3 or ext4 filesystem is tuned to mount with acl, but mounted by
a kernel built without ACL support, then umask was ignored when creating
inodes - though root or user has umask 022, touch creates files as 0666,
and mkdir creates directories as 0777.

This appears to have worked right until 2.6.11, when a fix to the default
mode on symlinks (always 0777) assumed VFS applies umask: which it does,
unless the mount is marked for ACLs; but ext[234] set MS_POSIXACL in
s_flags according to s_mount_opt set according to def_mount_opts.

We could revert to the 2.6.10 ext[234]_init_acl (adding an S_ISLNK test);
but other filesystems only set MS_POSIXACL when ACLs are configured.  We
could fix this at another level; but it seems most robust to avoid setting
the s_mount_opt flag in the first place (at the expense of more ifdefs).

Likewise don't set the XATTR_USER flag when built without XATTR support.

Signed-off-by: Hugh Dickins [EMAIL PROTECTED]
Acked-by: Andreas Gruenbacher [EMAIL PROTECTED]
Cc: Tigran Aivazian [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 fs/ext2/super.c |4 
 fs/ext3/super.c |4 
 fs/ext4/super.c |4 
 3 files changed, 12 insertions(+)

--- linux-2.6.20.1.orig/fs/ext2/super.c
+++ linux-2.6.20.1/fs/ext2/super.c
@@ -708,10 +708,14 @@ static int ext2_fill_super(struct super_
set_opt(sbi-s_mount_opt, GRPID);
if (def_mount_opts  EXT2_DEFM_UID16)
set_opt(sbi-s_mount_opt, NO_UID32);
+#ifdef CONFIG_EXT2_FS_XATTR
if (def_mount_opts  EXT2_DEFM_XATTR_USER)
set_opt(sbi-s_mount_opt, XATTR_USER);
+#endif
+#ifdef CONFIG_EXT2_FS_POSIX_ACL
if (def_mount_opts  EXT2_DEFM_ACL)
set_opt(sbi-s_mount_opt, POSIX_ACL);
+#endif

if (le16_to_cpu(sbi-s_es-s_errors) == EXT2_ERRORS_PANIC)
set_opt(sbi-s_mount_opt, ERRORS_PANIC);
--- linux-2.6.20.1.orig/fs/ext3/super.c
+++ linux-2.6.20.1/fs/ext3/super.c
@@ -1459,10 +1459,14 @@ static int ext3_fill_super (struct super
set_opt(sbi-s_mount_opt, GRPID);
if (def_mount_opts  EXT3_DEFM_UID16)
set_opt(sbi-s_mount_opt, NO_UID32);
+#ifdef CONFIG_EXT3_FS_XATTR
if (def_mount_opts  EXT3_DEFM_XATTR_USER)
set_opt(sbi-s_mount_opt, XATTR_USER);
+#endif
+#ifdef CONFIG_EXT3_FS_POSIX_ACL
if (def_mount_opts  EXT3_DEFM_ACL)
set_opt(sbi-s_mount_opt, POSIX_ACL);
+#endif
if ((def_mount_opts  EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_DATA)
sbi-s_mount_opt |= EXT3_MOUNT_JOURNAL_DATA;
else if ((def_mount_opts  EXT3_DEFM_JMODE) == EXT3_DEFM_JMODE_ORDERED)
--- linux-2.6.20.1.orig/fs/ext4/super.c
+++ linux-2.6.20.1/fs/ext4/super.c
@@ -1518,10 +1518,14 @@ static int ext4_fill_super (struct super
set_opt(sbi-s_mount_opt, GRPID);
if (def_mount_opts  EXT4_DEFM_UID16)
set_opt(sbi-s_mount_opt, NO_UID32);
+#ifdef CONFIG_EXT4DEV_FS_XATTR
if (def_mount_opts  EXT4_DEFM_XATTR_USER)
set_opt(sbi-s_mount_opt, XATTR_USER);
+#endif
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
if (def_mount_opts  EXT4_DEFM_ACL)
set_opt(sbi-s_mount_opt, POSIX_ACL);
+#endif
if ((def_mount_opts  EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
sbi-s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA;
else if ((def_mount_opts  EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 066/101] Fix skb data reallocation handling in IPSEC

2007-03-07 Thread Greg KH
From: Arnaldo Carvalho de Melo [EMAIL PROTECTED]

[XFRM_TUNNEL]: Reload header pointer after pskb_may_pull/pskb_expand_head

Please consider applying, this was found on your latest
net-2.6 tree while playing around with that ip_hdr() + turn
skb-nh/h/mac pointers  as offsets on 64 bits idea :-)

Signed-off-by: Arnaldo Carvalho de Melo [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/xfrm4_mode_tunnel.c |1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.20.1.orig/net/ipv4/xfrm4_mode_tunnel.c
+++ linux-2.6.20.1/net/ipv4/xfrm4_mode_tunnel.c
@@ -84,6 +84,7 @@ static int xfrm4_tunnel_input(struct xfr
(err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
goto out;
 
+   iph = skb-nh.iph;
if (x-props.flags  XFRM_STATE_DECAP_DSCP)
ipv4_copy_dscp(iph, skb-h.ipiph);
if (!(x-props.flags  XFRM_STATE_NOECN))

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 053/101] Fix posix-cpu-timer breakage caused by stale p-last_ran value

2007-03-07 Thread Greg KH
From: Thomas Gleixner [EMAIL PROTECTED]

Problem description at:
http://bugzilla.kernel.org/show_bug.cgi?id=8048

Commit b18ec80396834497933d77b81ec0918519f4e2a7 
[PATCH] sched: improve migration accuracy
optimized the scheduler time calculations, but broke posix-cpu-timers.

The problem is that the p-last_ran value is not updated after a context
switch. So a subsequent call to current_sched_time() calculates with a
stale p-last_ran value, i.e. accounts the full time, which the task was
scheduled away.

Signed-off-by: Thomas Gleixner [EMAIL PROTECTED]
Acked-by: Ingo Molnar [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 kernel/sched.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/kernel/sched.c
+++ linux-2.6.20.1/kernel/sched.c
@@ -3547,7 +3547,7 @@ switch_tasks:
 
sched_info_switch(prev, next);
if (likely(prev != next)) {
-   next-timestamp = now;
+   next-timestamp = next-last_ran = now;
rq-nr_switches++;
rq-curr = next;
++*switch_count;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 065/101] Fix xfrm_add_sa_expire() return value

2007-03-07 Thread Greg KH
From: David Miller [EMAIL PROTECTED]

[XFRM] xfrm_user: Fix return values of xfrm_add_sa_expire.

As noted by Kent Yoder, this function will always return an
error.  Make sure it returns zero on success.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/xfrm/xfrm_user.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/net/xfrm/xfrm_user.c
+++ linux-2.6.20.1/net/xfrm/xfrm_user.c
@@ -1557,14 +1557,13 @@ static int xfrm_add_sa_expire(struct sk_
struct xfrm_usersa_info *p = ue-state;
 
x = xfrm_state_lookup(p-id.daddr, p-id.spi, p-id.proto, p-family);
-   err = -ENOENT;
 
+   err = -ENOENT;
if (x == NULL)
return err;
 
-   err = -EINVAL;
-
spin_lock_bh(x-lock);
+   err = -EINVAL;
if (x-km.state != XFRM_STATE_VALID)
goto out;
km_state_expired(x, ue-hard, current-pid);
@@ -1574,6 +1573,7 @@ static int xfrm_add_sa_expire(struct sk_
xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
   AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
}
+   err = 0;
 out:
spin_unlock_bh(x-lock);
xfrm_state_put(x);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 064/101] Fix interrupt probing on E450 sparc64 systems

2007-03-07 Thread Greg KH
From: David Miller [EMAIL PROTECTED]

[SPARC64]: Fix PCI interrupts on E450 et al.

When the PCI controller OBP node lacks an interrupt-map
and interrupt-map-mask property, we need to form the
INO by hand.  The PCI swizzle logic was not doing that
properly.

This was a regression added by the of_device code.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/sparc64/kernel/of_device.c |   40 ++--
 1 file changed, 38 insertions(+), 2 deletions(-)

--- linux-2.6.20.1.orig/arch/sparc64/kernel/of_device.c
+++ linux-2.6.20.1/arch/sparc64/kernel/of_device.c
@@ -708,7 +708,7 @@ static unsigned int __init pci_irq_swizz
   unsigned int irq)
 {
struct linux_prom_pci_registers *regs;
-   unsigned int devfn, slot, ret;
+   unsigned int bus, devfn, slot, ret;
 
if (irq  1 || irq  4)
return irq;
@@ -717,10 +717,46 @@ static unsigned int __init pci_irq_swizz
if (!regs)
return irq;
 
+   bus = (regs-phys_hi  16)  0xff;
devfn = (regs-phys_hi  8)  0xff;
slot = (devfn  3)  0x1f;
 
-   ret = ((irq - 1 + (slot  3))  3) + 1;
+   if (pp-irq_trans) {
+   /* Derived from Table 8-3, U2P User's Manual.  This branch
+* is handling a PCI controller that lacks a proper set of
+* interrupt-map and interrupt-map-mask properties.  The
+* Ultra-E450 is one example.
+*
+* The bit layout is BSSLL, where:
+* B: 0 on bus A, 1 on bus B
+* D: 2-bit slot number, derived from PCI device number as
+*(dev - 1) for bus A, or (dev - 2) for bus B
+* L: 2-bit line number
+*
+* Actually, more portable way to calculate the funky
+* slot number is to subtract pbm-pci_first_slot from the
+* device number, and that's exactly what the pre-OF
+* sparc64 code did, but we're building this stuff generically
+* using the OBP tree, not in the PCI controller layer.
+*/
+   if (bus  0x80) {
+   /* PBM-A */
+   bus  = 0x00;
+   slot = (slot - 1)  2;
+   } else {
+   /* PBM-B */
+   bus  = 0x10;
+   slot = (slot - 2)  2;
+   }
+   irq -= 1;
+
+   ret = (bus | slot | irq);
+   } else {
+   /* Going through a PCI-PCI bridge that lacks a set of
+* interrupt-map and interrupt-map-mask properties.
+*/
+   ret = ((irq - 1 + (slot  3))  3) + 1;
+   }
 
return ret;
 }

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [stable] [patch 000/101] 2.6.20-stable review

2007-03-07 Thread Greg KH
On Wed, Mar 07, 2007 at 09:10:35AM -0800, Greg KH wrote:
 After many weeks of backlogs, I've finally flushed out all of the
 pending -stable patches, bringing this series to a whopping 101 patches
 pending for the next 2.6.20.2 release.

Oh, forgot to announce, but the whole thing can be found in a patch at:
kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.20.2-rc1.gz

And here's the diffstat below if anyone is curious.

thanks,

greg k-h


 Makefile   |2 
 arch/i386/kernel/cpu/mtrr/if.c |   33 +++-
 arch/i386/kernel/signal.c  |6 +-
 arch/i386/kernel/sysenter.c|2 
 arch/ia64/Kconfig  |1 
 arch/ia64/kernel/crash.c   |   11 ++--
 arch/ia64/kernel/machine_kexec.c   |2 
 arch/m32r/kernel/process.c |2 
 arch/m32r/kernel/signal.c  |   26 +
 arch/powerpc/kernel/head_64.S  |2 
 arch/ppc/kernel/ppc_ksyms.c|2 
 arch/sparc64/kernel/of_device.c|   40 ++-
 arch/um/os-Linux/sigio.c   |   38 +++---
 arch/x86_64/ia32/ia32_signal.c |7 ++
 arch/x86_64/ia32/ptrace32.c|1 
 block/ll_rw_blk.c  |2 
 drivers/Makefile   |2 
 drivers/ata/ahci.c |   14 +
 drivers/ata/ata_generic.c  |4 +
 drivers/ata/ata_piix.c |4 +
 drivers/ata/pata_ali.c |6 ++
 drivers/ata/pata_amd.c |   10 +++
 drivers/ata/pata_atiixp.c  |4 +
 drivers/ata/pata_cmd64x.c  |6 ++
 drivers/ata/pata_cs5520.c  |7 ++
 drivers/ata/pata_cs5530.c  |6 ++
 drivers/ata/pata_cs5535.c  |4 +
 drivers/ata/pata_cypress.c |4 +
 drivers/ata/pata_efar.c|4 +
 drivers/ata/pata_hpt366.c  |7 ++
 drivers/ata/pata_hpt3x3.c  |6 ++
 drivers/ata/pata_it821x.c  |6 ++
 drivers/ata/pata_jmicron.c |8 +++
 drivers/ata/pata_marvell.c |4 +
 drivers/ata/pata_mpiix.c   |4 +
 drivers/ata/pata_netcell.c |4 +
 drivers/ata/pata_ns87410.c |4 +
 drivers/ata/pata_oldpiix.c |4 +
 drivers/ata/pata_opti.c|4 +
 drivers/ata/pata_optidma.c |4 +
 drivers/ata/pata_pdc202xx_old.c|4 +
 drivers/ata/pata_radisys.c |4 +
 drivers/ata/pata_rz1000.c  |6 ++
 drivers/ata/pata_sc1200.c  |4 +
 drivers/ata/pata_serverworks.c |6 ++
 drivers/ata/pata_sil680.c  |8 +++
 drivers/ata/pata_sis.c |4 +
 drivers/ata/pata_triflex.c |4 +
 drivers/ata/pata_via.c |6 ++
 drivers/ata/sata_sil.c |   10 +++
 drivers/ata/sata_sil24.c   |2 
 drivers/block/pktcdvd.c|2 
 drivers/char/agp/intel-agp.c   |   14 +++--
 drivers/char/specialix.c   |2 
 drivers/char/tty_io.c  |   14 +
 drivers/hid/hid-core.c |5 -
 drivers/ide/ide-iops.c |2 
 drivers/ieee1394/nodemgr.c |   24 ++---
 drivers/ieee1394/video1394.c   |8 +++
 drivers/input/mouse/psmouse-base.c |   28 ++
 drivers/input/mouse/psmouse.h  |1 
 drivers/input/mouse/synaptics.c|1 
 drivers/kvm/kvm.h  |2 
 drivers/macintosh/Kconfig  |2 
 drivers/md/bitmap.c|   22 +++-
 drivers/md/raid10.c|   38 +++---
 drivers/md/raid5.c |   42 ++-
 drivers/media/dvb/dvb-core/dvbdev.c|   13 
 drivers/media/dvb/dvb-usb/cxusb.c  |4 -
 drivers/media/dvb/dvb-usb/digitv.c |2 
 drivers/media/video/cx25840/cx25840-core.c |4 -
 drivers/media/video/cx25840/cx25840-firmware.c |2 
 drivers/media/video/cx88/cx88-blackbird.c  |   14 +++--
 drivers/media/video/cx88/cx88.h|1 
 drivers/media/video/pvrusb2/pvrusb2-encoder.c  |   40 +++
 drivers/media/video/pvrusb2/pvrusb2-hdw.c  |   33 ++--
 drivers/mmc/sdhci.c|   22

[patch 063/101] HID: fix possible double-free on error path in hid parser

2007-03-07 Thread Greg KH

From: Jiri Kosina [EMAIL PROTECTED]

HID: fix possible double-free on error path in hid parser

Freeing of device-collection is properly done in hid_free_device() (as
this function is supposed to free all the device resources and could be
called from transport specific code, e.g. usb_hid_configure()).

Remove all kfree() calls preceeding the hid_free_device() call.

Signed-off-by: Jiri Kosina [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/hid/hid-core.c |5 -
 1 file changed, 5 deletions(-)

--- linux-2.6.20.1.orig/drivers/hid/hid-core.c
+++ linux-2.6.20.1/drivers/hid/hid-core.c
@@ -670,7 +670,6 @@ struct hid_device *hid_parse_report(__u8
 
if (item.format != HID_ITEM_FORMAT_SHORT) {
dbg(unexpected long global item);
-   kfree(device-collection);
hid_free_device(device);
kfree(parser);
return NULL;
@@ -679,7 +678,6 @@ struct hid_device *hid_parse_report(__u8
if (dispatch_type[item.type](parser, item)) {
dbg(item %u %u %u %u parsing failed\n,
item.format, (unsigned)item.size, 
(unsigned)item.type, (unsigned)item.tag);
-   kfree(device-collection);
hid_free_device(device);
kfree(parser);
return NULL;
@@ -688,14 +686,12 @@ struct hid_device *hid_parse_report(__u8
if (start == end) {
if (parser-collection_stack_ptr) {
dbg(unbalanced collection at end of report 
description);
-   kfree(device-collection);
hid_free_device(device);
kfree(parser);
return NULL;
}
if (parser-local.delimiter_depth) {
dbg(unbalanced delimiter at end of report 
description);
-   kfree(device-collection);
hid_free_device(device);
kfree(parser);
return NULL;
@@ -706,7 +702,6 @@ struct hid_device *hid_parse_report(__u8
}
 
dbg(item fetching failed at offset %d\n, (int)(end - start));
-   kfree(device-collection);
hid_free_device(device);
kfree(parser);
return NULL;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 052/101] V4L: cx88-blackbird: allow usage of 376836 and 262144 sized firmware images

2007-03-07 Thread Greg KH

From: Michael Krufky [EMAIL PROTECTED]

This updates the cx88-blackbird driver to be able to use the new cx23416
firmware image released by Hauppauge Computer Works, while retaining
compatibility with the older firmware images.
cx2341x firmware can be downloaded at: http://dl.ivtvdriver.org/ivtv/firmware/

(cherry picked from commit af70dbd3346999570db73b3bc3d4f7b7c004f2ea)

Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/video/cx88/cx88-blackbird.c |   14 +-
 drivers/media/video/cx88/cx88.h   |1 +
 2 files changed, 10 insertions(+), 5 deletions(-)

--- linux-2.6.20.1.orig/drivers/media/video/cx88/cx88-blackbird.c
+++ linux-2.6.20.1/drivers/media/video/cx88/cx88-blackbird.c
@@ -53,7 +53,8 @@ MODULE_PARM_DESC(debug,enable debug mes
 
 /* -- */
 
-#define BLACKBIRD_FIRM_IMAGE_SIZE 256*1024
+#define OLD_BLACKBIRD_FIRM_IMAGE_SIZE 262144
+#define BLACKBIRD_FIRM_IMAGE_SIZE 376836
 
 /* defines below are from ivtv-driver.h */
 
@@ -401,7 +402,7 @@ static int blackbird_find_mailbox(struct
u32 value;
int i;
 
-   for (i = 0; i  BLACKBIRD_FIRM_IMAGE_SIZE; i++) {
+   for (i = 0; i  dev-fw_size; i++) {
memory_read(dev-core, i, value);
if (value == signature[signaturecnt])
signaturecnt++;
@@ -449,12 +450,15 @@ static int blackbird_load_firmware(struc
return -1;
}
 
-   if (firmware-size != BLACKBIRD_FIRM_IMAGE_SIZE) {
-   dprintk(0, ERROR: Firmware size mismatch (have %zd, expected 
%d)\n,
-   firmware-size, BLACKBIRD_FIRM_IMAGE_SIZE);
+   if ((firmware-size != BLACKBIRD_FIRM_IMAGE_SIZE) 
+   (firmware-size != OLD_BLACKBIRD_FIRM_IMAGE_SIZE)) {
+   dprintk(0, ERROR: Firmware size mismatch (have %zd, expected 
%d or %d)\n,
+   firmware-size, BLACKBIRD_FIRM_IMAGE_SIZE,
+   OLD_BLACKBIRD_FIRM_IMAGE_SIZE);
release_firmware(firmware);
return -1;
}
+   dev-fw_size = firmware-size;
 
if (0 != memcmp(firmware-data, magic, 8)) {
dprintk(0, ERROR: Firmware magic mismatch, wrong file?\n);
--- linux-2.6.20.1.orig/drivers/media/video/cx88/cx88.h
+++ linux-2.6.20.1/drivers/media/video/cx88/cx88.h
@@ -459,6 +459,7 @@ struct cx8802_dev {
u32mailbox;
intwidth;
intheight;
+   intfw_size;
 
/* for dvb only */
struct videobuf_dvbdvb;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 046/101] dvbdev: fix illegal re-usage of fileoperations struct

2007-03-07 Thread Greg KH
From: Marcel Siegert [EMAIL PROTECTED]

Arjan van de Ven [EMAIL PROTECTED] reported an illegal re-usage of
the fileoperations struct if more than one dvb device (e.g. frontend) is
present.

This patch fixes this issue.

It allocates a new fileoperations struct each time a device is
registered and copies the default template fileops.

(backported from commit b61901024776b25ce7b8edc31bb1757c7382a88e)

Signed-off-by: Marcel Siegert [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/dvb/dvb-core/dvbdev.c |   13 +
 1 file changed, 13 insertions(+)

--- linux-2.6.20.1.orig/drivers/media/dvb/dvb-core/dvbdev.c
+++ linux-2.6.20.1/drivers/media/dvb/dvb-core/dvbdev.c
@@ -200,6 +200,8 @@ int dvb_register_device(struct dvb_adapt
const struct dvb_device *template, void *priv, int type)
 {
struct dvb_device *dvbdev;
+   struct file_operations *dvbdevfops;
+
int id;
 
if (mutex_lock_interruptible(dvbdev_register_lock))
@@ -219,12 +221,22 @@ int dvb_register_device(struct dvb_adapt
return -ENOMEM;
}
 
+   dvbdevfops = kzalloc(sizeof(struct file_operations), GFP_KERNEL);
+
+   if (!dvbdevfops) {
+   kfree (dvbdev);
+   mutex_unlock(dvbdev_register_lock);
+   return -ENOMEM;
+   }
+
memcpy(dvbdev, template, sizeof(struct dvb_device));
dvbdev-type = type;
dvbdev-id = id;
dvbdev-adapter = adap;
dvbdev-priv = priv;
+   dvbdev-fops = dvbdevfops;
 
+   memcpy(dvbdev-fops, template-fops, sizeof(struct file_operations));
dvbdev-fops-owner = adap-module;
 
list_add_tail (dvbdev-list_head, adap-device_list);
@@ -252,6 +264,7 @@ void dvb_unregister_device(struct dvb_de
dvbdev-type, dvbdev-id)));
 
list_del (dvbdev-list_head);
+   kfree (dvbdev-fops);
kfree (dvbdev);
 }
 EXPORT_SYMBOL(dvb_unregister_device);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 038/101] Fix oops in xfrm_audit_log()

2007-03-07 Thread Greg KH
From: David Miller [EMAIL PROTECTED]

[XFRM]: Fix OOPSes in xfrm_audit_log().

Make sure that this function is called correctly, and
add BUG() checking to ensure the arguments are sane.

Based upon a patch by Joy Latten.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/key/af_key.c   |   11 ++-
 net/xfrm/xfrm_policy.c |7 ++-
 net/xfrm/xfrm_user.c   |   12 +++-
 3 files changed, 19 insertions(+), 11 deletions(-)

--- linux-2.6.20.1.orig/net/key/af_key.c
+++ linux-2.6.20.1/net/key/af_key.c
@@ -2297,16 +2297,17 @@ static int pfkey_spddelete(struct sock *
   sel, tmp.security, 1);
security_xfrm_policy_free(tmp);
 
-   xfrm_audit_log(audit_get_loginuid(current-audit_context), 0,
-  AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
 
-   err = 0;
+   err = security_xfrm_policy_delete(xp);
 
-   if ((err = security_xfrm_policy_delete(xp)))
+   xfrm_audit_log(audit_get_loginuid(current-audit_context), 0,
+  AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+   if (err)
goto out;
+
c.seq = hdr-sadb_msg_seq;
c.pid = hdr-sadb_msg_pid;
c.event = XFRM_MSG_DELPOLICY;
--- linux-2.6.20.1.orig/net/xfrm/xfrm_policy.c
+++ linux-2.6.20.1/net/xfrm/xfrm_policy.c
@@ -1997,9 +1997,14 @@ void xfrm_audit_log(uid_t auid, u32 sid,
if (audit_enabled == 0)
return;
 
+   BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
+   type == AUDIT_MAC_IPSEC_DELSA)  !x);
+   BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
+   type == AUDIT_MAC_IPSEC_DELSPD)  !xp);
+
audit_buf = audit_log_start(current-audit_context, GFP_ATOMIC, type);
if (audit_buf == NULL)
-   return;
+   return;
 
switch(type) {
case AUDIT_MAC_IPSEC_ADDSA:
--- linux-2.6.20.1.orig/net/xfrm/xfrm_user.c
+++ linux-2.6.20.1/net/xfrm/xfrm_user.c
@@ -1273,10 +1273,6 @@ static int xfrm_get_policy(struct sk_buf
xp = xfrm_policy_bysel_ctx(type, p-dir, p-sel, tmp.security, 
delete);
security_xfrm_policy_free(tmp);
}
-   if (delete)
-   xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-  AUDIT_MAC_IPSEC_DELSPD, (xp) ? 1 : 0, xp, NULL);
-
if (xp == NULL)
return -ENOENT;
 
@@ -1292,8 +1288,14 @@ static int xfrm_get_policy(struct sk_buf
  MSG_DONTWAIT);
}
} else {
-   if ((err = security_xfrm_policy_delete(xp)) != 0)
+   err = security_xfrm_policy_delete(xp);
+
+   xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+  AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+
+   if (err != 0)
goto out;
+
c.data.byid = p-index;
c.event = nlh-nlmsg_type;
c.seq = nlh-nlmsg_seq;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 049/101] DVB: cxusb: fix firmware patch for big endian systems

2007-03-07 Thread Greg KH

From: Jin-Bong lee [EMAIL PROTECTED]

Without this patch, the device will not be detected after firmware download
on big endian systems.

(cherry picked from commit 1d1370a48ca285ebe197ecd3197a8d5f161bc291)

Signed-off-by: Jin-Bong lee [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/dvb/dvb-usb/cxusb.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.20.1.orig/drivers/media/dvb/dvb-usb/cxusb.c
+++ linux-2.6.20.1/drivers/media/dvb/dvb-usb/cxusb.c
@@ -469,9 +469,9 @@ static int bluebird_patch_dvico_firmware
fw-data[BLUEBIRD_01_ID_OFFSET + 1] == USB_VID_DVICO  8) {
 
fw-data[BLUEBIRD_01_ID_OFFSET + 2] =
-   udev-descriptor.idProduct + 1;
+   le16_to_cpu(udev-descriptor.idProduct) + 1;
fw-data[BLUEBIRD_01_ID_OFFSET + 3] =
-   udev-descriptor.idProduct  8;
+   le16_to_cpu(udev-descriptor.idProduct)  8;
 
return usb_cypress_load_firmware(udev, fw, CYPRESS_FX2);
}

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 039/101] sky2: dont flush good pause frames

2007-03-07 Thread Greg KH
From: Stephen Hemminger [EMAIL PROTECTED]

Don't mark pause frames as errors. This problem caused transmitter not
to pause and would effectively take out a gigabit switch because the
it can't handle overrun.

Signed-off-by: Stephen Hemminger [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/sky2.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/net/sky2.h
+++ linux-2.6.20.1/drivers/net/sky2.h
@@ -1579,7 +1579,7 @@ enum {
 
GMR_FS_ANY_ERR  = GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR |
  GMR_FS_FRAGMENT | GMR_FS_LONG_ERR |
- GMR_FS_MII_ERR | GMR_FS_GOOD_FC | GMR_FS_BAD_FC |
+ GMR_FS_MII_ERR | GMR_FS_BAD_FC |
  GMR_FS_UN_SIZE | GMR_FS_JABBER,
 };
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 051/101] V4L: fix cx25840 firmware loading

2007-03-07 Thread Greg KH

From: Hans Verkuil [EMAIL PROTECTED]
Date: Thu, 15 Feb 2007 03:40:34 -0300
Subject: [patch 051/101] [PATCH] V4L: fix cx25840 firmware loading

Due to changes in the i2c handling in 2.6.20 this cx25840 bug surfaced,
causing the firmware load to fail for the ivtv driver. The correct
sequence is to first attach the i2c client, then use the client's
device to load the firmware.

(cherry picked from commit d55c7aec58495e5b57a6b194c8c2a1ac255f)

Signed-off-by: Hans Verkuil [EMAIL PROTECTED]
Acked-by: Mike Isely [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/video/cx25840/cx25840-core.c |4 ++--
 drivers/media/video/cx25840/cx25840-firmware.c |2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/drivers/media/video/cx25840/cx25840-core.c
+++ linux-2.6.20.1/drivers/media/video/cx25840/cx25840-core.c
@@ -907,13 +907,13 @@ static int cx25840_detect_client(struct 
state-vbi_line_offset = 8;
state-id = id;
 
+   i2c_attach_client(client);
+
if (state-is_cx25836)
cx25836_initialize(client);
else
cx25840_initialize(client, 1);
 
-   i2c_attach_client(client);
-
return 0;
 }
 
--- linux-2.6.20.1.orig/drivers/media/video/cx25840/cx25840-firmware.c
+++ linux-2.6.20.1/drivers/media/video/cx25840/cx25840-firmware.c
@@ -37,7 +37,7 @@
  */
 #define FWSEND 48
 
-#define FWDEV(x) ((x)-adapter-dev)
+#define FWDEV(x) ((x)-dev)
 
 static char *firmware = FWFILE;
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 050/101] DVB: digitv: open nxt6000 i2c_gate for TDED4 tuner handling

2007-03-07 Thread Greg KH
From: Michael Krufky [EMAIL PROTECTED]

dvb-pll normally opens the i2c gate before attempting to communicate with
the pll, but the code for this device is not using dvb-pll.  This should
be cleaned up in the future, but for now, just open the i2c gate at the
appropriate place in order to fix this driver bug.

(cherry picked from commit 2fe22dcdc79b8dd34e61a3f1231caffd6180a626)

Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/dvb/dvb-usb/digitv.c |2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.20.1.orig/drivers/media/dvb/dvb-usb/digitv.c
+++ linux-2.6.20.1/drivers/media/dvb/dvb-usb/digitv.c
@@ -119,6 +119,8 @@ static int digitv_nxt6000_tuner_set_para
struct dvb_usb_adapter *adap = fe-dvb-priv;
u8 b[5];
dvb_usb_tuner_calc_regs(fe,fep,b, 5);
+   if (fe-ops.i2c_gate_ctrl)
+   fe-ops.i2c_gate_ctrl(fe, 1);
return digitv_ctrl_msg(adap-dev, USB_WRITE_TUNER, 0, b[1], 4, NULL, 
0);
 }
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 040/101] sky2: transmit timeout deadlock

2007-03-07 Thread Greg KH
From: Stephen Hemminger [EMAIL PROTECTED]

The code in transmit timeout incorrectly assumed that netif_tx_lock
was not set.

Signed-off-by: Stephen Hemminger [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/sky2.c |6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

--- linux-2.6.20.1.orig/drivers/net/sky2.c
+++ linux-2.6.20.1/drivers/net/sky2.c
@@ -1796,6 +1796,7 @@ out:
 
 /* Transmit timeout is only called if we are running, carries is up
  * and tx queue is full (stopped).
+ * Called with netif_tx_lock held.
  */
 static void sky2_tx_timeout(struct net_device *dev)
 {
@@ -1821,17 +1822,14 @@ static void sky2_tx_timeout(struct net_d
sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
} else if (report != sky2-tx_cons) {
printk(KERN_INFO PFX status report lost?\n);
-
-   netif_tx_lock_bh(dev);
sky2_tx_complete(sky2, report);
-   netif_tx_unlock_bh(dev);
} else {
printk(KERN_INFO PFX hardware hung? flushing\n);
 
sky2_write32(hw, Q_ADDR(txq, Q_CSR), BMU_STOP);
sky2_write32(hw, Y2_QADDR(txq, PREF_UNIT_CTRL), 
PREF_UNIT_RST_SET);
 
-   sky2_tx_clean(dev);
+   sky2_tx_complete(sky2, sky2-tx_prod);
 
sky2_qset(hw, txq);
sky2_prefetch_init(hw, txq, sky2-tx_le_map, TX_RING_SIZE - 1);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 041/101] x86_64: Fix wrong gcc check in bitops.h

2007-03-07 Thread Greg KH


gcc 5.0 will likely not have the constraint problem

Signed-off-by: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 include/asm-x86_64/bitops.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/include/asm-x86_64/bitops.h
+++ linux-2.6.20.1/include/asm-x86_64/bitops.h
@@ -7,7 +7,7 @@
 
 #include asm/alternative.h
 
-#if __GNUC__  4 || __GNUC_MINOR__  1
+#if __GNUC__  4 || (__GNUC__ == 4  __GNUC_MINOR__  1)
 /* Technically wrong, but this avoids compilation errors on some gcc
versions. */
 #define ADDR =m (*(volatile long *) addr)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 048/101] V4L: pvrusb2: Handle larger cx2341x firmware images

2007-03-07 Thread Greg KH
From: Mike Isely [EMAIL PROTECTED]

Rework the cx23416 firmware loader so that it longer requires the
firmware size to be a multiple of 8KB.  Until recently all cx2341x
firmware images were exactly 256KB, but newer firmware is larger than
that and also appears to have arbitrary size.  We still must check
against a multiple of 4 bytes (because the cx23416 itself uses a 32
bit word size).

This fix is already in the upstream driver source and has proven
itself there; this is a backport for the 2.6.20.y kernel series.

(backported from commit 90060d32ca0a941b158994f78e60d0381871c84b)

Signed-off-by: Mike Isely [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/video/pvrusb2/pvrusb2-hdw.c |   31 --
 1 file changed, 17 insertions(+), 14 deletions(-)

--- linux-2.6.20.1.orig/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ linux-2.6.20.1/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -1041,7 +1041,7 @@ int pvr2_upload_firmware2(struct pvr2_hd
 {
const struct firmware *fw_entry = NULL;
void  *fw_ptr;
-   unsigned int pipe, fw_len, fw_done;
+   unsigned int pipe, fw_len, fw_done, bcnt, icnt;
int actual_length;
int ret = 0;
int fwidx;
@@ -1093,11 +1093,11 @@ int pvr2_upload_firmware2(struct pvr2_hd
 
fw_len = fw_entry-size;
 
-   if (fw_len % FIRMWARE_CHUNK_SIZE) {
+   if (fw_len % sizeof(u32)) {
pvr2_trace(PVR2_TRACE_ERROR_LEGS,
   size of %s firmware
-   must be a multiple of 8192B,
-  fw_files[fwidx]);
+   must be a multiple of %zu bytes,
+  fw_files[fwidx],sizeof(u32));
release_firmware(fw_entry);
return -1;
}
@@ -1112,18 +1112,21 @@ int pvr2_upload_firmware2(struct pvr2_hd
 
pipe = usb_sndbulkpipe(hdw-usb_dev, PVR2_FIRMWARE_ENDPOINT);
 
-   for (fw_done = 0 ; (fw_done  fw_len)  !ret ;
-fw_done += FIRMWARE_CHUNK_SIZE ) {
-   int i;
-   memcpy(fw_ptr, fw_entry-data + fw_done, FIRMWARE_CHUNK_SIZE);
-   /* Usbsnoop log  shows that we must swap bytes... */
-   for (i = 0; i  FIRMWARE_CHUNK_SIZE/4 ; i++)
-   ((u32 *)fw_ptr)[i] = ___swab32(((u32 *)fw_ptr)[i]);
+   fw_done = 0;
+   for (fw_done = 0; fw_done  fw_len;) {
+   bcnt = fw_len - fw_done;
+   if (bcnt  FIRMWARE_CHUNK_SIZE) bcnt = FIRMWARE_CHUNK_SIZE;
+   memcpy(fw_ptr, fw_entry-data + fw_done, bcnt);
+   /* Usbsnoop log shows that we must swap bytes... */
+   for (icnt = 0; icnt  bcnt/4 ; icnt++)
+   ((u32 *)fw_ptr)[icnt] =
+   ___swab32(((u32 *)fw_ptr)[icnt]);
 
-   ret |= usb_bulk_msg(hdw-usb_dev, pipe, fw_ptr,
-   FIRMWARE_CHUNK_SIZE,
+   ret |= usb_bulk_msg(hdw-usb_dev, pipe, fw_ptr,bcnt,
actual_length, HZ);
-   ret |= (actual_length != FIRMWARE_CHUNK_SIZE);
+   ret |= (actual_length != bcnt);
+   if (ret) break;
+   fw_done += bcnt;
}
 
trace_firmware(upload of %s : %i / %i ,

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 047/101] V4L: pvrusb2: Fix video corruption on stream start

2007-03-07 Thread Greg KH
From: Mike Isely [EMAIL PROTECTED]

This introduces some extra cx23416 commands when streaming is
started.  The addition of these commands fix random sporadic video
corruption that can take place when the video stream is temporarily
disrupted through loss of signal (e.g. changing the channel in the RF
tuner).

This fix is already in the upstream driver source and has proven
itself there; this is a backport for the 2.6.20.y kernel series.

(backported from commit 6fe7d2c4660174110c6872cacc4fc2acb6e00acf)

Signed-off-by: Mike Isely [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/video/pvrusb2/pvrusb2-encoder.c |   40 ++
 1 file changed, 40 insertions(+)

--- linux-2.6.20.1.orig/drivers/media/video/pvrusb2/pvrusb2-encoder.c
+++ linux-2.6.20.1/drivers/media/video/pvrusb2/pvrusb2-encoder.c
@@ -288,6 +288,44 @@ static int pvr2_encoder_vcmd(struct pvr2
return pvr2_encoder_cmd(hdw,cmd,args,0,data);
 }
 
+
+/* This implements some extra setup for the encoder that seems to be
+   specific to the PVR USB2 hardware. */
+int pvr2_encoder_prep_config(struct pvr2_hdw *hdw)
+{
+   int ret = 0;
+   int encMisc3Arg = 0;
+
+   /* Mike Isely [EMAIL PROTECTED] 22-Feb-2007 The windows driver
+  sends the following list of ENC_MISC commands (for both
+  24xxx and 29xxx devices).  Meanings are not entirely clear,
+  however without the ENC_MISC(3,encMisc3Arg) command then we risk
+  random perpetual video corruption whenever the video input
+  breaks up for a moment (like when switching channels). */
+
+
+   /* This ENC_MISC(3,encMisc3Arg) command is critical - without
+  it there will eventually be video corruption.  Also, the
+  29xxx case is strange - the Windows driver is passing 1
+  regardless of device type but if we have 1 for 29xxx device
+  the video turns sluggish.  */
+   switch (hdw-hdw_type) {
+   case PVR2_HDW_TYPE_24XXX: encMisc3Arg = 1; break;
+   case PVR2_HDW_TYPE_29XXX: encMisc3Arg = 0; break;
+   default: break;
+   }
+   ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 3,
+encMisc3Arg,0,0);
+
+   ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 8,0,0,0);
+
+   ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4, 0,3,0,0);
+   ret |= pvr2_encoder_vcmd(hdw, CX2341X_ENC_MISC,4,15,0,0,0);
+
+   return ret;
+}
+
+
 int pvr2_encoder_configure(struct pvr2_hdw *hdw)
 {
int ret;
@@ -302,6 +340,8 @@ int pvr2_encoder_configure(struct pvr2_h
 
ret = 0;
 
+   ret |= pvr2_encoder_prep_config(hdw);
+
if (!ret) ret = pvr2_encoder_vcmd(
hdw,CX2341X_ENC_SET_NUM_VSYNC_LINES, 2,
0xf0, 0xf0);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 042/101] x86: Dont require the vDSO for handling a.out signals

2007-03-07 Thread Greg KH
From: Andi Kleen [EMAIL PROTECTED]

x86: Don't require the vDSO for handling a.out signals

and in other strange binfmts. vDSO is not necessarily mapped there.

This fixes signals in a.out programs

Signed-off-by: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/i386/kernel/signal.c  |6 +-
 arch/x86_64/ia32/ia32_signal.c |7 ++-
 fs/binfmt_elf.c|3 ++-
 include/linux/binfmts.h|1 +
 4 files changed, 14 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/arch/i386/kernel/signal.c
+++ linux-2.6.20.1/arch/i386/kernel/signal.c
@@ -21,6 +21,7 @@
 #include linux/suspend.h
 #include linux/ptrace.h
 #include linux/elf.h
+#include linux/binfmts.h
 #include asm/processor.h
 #include asm/ucontext.h
 #include asm/uaccess.h
@@ -349,7 +350,10 @@ static int setup_frame(int sig, struct k
goto give_sigsegv;
}
 
-   restorer = (void *)VDSO_SYM(__kernel_sigreturn);
+   if (current-binfmt-hasvdso)
+   restorer = (void *)VDSO_SYM(__kernel_sigreturn);
+   else
+   restorer = (void *)frame-retcode;
if (ka-sa.sa_flags  SA_RESTORER)
restorer = ka-sa.sa_restorer;
 
--- linux-2.6.20.1.orig/arch/x86_64/ia32/ia32_signal.c
+++ linux-2.6.20.1/arch/x86_64/ia32/ia32_signal.c
@@ -21,6 +21,7 @@
 #include linux/stddef.h
 #include linux/personality.h
 #include linux/compat.h
+#include linux/binfmts.h
 #include asm/ucontext.h
 #include asm/uaccess.h
 #include asm/i387.h
@@ -449,7 +450,11 @@ int ia32_setup_frame(int sig, struct k_s
 
/* Return stub is in 32bit vsyscall page */
{ 
-   void __user *restorer = VSYSCALL32_SIGRETURN; 
+   void __user *restorer;
+   if (current-binfmt-hasvdso)
+   restorer = VSYSCALL32_SIGRETURN;
+   else
+   restorer = (void *)frame-retcode;
if (ka-sa.sa_flags  SA_RESTORER)
restorer = ka-sa.sa_restorer;   
err |= __put_user(ptr_to_compat(restorer), frame-pretcode);
--- linux-2.6.20.1.orig/fs/binfmt_elf.c
+++ linux-2.6.20.1/fs/binfmt_elf.c
@@ -76,7 +76,8 @@ static struct linux_binfmt elf_format = 
.load_binary= load_elf_binary,
.load_shlib = load_elf_library,
.core_dump  = elf_core_dump,
-   .min_coredump   = ELF_EXEC_PAGESIZE
+   .min_coredump   = ELF_EXEC_PAGESIZE,
+   .hasvdso= 1
 };
 
 #define BAD_ADDR(x) ((unsigned long)(x) = TASK_SIZE)
--- linux-2.6.20.1.orig/include/linux/binfmts.h
+++ linux-2.6.20.1/include/linux/binfmts.h
@@ -59,6 +59,7 @@ struct linux_binfmt {
int (*load_shlib)(struct file *);
int (*core_dump)(long signr, struct pt_regs * regs, struct file * file);
unsigned long min_coredump; /* minimal dump size */
+   int hasvdso;
 };
 
 extern int register_binfmt(struct linux_binfmt *);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 043/101] i386: Fix broken CONFIG_COMPAT_VDSO on i386

2007-03-07 Thread Greg KH
From: Jan Beulich [EMAIL PROTECTED]

After updating several machines to 2.6.20, I can't boot  anymore the single
one of them that supports the NX bit and is configured as a 32-bit system.

My understanding is that the VDSO changes in 2.6.20-rc7 were not fully
cooked, in that with that config option enabled VDSO_SYM(x) now equals
x, meaning that an address in the fixmap area is now being passed to
apps via AT_SYSINFO. However, the page is mapped with PAGE_READONLY
rather than PAGE_READONLY_EXEC.

I'm not certain whether having app code go through the fixmap area is
intended, but in case it is here is the simple patch that makes things work
again.

Cc: Theodore Tso [EMAIL PROTECTED]
Signed-off-by: Jan Beulich [EMAIL PROTECTED]
Signed-off-by: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/i386/kernel/sysenter.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/arch/i386/kernel/sysenter.c
+++ linux-2.6.20.1/arch/i386/kernel/sysenter.c
@@ -77,7 +77,7 @@ int __init sysenter_setup(void)
syscall_page = (void *)get_zeroed_page(GFP_ATOMIC);
 
 #ifdef CONFIG_COMPAT_VDSO
-   __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_READONLY);
+   __set_fixmap(FIX_VDSO, __pa(syscall_page), PAGE_READONLY_EXEC);
printk(Compat vDSO mapped to %08lx.\n, __fix_to_virt(FIX_VDSO));
 #endif
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 034/101] Fix atmarp.h for userspace

2007-03-07 Thread Greg KH

From: David Miller [EMAIL PROTECTED]

[ATM]: atmarp.h needs to always include linux/types.h

To provide the __be* types, even for userspace includes.

Reported by Andrew Walrond.

Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 include/linux/atmarp.h |2 --
 1 file changed, 2 deletions(-)

--- linux-2.6.20.1.orig/include/linux/atmarp.h
+++ linux-2.6.20.1/include/linux/atmarp.h
@@ -6,9 +6,7 @@
 #ifndef _LINUX_ATMARP_H
 #define _LINUX_ATMARP_H
 
-#ifdef __KERNEL__
 #include linux/types.h
-#endif
 #include linux/atmapi.h
 #include linux/atmioc.h
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 024/101] ieee1394: fix host device registering when nodemgr disabled

2007-03-07 Thread Greg KH
From: Stefan Richter [EMAIL PROTECTED]

Since my commit 8252bbb1363b7fe963a3eb6f8a36da619a6f5a65 in 2.6.20-rc1,
host devices have a dummy driver attached.  Alas the driver was not
registered before use if ieee1394 was loaded with disable_nodemgr=1.

This resulted in non-functional FireWire drivers or kernel lockup.
http://bugzilla.kernel.org/show_bug.cgi?id=7942

Signed-off-by: Stefan Richter [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/ieee1394/nodemgr.c |   24 
 1 file changed, 16 insertions(+), 8 deletions(-)

--- linux-2.6.20.1.orig/drivers/ieee1394/nodemgr.c
+++ linux-2.6.20.1/drivers/ieee1394/nodemgr.c
@@ -274,7 +274,6 @@ static struct device_driver nodemgr_mid_
 struct device nodemgr_dev_template_host = {
.bus= ieee1394_bus_type,
.release= nodemgr_release_host,
-   .driver = nodemgr_mid_layer_driver,
 };
 
 
@@ -1889,22 +1888,31 @@ int init_ieee1394_nodemgr(void)
 
error = class_register(nodemgr_ne_class);
if (error)
-   return error;
-
+   goto fail_ne;
error = class_register(nodemgr_ud_class);
-   if (error) {
-   class_unregister(nodemgr_ne_class);
-   return error;
-   }
+   if (error)
+   goto fail_ud;
error = driver_register(nodemgr_mid_layer_driver);
+   if (error)
+   goto fail_ml;
+   /* This driver is not used if nodemgr is off (disable_nodemgr=1). */
+   nodemgr_dev_template_host.driver = nodemgr_mid_layer_driver;
+
hpsb_register_highlevel(nodemgr_highlevel);
return 0;
+
+fail_ml:
+   class_unregister(nodemgr_ud_class);
+fail_ud:
+   class_unregister(nodemgr_ne_class);
+fail_ne:
+   return error;
 }
 
 void cleanup_ieee1394_nodemgr(void)
 {
hpsb_unregister_highlevel(nodemgr_highlevel);
-
+   driver_unregister(nodemgr_mid_layer_driver);
class_unregister(nodemgr_ud_class);
class_unregister(nodemgr_ne_class);
 }

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 037/101] : Prevent pseudo garbage in SYNs advertized window

2007-03-07 Thread Greg KH
From: Ilpo Järvinen [EMAIL PROTECTED]

TCP may advertize up to 16-bits window in SYN packets (no window
scaling allowed). At the same time, TCP may have rcv_wnd
(32-bits) that does not fit to 16-bits without window scaling
resulting in pseudo garbage into advertized window from the
low-order bits of rcv_wnd. This can happen at least when
mss = (1wscale) (see tcp_select_initial_window). This patch
fixes the handling of SYN advertized windows (compile tested
only).

In worst case (which is unlikely to occur though), the receiver
advertized window could be just couple of bytes. I'm not sure
that such situation would be handled very well at all by the
receiver!? Fortunately, the situation normalizes after the
first non-SYN ACK is received because it has the correct,
scaled window.

Alternatively, tcp_select_initial_window could be changed to
prevent too large rcv_wnd in the first place.

[ tcp_make_synack() has the same bug, and I've added a fix for
  that to this patch -DaveM ]

Signed-off-by: Ilpo Järvinen [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/tcp_output.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.20.1.orig/net/ipv4/tcp_output.c
+++ linux-2.6.20.1/net/ipv4/tcp_output.c
@@ -481,7 +481,7 @@ static int tcp_transmit_skb(struct sock 
/* RFC1323: The window in SYN  SYN/ACK segments
 * is never scaled.
 */
-   th-window  = htons(tp-rcv_wnd);
+   th-window  = htons(min(tp-rcv_wnd, 65535U));
} else {
th-window  = htons(tcp_select_window(sk));
}
@@ -2160,7 +2160,7 @@ struct sk_buff * tcp_make_synack(struct 
}
 
/* RFC1323: The window in SYN  SYN/ACK segments is never scaled. */
-   th-window = htons(req-rcv_wnd);
+   th-window = htons(min(req-rcv_wnd, 65535U));
 
TCP_SKB_CB(skb)-when = tcp_time_stamp;
tcp_syn_build_options((__be32 *)(th + 1), dst_metric(dst, RTAX_ADVMSS), 
ireq-tstamp_ok,

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 036/101] Fix IPX module unload

2007-03-07 Thread Greg KH
From: Jiri Bohac [EMAIL PROTECTED]

[IPX]: Fix NULL pointer dereference on ipx unload

Fixes a null pointer dereference when unloading the ipx module.

On initialization of the ipx module, registering certain packet
types can fail. When this happens, unloading the module later
dereferences NULL pointers.  This patch fixes that. Please apply.

Signed-off-by: Jiri Bohac [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipx/af_ipx.c |   26 +-
 1 file changed, 17 insertions(+), 9 deletions(-)

--- linux-2.6.20.1.orig/net/ipx/af_ipx.c
+++ linux-2.6.20.1/net/ipx/af_ipx.c
@@ -2035,19 +2035,27 @@ static void __exit ipx_proto_finito(void
 
ipxitf_cleanup();
 
-   unregister_snap_client(pSNAP_datalink);
-   pSNAP_datalink = NULL;
-
-   unregister_8022_client(p8022_datalink);
-   p8022_datalink = NULL;
+   if (pSNAP_datalink) {
+   unregister_snap_client(pSNAP_datalink);
+   pSNAP_datalink = NULL;
+   }
+
+   if (p8022_datalink) {
+   unregister_8022_client(p8022_datalink);
+   p8022_datalink = NULL;
+   }
 
dev_remove_pack(ipx_8023_packet_type);
-   destroy_8023_client(p8023_datalink);
-   p8023_datalink = NULL;
+   if (p8023_datalink) {
+   destroy_8023_client(p8023_datalink);
+   p8023_datalink = NULL;
+   }
 
dev_remove_pack(ipx_dix_packet_type);
-   destroy_EII_client(pEII_datalink);
-   pEII_datalink = NULL;
+   if (pEII_datalink) {
+   destroy_EII_client(pEII_datalink);
+   pEII_datalink = NULL;
+   }
 
proto_unregister(ipx_proto);
sock_unregister(ipx_family_ops.family);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 026/101] USB HID: Fix USB vendor and product IDs endianness for USB HID devices

2007-03-07 Thread Greg KH
From: Julien BLACHE [EMAIL PROTECTED]

[PATCH] USB HID: Fix USB vendor and product IDs endianness for USB HID devices

The USB vendor and product IDs are not byteswapped appropriately, and
thus come out in the wrong endianness when fetched through the evdev
using ioctl() on big endian platforms.

Signed-off-by: Julien BLACHE [EMAIL PROTECTED]
Signed-off-by: Jiri Kosina [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/usb/input/hid-core.c |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.20.1.orig/drivers/usb/input/hid-core.c
+++ linux-2.6.20.1/drivers/usb/input/hid-core.c
@@ -1212,8 +1212,8 @@ static struct hid_device *usb_hid_config
 le16_to_cpu(dev-descriptor.idProduct));
 
hid-bus = BUS_USB;
-   hid-vendor = dev-descriptor.idVendor;
-   hid-product = dev-descriptor.idProduct;
+   hid-vendor = le16_to_cpu(dev-descriptor.idVendor);
+   hid-product = le16_to_cpu(dev-descriptor.idProduct);
 
usb_make_path(dev, hid-phys, sizeof(hid-phys));
strlcat(hid-phys, /input, sizeof(hid-phys));

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 030/101] EHCI: turn off remote wakeup during shutdown

2007-03-07 Thread Greg KH
From: Alan Stern [EMAIL PROTECTED]

This patch (as850b) disables remote wakeup (and everything else!) on
all EHCI ports when the shutdown() method is called.  If remote wakeup
is left active then some systems will reboot instead of powering off.
This fixes Bugzilla #7828.

Signed-off-by: Alan Stern [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/usb/host/ehci-hcd.c |   16 
 1 file changed, 16 insertions(+)

--- linux-2.6.20.1.orig/drivers/usb/host/ehci-hcd.c
+++ linux-2.6.20.1/drivers/usb/host/ehci-hcd.c
@@ -296,6 +296,18 @@ static void ehci_watchdog (unsigned long
spin_unlock_irqrestore (ehci-lock, flags);
 }
 
+/* On some systems, leaving remote wakeup enabled prevents system shutdown.
+ * The firmware seems to think that powering off is a wakeup event!
+ * This routine turns off remote wakeup and everything else, on all ports.
+ */
+static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
+{
+   int port = HCS_N_PORTS(ehci-hcs_params);
+
+   while (port--)
+   writel(PORT_RWC_BITS, ehci-regs-port_status[port]);
+}
+
 /* ehci_shutdown kick in for silicon on any bus (not just pci, etc).
  * This forcibly disables dma and IRQs, helping kexec and other cases
  * where the next system software may expect clean state.
@@ -307,9 +319,13 @@ ehci_shutdown (struct usb_hcd *hcd)
 
ehci = hcd_to_ehci (hcd);
(void) ehci_halt (ehci);
+   ehci_turn_off_all_ports(ehci);
 
/* make BIOS/etc use companion controller during reboot */
writel (0, ehci-regs-configured_flag);
+
+   /* unblock posted writes */
+   readl(ehci-regs-configured_flag);
 }
 
 static void ehci_port_power (struct ehci_hcd *ehci, int is_on)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 028/101] MTD: Fatal regression in drivers/mtd/redboot.c in 2.6.20

2007-03-07 Thread Greg KH
From: David Woodhouse [EMAIL PROTECTED]

[MTD] Fix regression in RedBoot partition scanning

This fixes a regression introduced by the attempt to handle RedBoot FIS
tables which are smaller than an eraseblock, in commit
0b47d654089c5ce3f2ea26a4485db9bcead1e515

It moves the recalculation of the number of slots in the table to the
correct place, and improves the heuristic for when we think we need to
byte-swap what we read from the flash.

Signed-off-by: David Woodhouse [EMAIL PROTECTED]
Cc: Rod Whitby [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/mtd/redboot.c |   19 +++
 1 file changed, 15 insertions(+), 4 deletions(-)

--- linux-2.6.20.1.orig/drivers/mtd/redboot.c
+++ linux-2.6.20.1/drivers/mtd/redboot.c
@@ -94,8 +94,19 @@ static int parse_redboot_partitions(stru
 * (NOTE: this is 'size' not 'data_length'; size is
 * the full size of the entry.)
 */
-   if (swab32(buf[i].size) == master-erasesize) {
+
+   /* RedBoot can combine the FIS directory and
+  config partitions into a single eraseblock;
+  we assume wrong-endian if either the swapped
+  'size' matches the eraseblock size precisely,
+  or if the swapped size actually fits in an
+  eraseblock while the unswapped size doesn't. */
+   if (swab32(buf[i].size) == master-erasesize ||
+   (buf[i].size  master-erasesize
+ swab32(buf[i].size)  master-erasesize)) {
int j;
+   /* Update numslots based on actual FIS 
directory size */
+   numslots = swab32(buf[i].size) / sizeof (struct 
fis_image_desc);
for (j = 0; j  numslots; ++j) {
 
/* A single 0xff denotes a deleted 
entry.
@@ -120,11 +131,11 @@ static int parse_redboot_partitions(stru
swab32s(buf[j].desc_cksum);
swab32s(buf[j].file_cksum);
}
+   } else if (buf[i].size  master-erasesize) {
+   /* Update numslots based on actual FIS 
directory size */
+   numslots = buf[i].size / sizeof(struct 
fis_image_desc);
}
break;
-   } else {
-   /* re-calculate of real numslots */
-   numslots = buf[i].size / sizeof(struct fis_image_desc);
}
}
if (i == numslots) {

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 032/101] Fix recently introduced problem with shutting down a busy NFS server.

2007-03-07 Thread Greg KH
From: NeilBrown [EMAIL PROTECTED]


When the last thread of nfsd exits, it shuts down all related sockets.
It currently uses svc_close_socket to do this, but that only is
immediately effective if the socket is not SK_BUSY.

If the socket is busy - i.e. if a request has arrived that has not yet
been processes - svc_close_socket is not effective and the shutdown
process spins.

So create a new svc_force_close_socket which removes the SK_BUSY flag
is set and then calls svc_close_socket.

Also change some open-codes loops in svc_destroy to use
list_for_each_entry_safe.

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 include/linux/sunrpc/svcsock.h |2 +-
 net/sunrpc/svc.c   |   23 ++-
 net/sunrpc/svcsock.c   |   16 +++-
 3 files changed, 26 insertions(+), 15 deletions(-)

--- linux-2.6.20.1.orig/include/linux/sunrpc/svcsock.h
+++ linux-2.6.20.1/include/linux/sunrpc/svcsock.h
@@ -63,7 +63,7 @@ struct svc_sock {
  * Function prototypes.
  */
 intsvc_makesock(struct svc_serv *, int, unsigned short);
-void   svc_close_socket(struct svc_sock *);
+void   svc_force_close_socket(struct svc_sock *);
 intsvc_recv(struct svc_rqst *, long);
 intsvc_send(struct svc_rqst *);
 void   svc_drop(struct svc_rqst *);
--- linux-2.6.20.1.orig/net/sunrpc/svc.c
+++ linux-2.6.20.1/net/sunrpc/svc.c
@@ -371,6 +371,7 @@ void
 svc_destroy(struct svc_serv *serv)
 {
struct svc_sock *svsk;
+   struct svc_sock *tmp;
 
dprintk(RPC: svc_destroy(%s, %d)\n,
serv-sv_program-pg_name,
@@ -386,22 +387,18 @@ svc_destroy(struct svc_serv *serv)
 
del_timer_sync(serv-sv_temptimer);
 
-   while (!list_empty(serv-sv_tempsocks)) {
-   svsk = list_entry(serv-sv_tempsocks.next,
- struct svc_sock,
- sk_list);
-   svc_close_socket(svsk);
-   }
+   list_for_each_entry_safe(svsk, tmp, serv-sv_tempsocks, sk_list)
+   svc_force_close_socket(svsk);
+
if (serv-sv_shutdown)
serv-sv_shutdown(serv);
 
-   while (!list_empty(serv-sv_permsocks)) {
-   svsk = list_entry(serv-sv_permsocks.next,
- struct svc_sock,
- sk_list);
-   svc_close_socket(svsk);
-   }
-   
+   list_for_each_entry_safe(svsk, tmp, serv-sv_permsocks, sk_list)
+   svc_force_close_socket(svsk);
+
+   BUG_ON(!list_empty(serv-sv_permsocks));
+   BUG_ON(!list_empty(serv-sv_tempsocks));
+
cache_clean_deferred(serv);
 
/* Unregister service with the portmapper */
--- linux-2.6.20.1.orig/net/sunrpc/svcsock.c
+++ linux-2.6.20.1/net/sunrpc/svcsock.c
@@ -80,6 +80,7 @@ static void   svc_delete_socket(struct sv
 static voidsvc_udp_data_ready(struct sock *, int);
 static int svc_udp_recvfrom(struct svc_rqst *);
 static int svc_udp_sendto(struct svc_rqst *);
+static voidsvc_close_socket(struct svc_sock *svsk);
 
 static struct svc_deferred_req *svc_deferred_dequeue(struct svc_sock *svsk);
 static int svc_deferred_recv(struct svc_rqst *rqstp);
@@ -1668,7 +1669,7 @@ svc_delete_socket(struct svc_sock *svsk)
spin_unlock_bh(serv-sv_lock);
 }
 
-void svc_close_socket(struct svc_sock *svsk)
+static void svc_close_socket(struct svc_sock *svsk)
 {
set_bit(SK_CLOSE, svsk-sk_flags);
if (test_and_set_bit(SK_BUSY, svsk-sk_flags))
@@ -1681,6 +1682,19 @@ void svc_close_socket(struct svc_sock *s
svc_sock_put(svsk);
 }
 
+void svc_force_close_socket(struct svc_sock *svsk)
+{
+   set_bit(SK_CLOSE, svsk-sk_flags);
+   if (test_bit(SK_BUSY, svsk-sk_flags)) {
+   /* Waiting to be processed, but no threads left,
+* So just remove it from the waiting list
+*/
+   list_del_init(svsk-sk_ready);
+   clear_bit(SK_BUSY, svsk-sk_flags);
+   }
+   svc_close_socket(svsk);
+}
+
 /*
  * Make a socket for nfsd and lockd
  */

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 017/101] Fix various bugs with aligned reads in RAID5.

2007-03-07 Thread Greg KH
From: Neil Brown [EMAIL PROTECTED]

Fix various bugs with aligned reads in RAID5.

It is possible for raid5 to be sent a bio that is too big
for an underlying device.  So if it is a READ that we
pass stright down to a device, it will fail and confuse
RAID5.

So in 'chunk_aligned_read' we check that the bio fits within the
parameters for the target device and if it doesn't fit, fall back
on reading through the stripe cache and making lots of one-page
requests.

Note that this is the earliest time we can check against the device
because earlier we don't have a lock on the device, so it could change
underneath us.

Also, the code for handling a retry through the cache when a read
fails has not been tested and was badly broken.  This patch fixes that
code.

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/md/raid5.c |   42 +++---
 1 file changed, 39 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/drivers/md/raid5.c
+++ linux-2.6.20.1/drivers/md/raid5.c
@@ -2620,7 +2620,7 @@ static struct bio *remove_bio_from_retry
}
bi = conf-retry_read_aligned_list;
if(bi) {
-   conf-retry_read_aligned = bi-bi_next;
+   conf-retry_read_aligned_list = bi-bi_next;
bi-bi_next = NULL;
bi-bi_phys_segments = 1; /* biased count of active stripes */
bi-bi_hw_segments = 0; /* count of processed stripes */
@@ -2669,6 +2669,27 @@ static int raid5_align_endio(struct bio 
return 0;
 }
 
+static int bio_fits_rdev(struct bio *bi)
+{
+   request_queue_t *q = bdev_get_queue(bi-bi_bdev);
+
+   if ((bi-bi_size9)  q-max_sectors)
+   return 0;
+   blk_recount_segments(q, bi);
+   if (bi-bi_phys_segments  q-max_phys_segments ||
+   bi-bi_hw_segments  q-max_hw_segments)
+   return 0;
+
+   if (q-merge_bvec_fn)
+   /* it's too hard to apply the merge_bvec_fn at this stage,
+* just just give up
+*/
+   return 0;
+
+   return 1;
+}
+
+
 static int chunk_aligned_read(request_queue_t *q, struct bio * raid_bio)
 {
mddev_t *mddev = q-queuedata;
@@ -2715,6 +2736,13 @@ static int chunk_aligned_read(request_qu
align_bi-bi_flags = ~(1  BIO_SEG_VALID);
align_bi-bi_sector += rdev-data_offset;
 
+   if (!bio_fits_rdev(align_bi)) {
+   /* too big in some way */
+   bio_put(align_bi);
+   rdev_dec_pending(rdev, mddev);
+   return 0;
+   }
+
spin_lock_irq(conf-device_lock);
wait_event_lock_irq(conf-wait_for_stripe,
conf-quiesce == 0,
@@ -3107,7 +3135,9 @@ static int  retry_aligned_read(raid5_con
last_sector = raid_bio-bi_sector + (raid_bio-bi_size9);
 
for (; logical_sector  last_sector;
-logical_sector += STRIPE_SECTORS, scnt++) {
+logical_sector += STRIPE_SECTORS,
+sector += STRIPE_SECTORS,
+scnt++) {
 
if (scnt  raid_bio-bi_hw_segments)
/* already done this stripe */
@@ -3123,7 +3153,13 @@ static int  retry_aligned_read(raid5_con
}
 
set_bit(R5_ReadError, sh-dev[dd_idx].flags);
-   add_stripe_bio(sh, raid_bio, dd_idx, 0);
+   if (!add_stripe_bio(sh, raid_bio, dd_idx, 0)) {
+   release_stripe(sh);
+   raid_bio-bi_hw_segments = scnt;
+   conf-retry_read_aligned = raid_bio;
+   return handled;
+   }
+
handle_stripe(sh, NULL);
release_stripe(sh);
handled++;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 023/101] ieee1394: video1394: DMA fix

2007-03-07 Thread Greg KH
From: David Moore [EMAIL PROTECTED]

This together with the phys_to_virt fix in lib/swiotlb.c::swiotlb_sync_sg
fixes video1394 DMA on machines with DMA bounce buffers, especially Intel
x86-64 machines with  3GB RAM.

Signed-off-by: Stefan Richter [EMAIL PROTECTED]
Signed-off-by: David Moore [EMAIL PROTECTED]
Tested-by: Nicolas Turro [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/ieee1394/video1394.c |8 
 1 file changed, 8 insertions(+)

--- linux-2.6.20.1.orig/drivers/ieee1394/video1394.c
+++ linux-2.6.20.1/drivers/ieee1394/video1394.c
@@ -489,6 +489,9 @@ static void wakeup_dma_ir_ctx(unsigned l
reset_ir_status(d, i);
d-buffer_status[d-buffer_prg_assignment[i]] = 
VIDEO1394_BUFFER_READY;

do_gettimeofday(d-buffer_time[d-buffer_prg_assignment[i]]);
+   dma_region_sync_for_cpu(d-dma,
+   d-buffer_prg_assignment[i] * d-buf_size,
+   d-buf_size);
}
}
 
@@ -1096,6 +1099,8 @@ static long video1394_ioctl(struct file 
DBGMSG(ohci-host-id, Starting iso transmit DMA 
ctx=%d,
   d-ctx);
put_timestamp(ohci, d, d-last_buffer);
+   dma_region_sync_for_device(d-dma,
+   v.buffer * d-buf_size, d-buf_size);
 
/* Tell the controller where the first program is */
reg_write(ohci, d-cmdPtr,
@@ -,6 +1116,9 @@ static long video1394_ioctl(struct file 
  Waking up iso transmit dma ctx=%d,
  d-ctx);
put_timestamp(ohci, d, d-last_buffer);
+   dma_region_sync_for_device(d-dma,
+   v.buffer * d-buf_size, d-buf_size);
+
reg_write(ohci, d-ctrlSet, 0x1000);
}
}

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 014/101] USB audio fixes 1

2007-03-07 Thread Greg KH
From: Takashi Iwai [EMAIL PROTECTED]

[PATCH] usbaudio - Fix Oops with broken usb descriptors

This is a patch for ALSA Bug #2724. Some webcams provide bogus
settings with no valid rates. With this patch those are skipped.

Signed-off-by: Gregor Jasny [EMAIL PROTECTED]
Signed-off-by: Takashi Iwai [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 sound/usb/usbaudio.c |6 ++
 1 file changed, 6 insertions(+)

--- linux-2.6.20.1.orig/sound/usb/usbaudio.c
+++ linux-2.6.20.1/sound/usb/usbaudio.c
@@ -2456,6 +2456,7 @@ static int parse_audio_format_rates(stru
 * build the rate table and bitmap flags
 */
int r, idx, c;
+   unsigned int nonzero_rates = 0;
/* this table corresponds to the SNDRV_PCM_RATE_XXX bit */
static unsigned int conv_rates[] = {
5512, 8000, 11025, 16000, 22050, 32000, 44100, 48000,
@@ -2478,6 +2479,7 @@ static int parse_audio_format_rates(stru
fp-altsetting == 5  fp-maxpacksize == 392)
rate = 96000;
fp-rate_table[r] = rate;
+   nonzero_rates |= rate;
if (rate  fp-rate_min)
fp-rate_min = rate;
else if (rate  fp-rate_max)
@@ -2493,6 +2495,10 @@ static int parse_audio_format_rates(stru
if (!found)
fp-needs_knot = 1;
}
+   if (!nonzero_rates) {
+   hwc_debug(All rates were zero. Skipping format!\n);
+   return -1;
+   }
if (fp-needs_knot)
fp-rates |= SNDRV_PCM_RATE_KNOT;
} else {

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 016/101] hda-intel - Dont try to probe invalid codecs

2007-03-07 Thread Greg KH
From: Takashi Iwai [EMAIL PROTECTED]

[ALSA] hda-intel - Don't try to probe invalid codecs

Fix the max number of codecs detected by HD-intel (and compatible)
controllers to 3.  Some hardware reports extra bits as if
connected, and the driver gets confused to probe unexisting codecs.

Signed-off-by: Takashi Iwai [EMAIL PROTECTED]
Signed-off-by: Jaroslav Kysela [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 sound/pci/hda/hda_intel.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/sound/pci/hda/hda_intel.c
+++ linux-2.6.20.1/sound/pci/hda/hda_intel.c
@@ -199,7 +199,7 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO
 
 /* STATESTS int mask: SD2,SD1,SD0 */
 #define STATESTS_INT_MASK  0x07
-#define AZX_MAX_CODECS 4
+#define AZX_MAX_CODECS 3
 
 /* SD_CTL bits */
 #define SD_CTL_STREAM_RESET0x01/* stream reset bit */

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 012/101] Missing critical phys_to_virt in lib/swiotlb.c

2007-03-07 Thread Greg KH
From: David Moore [EMAIL PROTECTED]

Missing critical phys_to_virt in lib/swiotlb.c

Adds missing call to phys_to_virt() in the
lib/swiotlb.c:swiotlb_sync_sg() function.  Without this change, a kernel
panic will always occur whenever a SWIOTLB bounce buffer from a
scatter-gather list gets synced.  Affected are especially Intel x86_64
machines with more than about 3 GB RAM.

Signed-off-by: David Moore [EMAIL PROTECTED]
Signed-off-by: Stefan Richter [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 lib/swiotlb.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/lib/swiotlb.c
+++ linux-2.6.20.1/lib/swiotlb.c
@@ -750,7 +750,7 @@ swiotlb_sync_sg(struct device *hwdev, st
 
for (i = 0; i  nelems; i++, sg++)
if (sg-dma_address != SG_ENT_PHYS_ADDRESS(sg))
-   sync_single(hwdev, (void *) sg-dma_address,
+   sync_single(hwdev, phys_to_virt(sg-dma_address),
sg-dma_length, dir, target);
 }
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 019/101] Fix TCP FIN handling

2007-03-07 Thread Greg KH
From: John Heffner [EMAIL PROTECTED]

We can accidently spit out a huge burst of packets with TSO
when the FIN back is piggybacked onto the final packet.

[TCP]: Don't apply FIN exception to full TSO segments.

Signed-off-by: John Heffner [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv4/tcp_output.c |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.20.1.orig/net/ipv4/tcp_output.c
+++ linux-2.6.20.1/net/ipv4/tcp_output.c
@@ -965,7 +965,8 @@ static inline unsigned int tcp_cwnd_test
u32 in_flight, cwnd;
 
/* Don't be strict about the congestion window for the final FIN.  */
-   if (TCP_SKB_CB(skb)-flags  TCPCB_FLAG_FIN)
+   if ((TCP_SKB_CB(skb)-flags  TCPCB_FLAG_FIN) 
+   tcp_skb_pcount(skb) == 1)
return 1;
 
in_flight = tcp_packets_in_flight(tp);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 000/101] 2.6.20-stable review

2007-03-07 Thread Greg KH
After many weeks of backlogs, I've finally flushed out all of the
pending -stable patches, bringing this series to a whopping 101 patches
pending for the next 2.6.20.2 release.

If everyone could please take the time to review them and let me know if
there are any issues with any of these being applied.

Also, if there are any patches that I am somehow missing that should go
into the 2.6.20-stable tree, please forward them on to the
[EMAIL PROTECTED] alias.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email [EMAIL PROTECTED] to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Friday March 9, 17:00:00 UTC.  Anything
received after that time might be too late.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 006/101] knfsd: Fix a race in closing NFSd connections.

2007-03-07 Thread Greg KH
If you lose this race, it can iput a socket inode twice and you
get a BUG in fs/inode.c

When I added the option for user-space to close a socket,
I added some cruft to svc_delete_socket so that I could call
that function when closing a socket per user-space request.

This was the wrong thing to do.  I should have just set SK_CLOSE
and let normal mechanisms do the work.

Not only wrong, but buggy.  The locking is all wrong and it openned
up a race where-by a socket could be closed twice.

So this patch:
  Introduces svc_close_socket which sets SK_CLOSE then either leave
  the close up to a thread, or calls svc_delete_socket if it can
  get SK_BUSY.

  Adds a bias to sk_busy which is removed when SK_DEAD is set,
  This avoid races around shutting down the socket.

  Changes several 'spin_lock' to 'spin_lock_bh' where the _bh 
  was missing.

Bugzilla-url: http://bugzilla.kernel.org/show_bug.cgi?id=7916

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 include/linux/sunrpc/svcsock.h |2 -
 net/sunrpc/svc.c   |4 +--
 net/sunrpc/svcsock.c   |   52 +
 3 files changed, 41 insertions(+), 17 deletions(-)

--- linux-2.6.20.1.orig/include/linux/sunrpc/svcsock.h
+++ linux-2.6.20.1/include/linux/sunrpc/svcsock.h
@@ -63,7 +63,7 @@ struct svc_sock {
  * Function prototypes.
  */
 intsvc_makesock(struct svc_serv *, int, unsigned short);
-void   svc_delete_socket(struct svc_sock *);
+void   svc_close_socket(struct svc_sock *);
 intsvc_recv(struct svc_rqst *, long);
 intsvc_send(struct svc_rqst *);
 void   svc_drop(struct svc_rqst *);
--- linux-2.6.20.1.orig/net/sunrpc/svc.c
+++ linux-2.6.20.1/net/sunrpc/svc.c
@@ -386,7 +386,7 @@ svc_destroy(struct svc_serv *serv)
svsk = list_entry(serv-sv_tempsocks.next,
  struct svc_sock,
  sk_list);
-   svc_delete_socket(svsk);
+   svc_close_socket(svsk);
}
if (serv-sv_shutdown)
serv-sv_shutdown(serv);
@@ -395,7 +395,7 @@ svc_destroy(struct svc_serv *serv)
svsk = list_entry(serv-sv_permsocks.next,
  struct svc_sock,
  sk_list);
-   svc_delete_socket(svsk);
+   svc_close_socket(svsk);
}

cache_clean_deferred(serv);
--- linux-2.6.20.1.orig/net/sunrpc/svcsock.c
+++ linux-2.6.20.1/net/sunrpc/svcsock.c
@@ -62,6 +62,12 @@
  * after a clear, the socket must be read/accepted
  *  if this succeeds, it must be set again.
  * SK_CLOSE can set at any time. It is never cleared.
+ *  sk_inuse contains a bias of '1' until SK_DEAD is set.
+ * so when sk_inuse hits zero, we know the socket is dead
+ * and no-one is using it.
+ *  SK_DEAD can only be set while SK_BUSY is held which ensures
+ * no other thread will be using the socket or will try to
+ *set SK_DEAD.
  *
  */
 
@@ -70,6 +76,7 @@
 
 static struct svc_sock *svc_setup_socket(struct svc_serv *, struct socket *,
 int *errp, int pmap_reg);
+static voidsvc_delete_socket(struct svc_sock *svsk);
 static voidsvc_udp_data_ready(struct sock *, int);
 static int svc_udp_recvfrom(struct svc_rqst *);
 static int svc_udp_sendto(struct svc_rqst *);
@@ -329,8 +336,9 @@ void svc_reserve(struct svc_rqst *rqstp,
 static inline void
 svc_sock_put(struct svc_sock *svsk)
 {
-   if (atomic_dec_and_test(svsk-sk_inuse) 
-   test_bit(SK_DEAD, svsk-sk_flags)) {
+   if (atomic_dec_and_test(svsk-sk_inuse)) {
+   BUG_ON(! test_bit(SK_DEAD, svsk-sk_flags));
+
dprintk(svc: releasing dead socket\n);
if (svsk-sk_sock-file)
sockfd_put(svsk-sk_sock);
@@ -520,7 +528,7 @@ svc_sock_names(char *buf, struct svc_ser
 
if (!serv)
return 0;
-   spin_lock(serv-sv_lock);
+   spin_lock_bh(serv-sv_lock);
list_for_each_entry(svsk, serv-sv_permsocks, sk_list) {
int onelen = one_sock_name(buf+len, svsk);
if (toclose  strcmp(toclose, buf+len) == 0)
@@ -528,12 +536,12 @@ svc_sock_names(char *buf, struct svc_ser
else
len += onelen;
}
-   spin_unlock(serv-sv_lock);
+   spin_unlock_bh(serv-sv_lock);
if (closesk)
/* Should unregister with portmap, but you cannot
 * unregister just one protocol...
 */
-   svc_delete_socket(closesk);
+   svc_close_socket(closesk);
else if (toclose)
return -ENOENT;
return len;
@@ -683,6 +691,11 @@ svc_udp_recvfrom(struct svc_rqst 

[patch 010/101] bcm43xx: Fix for oops on ampdu status

2007-03-07 Thread Greg KH

From: Michael Buesch [EMAIL PROTECTED]

If bcm43xx were to process an afterburner (ampdu) status response, Linux would 
oops. The
ampdu and intermediate status bits are properly named.

Signed-off-by: Michael Buesch [EMAIL PROTECTED]
Signed-off-by: Larry Finger [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/wireless/bcm43xx/bcm43xx_main.c |8 +++-
 drivers/net/wireless/bcm43xx/bcm43xx_xmit.h |   10 ++
 2 files changed, 5 insertions(+), 13 deletions(-)

--- linux-2.6.20.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ linux-2.6.20.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1453,12 +1453,10 @@ static void handle_irq_transmit_status(s
 
bcm43xx_debugfs_log_txstat(bcm, stat);
 
-   if (stat.flags  BCM43xx_TXSTAT_FLAG_IGNORE)
+   if (stat.flags  BCM43xx_TXSTAT_FLAG_AMPDU)
+   continue;
+   if (stat.flags  BCM43xx_TXSTAT_FLAG_INTER)
continue;
-   if (!(stat.flags  BCM43xx_TXSTAT_FLAG_ACK)) {
-   //TODO: packet was not acked (was lost)
-   }
-   //TODO: There are more (unknown) flags to test. see 
bcm43xx_main.h
 
if (bcm43xx_using_pio(bcm))
bcm43xx_pio_handle_xmitstatus(bcm, stat);
--- linux-2.6.20.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
+++ linux-2.6.20.1/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus {
u16 unknown; //FIXME
 };
 
-#define BCM43xx_TXSTAT_FLAG_ACK0x01
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10
-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40
-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80
+#define BCM43xx_TXSTAT_FLAG_AMPDU  0x10
+#define BCM43xx_TXSTAT_FLAG_INTER  0x20
 
 u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate);
 u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 003/101] rtc-pcf8563: detect polarity of century bit automatically

2007-03-07 Thread Greg KH

From: Atsushi Nemoto [EMAIL PROTECTED]

The usage of the century bit was inverted on 2.6.19 following to PCF8563's
description, but it was not match to usage suggested by RTC8564's
datasheet.  Anyway what MO_C=1 means can vary on each platform.  This patch
is to detect its polarity in get_datetime routine.  The default value of
c_polarity is 0 (MO_C=1 means 19xx) so that this patch does not change
current behavior even if get_datetime was not called before set_datetime.

Signed-off-by: Atsushi Nemoto [EMAIL PROTECTED]
Cc: Jean-Baptiste Maneyrol [EMAIL PROTECTED]
Cc: David Brownell [EMAIL PROTECTED]
Cc: Alessandro Zummo [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/rtc/rtc-pcf8563.c |   40 ++--
 1 file changed, 34 insertions(+), 6 deletions(-)

--- linux-2.6.20.1.orig/drivers/rtc/rtc-pcf8563.c
+++ linux-2.6.20.1/drivers/rtc/rtc-pcf8563.c
@@ -53,6 +53,25 @@ I2C_CLIENT_INSMOD;
 #define PCF8563_SC_LV  0x80 /* low voltage */
 #define PCF8563_MO_C   0x80 /* century */
 
+struct pcf8563 {
+   struct i2c_client client;
+   /*
+* The meaning of MO_C bit varies by the chip type.
+* From PCF8563 datasheet: this bit is toggled when the years
+* register overflows from 99 to 00
+*   0 indicates the century is 20xx
+*   1 indicates the century is 19xx
+* From RTC8564 datasheet: this bit indicates change of
+* century. When the year digit data overflows from 99 to 00,
+* this bit is set. By presetting it to 0 while still in the
+* 20th century, it will be set in year 2000, ...
+* There seems no reliable way to know how the system use this
+* bit.  So let's do it heuristically, assuming we are live in
+* 1970...2069.
+*/
+   int c_polarity; /* 0: MO_C=1 means 19xx, otherwise MO_C=1 means 20xx */
+};
+
 static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind);
 static int pcf8563_detach(struct i2c_client *client);
 
@@ -62,6 +81,7 @@ static int pcf8563_detach(struct i2c_cli
  */
 static int pcf8563_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 {
+   struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
unsigned char buf[13] = { PCF8563_REG_ST1 };
 
struct i2c_msg msgs[] = {
@@ -94,8 +114,12 @@ static int pcf8563_get_datetime(struct i
tm-tm_mday = BCD2BIN(buf[PCF8563_REG_DM]  0x3F);
tm-tm_wday = buf[PCF8563_REG_DW]  0x07;
tm-tm_mon = BCD2BIN(buf[PCF8563_REG_MO]  0x1F) - 1; /* rtc mn 1-12 */
-   tm-tm_year = BCD2BIN(buf[PCF8563_REG_YR])
-   + (buf[PCF8563_REG_MO]  PCF8563_MO_C ? 0 : 100);
+   tm-tm_year = BCD2BIN(buf[PCF8563_REG_YR]);
+   if (tm-tm_year  70)
+   tm-tm_year += 100; /* assume we are in 1970...2069 */
+   /* detect the polarity heuristically. see note above. */
+   pcf8563-c_polarity = (buf[PCF8563_REG_MO]  PCF8563_MO_C) ?
+   (tm-tm_year = 100) : (tm-tm_year  100);
 
dev_dbg(client-dev, %s: tm is secs=%d, mins=%d, hours=%d, 
mday=%d, mon=%d, year=%d, wday=%d\n,
@@ -114,6 +138,7 @@ static int pcf8563_get_datetime(struct i
 
 static int pcf8563_set_datetime(struct i2c_client *client, struct rtc_time *tm)
 {
+   struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
int i, err;
unsigned char buf[9];
 
@@ -135,7 +160,7 @@ static int pcf8563_set_datetime(struct i
 
/* year and century */
buf[PCF8563_REG_YR] = BIN2BCD(tm-tm_year % 100);
-   if (tm-tm_year  100)
+   if (pcf8563-c_polarity ? (tm-tm_year = 100) : (tm-tm_year  100))
buf[PCF8563_REG_MO] |= PCF8563_MO_C;
 
buf[PCF8563_REG_DW] = tm-tm_wday  0x07;
@@ -248,6 +273,7 @@ static struct i2c_driver pcf8563_driver 
 
 static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind)
 {
+   struct pcf8563 *pcf8563;
struct i2c_client *client;
struct rtc_device *rtc;
 
@@ -260,11 +286,12 @@ static int pcf8563_probe(struct i2c_adap
goto exit;
}
 
-   if (!(client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL))) {
+   if (!(pcf8563 = kzalloc(sizeof(struct pcf8563), GFP_KERNEL))) {
err = -ENOMEM;
goto exit;
}
 
+   client = pcf8563-client;
client-addr = address;
client-driver = pcf8563_driver;
client-adapter = adapter;
@@ -301,7 +328,7 @@ exit_detach:
i2c_detach_client(client);
 
 exit_kfree:
-   kfree(client);
+   kfree(pcf8563);
 
 exit:
return err;
@@ -309,6 +336,7 @@ exit:
 
 static int pcf8563_detach(struct i2c_client *client)
 {
+   struct pcf8563 *pcf8563 = container_of(client, struct pcf8563, client);
int err;
struct rtc_device *rtc = i2c_get_clientdata(client);
 
@@ -318,7 

[patch 004/101] prism54: correct assignment of DOT1XENABLE in WE-19 codepaths

2007-03-07 Thread Greg KH

Correct assignment of DOT1XENABLE in WE-19 codepaths.
RX_UNENCRYPTED_EAPOL = 1 really means setting DOT1XENABLE _off_, and
vice versa.  The original WE-19 patch erroneously reversed that.  This
patch fixes association with unencrypted and WEP networks when using
wpa_supplicant.

It also adds two missing break statements that, left out, could result
in incorrect card configuration.

Applies to (I think) 2.6.19 and later.

Signed-off-by: Dan Williams [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/wireless/prism54/isl_ioctl.c |8 +++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/net/wireless/prism54/isl_ioctl.c
+++ linux-2.6.20.1/drivers/net/wireless/prism54/isl_ioctl.c
@@ -1395,11 +1395,16 @@ static int prism54_set_auth(struct net_d
break;
 
case IW_AUTH_RX_UNENCRYPTED_EAPOL:
-   dot1x = param-value ? 1 : 0;
+   /* dot1x should be the opposite of RX_UNENCRYPTED_EAPOL;
+* turn off dot1x when  allowing recepit of unencrypted eapol
+* frames, turn on dot1x when we disallow receipt
+*/
+   dot1x = param-value ? 0x00 : 0x01;
break;
 
case IW_AUTH_PRIVACY_INVOKED:
privinvoked = param-value ? 1 : 0;
+   break;
 
case IW_AUTH_DROP_UNENCRYPTED:
exunencrypt = param-value ? 1 : 0;
@@ -1589,6 +1594,7 @@ static int prism54_set_encodeext(struct 
}
key.type = DOT11_PRIV_TKIP;
key.length = KEY_SIZE_TKIP;
+   break;
default:
return -EINVAL;
}

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 007/101] Keys: Fix key serial number collision handling

2007-03-07 Thread Greg KH
From: David Howells [EMAIL PROTECTED]

[PATCH] Keys: Fix key serial number collision handling

Fix the key serial number collision avoidance code in key_alloc_serial().

This didn't use to be so much of a problem as the key serial numbers were
allocated from a simple incremental counter, and it would have to go through
two billion keys before it could possibly encounter a collision.  However, now
that random numbers are used instead, collisions are much more likely.

This is fixed by finding a hole in the rbtree where the next unused serial
number ought to be and using that by going almost back to the top of the
insertion routine and redoing the insertion with the new serial number rather
than trying to be clever and attempting to work out the insertion point
pointer directly.

This fixes kernel BZ #7727.

Signed-off-by: David Howells [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 security/keys/key.c |   33 ++---
 1 file changed, 14 insertions(+), 19 deletions(-)

--- linux-2.6.20.1.orig/security/keys/key.c
+++ linux-2.6.20.1/security/keys/key.c
@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru
 
spin_lock(key_serial_lock);
 
+attempt_insertion:
parent = NULL;
p = key_serial_tree.rb_node;
 
@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru
else
goto serial_exists;
}
-   goto insert_here;
+
+   /* we've found a suitable hole - arrange for this key to occupy it */
+   rb_link_node(key-serial_node, parent, p);
+   rb_insert_color(key-serial_node, key_serial_tree);
+
+   spin_unlock(key_serial_lock);
+   return;
 
/* we found a key with the proposed serial number - walk the tree from
 * that point looking for the next unused serial number */
 serial_exists:
for (;;) {
key-serial++;
-   if (key-serial  2)
-   key-serial = 2;
-
-   if (!rb_parent(parent))
-   p = key_serial_tree.rb_node;
-   else if (rb_parent(parent)-rb_left == parent)
-   p = (rb_parent(parent)-rb_left);
-   else
-   p = (rb_parent(parent)-rb_right);
+   if (key-serial  3) {
+   key-serial = 3;
+   goto attempt_insertion;
+   }
 
parent = rb_next(parent);
if (!parent)
-   break;
+   goto attempt_insertion;
 
xkey = rb_entry(parent, struct key, serial_node);
if (key-serial  xkey-serial)
-   goto insert_here;
+   goto attempt_insertion;
}
 
-   /* we've found a suitable hole - arrange for this key to occupy it */
-insert_here:
-   rb_link_node(key-serial_node, parent, p);
-   rb_insert_color(key-serial_node, key_serial_tree);
-
-   spin_unlock(key_serial_lock);
-
 } /* end key_alloc_serial() */
 
 /*/

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 009/101] bcm43xx: Fix for oops on resume

2007-03-07 Thread Greg KH

There is a kernel oops on bcm43xx when resuming due to an overly tight timeout 
loop.

Signed-off-by: Larry Finger[EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/wireless/bcm43xx/bcm43xx.h |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ linux-2.6.20.1/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -21,7 +21,7 @@
 #define PFXKBUILD_MODNAME : 
 
 #define BCM43xx_SWITCH_CORE_MAX_RETRIES50
-#define BCM43xx_IRQWAIT_MAX_RETRIES50
+#define BCM43xx_IRQWAIT_MAX_RETRIES100
 
 #define BCM43xx_IO_SIZE8192
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 011/101] AGP: intel-agp bugfix

2007-03-07 Thread Greg KH
From: Dave Jones [EMAIL PROTECTED]

On Sun, Feb 04, 2007 at 04:51:38PM +0100, Eric Piel wrote:
  Hello,
  
  I've got a regression in 2.6.20-rc7 (-rc6 was fine) due to commit 
  4b95320fc4d21b0ff2f8604305dd6c851aff6096 ([AGPGART] intel_agp: restore 
  graphics device's pci space early in resume).

I think the key to this failure is the last line here ..

  agpgart-intel :00:00.0: resuming
  PM: Writing back config space on device :00:02.0 at offset f (was 10b, 
  writing 0)
  PM: Writing back config space on device :00:02.0 at offset d (was dc, 
  writing 0)
  PM: Writing back config space on device :00:02.0 at offset b (was 
  10161025, writing 0)
  PM: Writing back config space on device :00:02.0 at offset 5 (was 
  f400, writing 0)
  PM: Writing back config space on device :00:02.0 at offset 4 (was 
  f808, writing 0)
  PM: Writing back config space on device :00:02.0 at offset 2 (was 
  311, writing 0)
  PM: Writing back config space on device :00:02.0 at offset 1 (was 
  2b7, writing 0)
  PM: Writing back config space on device :00:02.0 at offset 0 (was 
  11328086, writing 0)
  agpgart: Unable to remap memory.

This then blows up the next access to intel_i810_private.registers, which 
happens to
be intel_i810_insert_entries.

Either we need .suspend methods which unmap these regions, or we need
to skip trying to map them a second time on resume.

There's an ugly patch below which does the latter. Give it a try?

The intel-agp suspend/resume code has really grown into something
of a monster, and could use some refactoring in a big way.

Dave


From: Dave Jones [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/char/agp/intel-agp.c |   14 --
 1 file changed, 8 insertions(+), 6 deletions(-)

--- linux-2.6.20.1.orig/drivers/char/agp/intel-agp.c
+++ linux-2.6.20.1/drivers/char/agp/intel-agp.c
@@ -117,13 +117,15 @@ static int intel_i810_configure(void)
 
current_size = A_SIZE_FIX(agp_bridge-current_size);
 
-   pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, temp);
-   temp = 0xfff8;
-
-   intel_i810_private.registers = ioremap(temp, 128 * 4096);
if (!intel_i810_private.registers) {
-   printk(KERN_ERR PFX Unable to remap memory.\n);
-   return -ENOMEM;
+   pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, 
temp);
+   temp = 0xfff8;
+
+   intel_i810_private.registers = ioremap(temp, 128 * 4096);
+   if (!intel_i810_private.registers) {
+   printk(KERN_ERR PFX Unable to remap memory.\n);
+   return -ENOMEM;
+   }
}
 
if ((readl(intel_i810_private.registers+I810_DRAM_CTL)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 100/101] ATA: convert GSI to irq on ia64

2007-03-07 Thread Greg KH

From: Zhang, Yanmin [EMAIL PROTECTED]

If an ATA drive uses legacy mode, ata driver will choose 14 and 15 as the
fixed irq number.  On ia64 platform, such numbers are GSI and should be
converted to irq vector.

Signed-off-by: Zhang Yanmin [EMAIL PROTECTED]
Cc: Jeff Garzik [EMAIL PROTECTED]
Cc: Tony Luck [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/ia64/Kconfig |1 +
 include/asm-ia64/libata-portmap.h |   12 
 2 files changed, 13 insertions(+)

--- linux-2.6.20.1.orig/arch/ia64/Kconfig
+++ linux-2.6.20.1/arch/ia64/Kconfig
@@ -11,6 +11,7 @@ menu Processor type and features
 
 config IA64
bool
+   select ATA_NONSTANDARD if ATA
default y
help
  The Itanium Processor Family is Intel's 64-bit successor to
--- /dev/null
+++ linux-2.6.20.1/include/asm-ia64/libata-portmap.h
@@ -0,0 +1,12 @@
+#ifndef __ASM_IA64_LIBATA_PORTMAP_H
+#define __ASM_IA64_LIBATA_PORTMAP_H
+
+#define ATA_PRIMARY_CMD0x1F0
+#define ATA_PRIMARY_CTL0x3F6
+#define ATA_PRIMARY_IRQ(dev)   isa_irq_to_vector(14)
+
+#define ATA_SECONDARY_CMD  0x170
+#define ATA_SECONDARY_CTL  0x376
+#define ATA_SECONDARY_IRQ(dev) isa_irq_to_vector(15)
+
+#endif

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 101/101] gfs2: fix locking mistake

2007-03-07 Thread Greg KH
From: Josef Whiter [EMAIL PROTECTED]

Fix a locking mistake in the quota code, we do a mutex_lock instead of a
mutex_unlock.

Signed-off-by: Josef Whiter [EMAIL PROTECTED]
Cc: Steven Whitehouse [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 fs/gfs2/quota.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/fs/gfs2/quota.c
+++ linux-2.6.20.1/fs/gfs2/quota.c
@@ -279,7 +279,7 @@ static int bh_get(struct gfs2_quota_data
(bh-b_data + sizeof(struct gfs2_meta_header) +
 offset * sizeof(struct gfs2_quota_change));
 
-   mutex_lock(sdp-sd_quota_mutex);
+   mutex_unlock(sdp-sd_quota_mutex);
 
return 0;
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 099/101] pktcdvd: Correctly set cmd_len field in pkt_generic_packet

2007-03-07 Thread Greg KH

From: Gerhard Dirschl [EMAIL PROTECTED]

Fixes http://bugzilla.kernel.org/show_bug.cgi?id=7810 - a silly
copy-paste bug introduced by the latest change.

Signed-off-by: Gerhard Dirschl [EMAIL PROTECTED]
Cc: Peter Osterlund [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/block/pktcdvd.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/block/pktcdvd.c
+++ linux-2.6.20.1/drivers/block/pktcdvd.c
@@ -777,7 +777,7 @@ static int pkt_generic_packet(struct pkt
goto out;
}
 
-   rq-cmd_len = COMMAND_SIZE(rq-cmd[0]);
+   rq-cmd_len = COMMAND_SIZE(cgc-cmd[0]);
memcpy(rq-cmd, cgc-cmd, CDROM_PACKET_SIZE);
if (sizeof(rq-cmd)  CDROM_PACKET_SIZE)
memset(rq-cmd + CDROM_PACKET_SIZE, 0, sizeof(rq-cmd) - 
CDROM_PACKET_SIZE);

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 1/1] Input: add sensable phantom driver

2007-03-07 Thread Greg KH
On Wed, Mar 07, 2007 at 05:38:59PM +0100, Jiri Slaby wrote:
 Dmitry Torokhov napsal(a):
 +static int __devinit phantom_probe(struct pci_dev *pdev,
 +   const struct pci_device_id *pci_id)
 +{
 +   struct phantom_device *pht;
 +   unsigned int minor;
 +   int retval;
 +
 +   retval = pci_enable_device(pdev);
 +   if (retval)
 +   goto err;
 +
 +   minor = phantom_get_free();
 +   if (minor == PHANTOM_MAX_MINORS) {
 +   dev_err(pdev-dev, too many devices found!\n);
 +   retval = -EIO;
 +   goto err;
 +   }
 +
 +   phantom_devices[minor] = 1;
 
 Locking? In face of multithreaded PCI probes it might be needed.
 
 I think, this is the same issue?
 
 cite from=akpm date=12/19/06
 On Sat, 16 Dec 2006 02:09:48 +0100 (CET)
 Jiri Slaby [EMAIL PROTECTED] wrote:
 
  isicom, fix probe race
 
  Fix two race conditions in the probe function with mutex.
 
  ...
 
   static int __devinit isicom_probe(struct pci_dev *pdev,
const struct pci_device_id *ent)
   {
  + static DEFINE_MUTEX(probe_lock);
 
 hm.  How can isicom_probe() race with itself?  Even with the dreaded
 multithreaded-pci-probing?  It's only called once, by a single thread.
 
 Confused.
 /cite
 
 What do you think? Greg?

We used to be able to call the pci probe functions from different
threads for different devices.  But people seemed to like to enable
options that told them their box could blow up into tiny pieces and then
got upset when it did.  So I removed the option :(

So you don't have to worry about it now, but note that it could race
with the remove function if two different devices are in the system, one
being added and one removed at the same time.  So you should protect it
with a spinlock or something.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 057/101] UML - Fix 2.6.20 hang

2007-03-07 Thread Greg KH
From: Jeff Dike [EMAIL PROTECTED]

A previous cleanup misused need_poll, which had a fairly broken
interface.  It implemented a growable array, changing the used
elements count itself, but leaving it up to the caller to fill in the
actual elements, including the entire array if the array had to be
reallocated.  This worked because the previous users were switching
between two such structures, and the elements were copied from the
inactive array to the active array after making sure the active array
had enough room.

maybe_sigio_broken was made to use need_poll, but it was operating on
a single array, so when the buffer was reallocated, the previous
contents were lost.

This patch makes need_poll implement more sane semantics.  It merely
assures that the array is of the proper size and that the contents are
preserved.  It is up to the caller to adjust the used elements count
and to ensure that the proper elements are resent.

This manifested itself as a hang in 2.6.20 as the uninitialized buffer
convinced UML that one of its own file descriptors didn't support
SIGIO and needed to be watched by poll in a separate thread.  The
result was an interrupt flood as control traffic over this descriptor
sparked interrupts, which resulted in more control traffic, ad nauseum.

Signed-off-by: Jeff Dike [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/um/os-Linux/sigio.c |   38 --
 1 file changed, 20 insertions(+), 18 deletions(-)

--- linux-2.6.20.1.orig/arch/um/os-Linux/sigio.c
+++ linux-2.6.20.1/arch/um/os-Linux/sigio.c
@@ -97,20 +97,22 @@ static int write_sigio_thread(void *unus
 
 static int need_poll(struct pollfds *polls, int n)
 {
-   if(n = polls-size){
-   polls-used = n;
+   struct pollfd *new;
+
+   if(n = polls-size)
return 0;
-   }
-   kfree(polls-poll);
-   polls-poll = um_kmalloc_atomic(n * sizeof(struct pollfd));
-   if(polls-poll == NULL){
+
+   new = um_kmalloc_atomic(n * sizeof(struct pollfd));
+   if(new == NULL){
printk(need_poll : failed to allocate new pollfds\n);
-   polls-size = 0;
-   polls-used = 0;
return -ENOMEM;
}
+
+   memcpy(new, polls-poll, polls-used * sizeof(struct pollfd));
+   kfree(polls-poll);
+
+   polls-poll = new;
polls-size = n;
-   polls-used = n;
return 0;
 }
 
@@ -171,15 +173,15 @@ int add_sigio_fd(int fd)
goto out;
}
 
-   n = current_poll.used + 1;
-   err = need_poll(next_poll, n);
+   n = current_poll.used;
+   err = need_poll(next_poll, n + 1);
if(err)
goto out;
 
-   for(i = 0; i  current_poll.used; i++)
-   next_poll.poll[i] = current_poll.poll[i];
-
-   next_poll.poll[n - 1] = *p;
+   memcpy(next_poll.poll, current_poll.poll,
+  current_poll.used * sizeof(struct pollfd));
+   next_poll.poll[n] = *p;
+   next_poll.used = n + 1;
update_thread();
  out:
sigio_unlock();
@@ -214,6 +216,7 @@ int ignore_sigio_fd(int fd)
if(p-fd != fd)
next_poll.poll[n++] = *p;
}
+   next_poll.used = current_poll.used - 1;
 
update_thread();
  out:
@@ -331,10 +334,9 @@ void maybe_sigio_broken(int fd, int read
 
sigio_lock();
err = need_poll(all_sigio_fds, all_sigio_fds.used + 1);
-   if(err){
-   printk(maybe_sigio_broken - failed to add pollfd\n);
+   if(err)
goto out;
-   }
+
all_sigio_fds.poll[all_sigio_fds.used++] =
((struct pollfd) { .fd  = fd,
   .events  = read ? POLLIN : POLLOUT,

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 002/101] x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted

2007-03-07 Thread Greg KH

Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and
forced by binary compatibility. UML/32bit breaks because of this - since it is 
wise
enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host
kernels.

Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had:

   default:
return sys_ptrace(request, pid, addr, data);

Instead here we have:
case PTRACE_GET_THREAD_AREA:
case ...:
return sys_ptrace(request, pid, addr, data);

default:
return -EINVAL;

This change was a style change - when a case is added, it must be explicitly
tested this way. In this case, not enough testing was done.

Cc: Andi Kleen [EMAIL PROTECTED]
Signed-off-by: Paolo 'Blaisorblade' Giarrusso [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/x86_64/ia32/ptrace32.c |1 +
 1 file changed, 1 insertion(+)

--- linux-2.6.20.1.orig/arch/x86_64/ia32/ptrace32.c
+++ linux-2.6.20.1/arch/x86_64/ia32/ptrace32.c
@@ -243,6 +243,7 @@ asmlinkage long sys32_ptrace(long reques
case PTRACE_SINGLESTEP:
case PTRACE_DETACH:
case PTRACE_SYSCALL:
+   case PTRACE_OLDSETOPTIONS:
case PTRACE_SETOPTIONS:
case PTRACE_SET_THREAD_AREA:
case PTRACE_GET_THREAD_AREA:

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 022/101] Fix compile error for e500 core based processors

2007-03-07 Thread Greg KH
From: Rojhalat Ibrahim [EMAIL PROTECTED]

We get the following compiler error:

   CC  arch/ppc/kernel/ppc_ksyms.o
arch/ppc/kernel/ppc_ksyms.c:275: error: '__mtdcr' undeclared here (not in a 
function)
arch/ppc/kernel/ppc_ksyms.c:275: warning: type defaults to 'int' in declaration 
of '__mtdcr'
arch/ppc/kernel/ppc_ksyms.c:276: error: '__mfdcr' undeclared here (not in a 
function)
arch/ppc/kernel/ppc_ksyms.c:276: warning: type defaults to 'int' in declaration 
of '__mfdcr'
make[1]: *** [arch/ppc/kernel/ppc_ksyms.o] Error 1

This is due to the EXPORT_SYMBOL for __mtdcr/__mfdcr not having the proper 
CONFIG protection

Signed-off-by: Rojhalat Ibrahim [EMAIL PROTECTED]
Signed-off-by: Kumar Gala [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/ppc/kernel/ppc_ksyms.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/arch/ppc/kernel/ppc_ksyms.c
+++ linux-2.6.20.1/arch/ppc/kernel/ppc_ksyms.c
@@ -270,7 +270,7 @@ EXPORT_SYMBOL(mmu_hash_lock); /* For MOL
 extern long *intercept_table;
 EXPORT_SYMBOL(intercept_table);
 #endif /* CONFIG_PPC_STD_MMU */
-#if defined(CONFIG_40x) || defined(CONFIG_BOOKE)
+#ifdef CONFIG_PPC_DCR_NATIVE
 EXPORT_SYMBOL(__mtdcr);
 EXPORT_SYMBOL(__mfdcr);
 #endif

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 096/101] bug in gdth.c crashing machine

2007-03-07 Thread Greg KH

From: Joerg Dorchain [EMAIL PROTECTED]

Undocumented...

Signed-off-by: Joerg Dorchain [EMAIL PROTECTED]
Acked-by: Achim Leubner [EMAIL PROTECTED]
Cc: James Bottomley [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/scsi/gdth.c |2 ++
 1 file changed, 2 insertions(+)

--- linux-2.6.20.1.orig/drivers/scsi/gdth.c
+++ linux-2.6.20.1/drivers/scsi/gdth.c
@@ -3092,6 +3092,7 @@ static int gdth_fill_raw_cmd(int hanum,S
 cmdp-u.raw64.direction  = 
 gdth_direction_tab[scp-cmnd[0]]==DOU ? 
GDTH_DATA_OUT:GDTH_DATA_IN;
 memcpy(cmdp-u.raw64.cmd,scp-cmnd,16);
+cmdp-u.raw64.sg_ranz= 0;
 } else {
 cmdp-u.raw.reserved   = 0;
 cmdp-u.raw.mdisc_time = 0;
@@ -3108,6 +3109,7 @@ static int gdth_fill_raw_cmd(int hanum,S
 cmdp-u.raw.direction  = 
 gdth_direction_tab[scp-cmnd[0]]==DOU ? 
GDTH_DATA_OUT:GDTH_DATA_IN;
 memcpy(cmdp-u.raw.cmd,scp-cmnd,12);
+cmdp-u.raw.sg_ranz= 0;
 }
 
 if (scp-use_sg) {

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 045/101] md: Fix raid10 recovery problem.

2007-03-07 Thread Greg KH
From: NeilBrown [EMAIL PROTECTED]

There are two errors that can lead to recovery problems with raid10
when used in 'far' more (not the default).

Due to a '' instead of '=' the wrong block is located which would
result in garbage being written to some random location, quite
possible outside the range of the device, causing the newly
reconstructed device to fail.

The device size calculation had some rounding errors (it didn't round
when it should) and so recovery would go a few blocks too far which
would again cause a write to a random block address and probably
a device error.

The code for working with device sizes was fairly confused and spread
out, so this has been tided up a bit.

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/md/raid10.c |   38 --
 1 file changed, 20 insertions(+), 18 deletions(-)

--- linux-2.6.20.1.orig/drivers/md/raid10.c
+++ linux-2.6.20.1/drivers/md/raid10.c
@@ -429,7 +429,7 @@ static sector_t raid10_find_virt(conf_t 
if (dev  0)
dev += conf-raid_disks;
} else {
-   while (sector  conf-stride) {
+   while (sector = conf-stride) {
sector -= conf-stride;
if (dev  conf-near_copies)
dev += conf-raid_disks - conf-near_copies;
@@ -1801,6 +1801,7 @@ static sector_t sync_request(mddev_t *md
for (k=0; kconf-copies; k++)
if 
(r10_bio-devs[k].devnum == i)
break;
+   BUG_ON(k == conf-copies);
bio = r10_bio-devs[1].bio;
bio-bi_next = biolist;
biolist = bio;
@@ -2021,19 +2022,30 @@ static int run(mddev_t *mddev)
if (!conf-tmppage)
goto out_free_conf;
 
+   conf-mddev = mddev;
+   conf-raid_disks = mddev-raid_disks;
conf-near_copies = nc;
conf-far_copies = fc;
conf-copies = nc*fc;
conf-far_offset = fo;
conf-chunk_mask = (sector_t)(mddev-chunk_size9)-1;
conf-chunk_shift = ffz(~mddev-chunk_size) - 9;
+   size = mddev-size  (conf-chunk_shift-1);
+   sector_div(size, fc);
+   size = size * conf-raid_disks;
+   sector_div(size, nc);
+   /* 'size' is now the number of chunks in the array */
+   /* calculate used chunks per device in 'stride' */
+   stride = size * conf-copies;
+   sector_div(stride, conf-raid_disks);
+   mddev-size = stride   (conf-chunk_shift-1);
+
if (fo)
-   conf-stride = 1  conf-chunk_shift;
-   else {
-   stride = mddev-size  (conf-chunk_shift-1);
+   stride = 1;
+   else
sector_div(stride, fc);
-   conf-stride = stride  conf-chunk_shift;
-   }
+   conf-stride = stride  conf-chunk_shift;
+
conf-r10bio_pool = mempool_create(NR_RAID10_BIOS, r10bio_pool_alloc,
r10bio_pool_free, conf);
if (!conf-r10bio_pool) {
@@ -2063,8 +2075,6 @@ static int run(mddev_t *mddev)
 
disk-head_position = 0;
}
-   conf-raid_disks = mddev-raid_disks;
-   conf-mddev = mddev;
spin_lock_init(conf-device_lock);
INIT_LIST_HEAD(conf-retry_list);
 
@@ -2106,16 +2116,8 @@ static int run(mddev_t *mddev)
/*
 * Ok, everything is just fine now
 */
-   if (conf-far_offset) {
-   size = mddev-size  (conf-chunk_shift-1);
-   size *= conf-raid_disks;
-   size = conf-chunk_shift;
-   sector_div(size, conf-far_copies);
-   } else
-   size = conf-stride * conf-raid_disks;
-   sector_div(size, conf-near_copies);
-   mddev-array_size = size/2;
-   mddev-resync_max_sectors = size;
+   mddev-array_size = size  (conf-chunk_shift-1);
+   mddev-resync_max_sectors = size  conf-chunk_shift;
 
mddev-queue-unplug_fn = raid10_unplug;
mddev-queue-issue_flush_fn = raid10_issue_flush;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 021/101] md: Avoid possible BUG_ON in md bitmap handling.

2007-03-07 Thread Greg KH
From: Neil Brown [EMAIL PROTECTED]

md/bitmap tracks how many active write requests are pending on blocks
associated with each bit in the bitmap, so that it knows when it can
clear the bit (when count hits zero).

The counter has 14 bits of space, so if there are ever more than 16383,
we cannot cope.

Currently the code just calles BUG_ON as all drivers have request queue
limits much smaller than this.

However is seems that some don't.  Apparently some multipath configurations
can allow more than 16383 concurrent write requests.

So, in this unlikely situation, instead of calling BUG_ON we now wait
for the count to drop down a bit.  This requires a new wait_queue_head,
some waiting code, and a wakeup call.

Tested by limiting the counter to 20 instead of 16383 (writes go a lot slower
in that case...).

Signed-off-by: Neil Brown [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

diff .prev/drivers/md/bitmap.c ./drivers/md/bitmap.c
---
 drivers/md/bitmap.c |   22 +-
 include/linux/raid/bitmap.h |1 +
 2 files changed, 22 insertions(+), 1 deletion(-)

--- linux-2.6.20.1.orig/drivers/md/bitmap.c
+++ linux-2.6.20.1/drivers/md/bitmap.c
@@ -1160,6 +1160,22 @@ int bitmap_startwrite(struct bitmap *bit
return 0;
}
 
+   if (unlikely((*bmc  COUNTER_MAX) == COUNTER_MAX)) {
+   DEFINE_WAIT(__wait);
+   /* note that it is safe to do the prepare_to_wait
+* after the test as long as we do it before dropping
+* the spinlock.
+*/
+   prepare_to_wait(bitmap-overflow_wait, __wait,
+   TASK_UNINTERRUPTIBLE);
+   spin_unlock_irq(bitmap-lock);
+   bitmap-mddev-queue
+   -unplug_fn(bitmap-mddev-queue);
+   schedule();
+   finish_wait(bitmap-overflow_wait, __wait);
+   continue;
+   }
+
switch(*bmc) {
case 0:
bitmap_file_set_bit(bitmap, offset);
@@ -1169,7 +1185,7 @@ int bitmap_startwrite(struct bitmap *bit
case 1:
*bmc = 2;
}
-   BUG_ON((*bmc  COUNTER_MAX) == COUNTER_MAX);
+
(*bmc)++;
 
spin_unlock_irq(bitmap-lock);
@@ -1207,6 +1223,9 @@ void bitmap_endwrite(struct bitmap *bitm
if (!success  ! (*bmc  NEEDED_MASK))
*bmc |= NEEDED_MASK;
 
+   if ((*bmc  COUNTER_MAX) == COUNTER_MAX)
+   wake_up(bitmap-overflow_wait);
+
(*bmc)--;
if (*bmc = 2) {
set_page_attr(bitmap,
@@ -1431,6 +1450,7 @@ int bitmap_create(mddev_t *mddev)
spin_lock_init(bitmap-lock);
atomic_set(bitmap-pending_writes, 0);
init_waitqueue_head(bitmap-write_wait);
+   init_waitqueue_head(bitmap-overflow_wait);
 
bitmap-mddev = mddev;
 
--- linux-2.6.20.1.orig/include/linux/raid/bitmap.h
+++ linux-2.6.20.1/include/linux/raid/bitmap.h
@@ -247,6 +247,7 @@ struct bitmap {
 
atomic_t pending_writes; /* pending writes to the bitmap file */
wait_queue_head_t write_wait;
+   wait_queue_head_t overflow_wait;
 
 };
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 081/101] kexec: Fix CONFIG_SMP=n compilation V2 (ia64)

2007-03-07 Thread Greg KH

From: Magnus Damm [EMAIL PROTECTED]

Kexec support for 2.6.20 on ia64 does not build properly using a config
made up by CONFIG_SMP=n and CONFIG_HOTPLUG_CPU=n:

  CC  arch/ia64/kernel/machine_kexec.o
arch/ia64/kernel/machine_kexec.c: In function `machine_shutdown':
arch/ia64/kernel/machine_kexec.c:77: warning: implicit declaration of function 
`cpu_down'
  AS  arch/ia64/kernel/relocate_kernel.o
  CC  arch/ia64/kernel/crash.o
arch/ia64/kernel/crash.c: In function `kdump_cpu_freeze':
arch/ia64/kernel/crash.c:139: warning: implicit declaration of function 
`ia64_jump_to_sal'
arch/ia64/kernel/crash.c:139: error: `sal_boot_rendez_state' undeclared (first 
use in this function)
arch/ia64/kernel/crash.c:139: error: (Each undeclared identifier is reported 
only once
arch/ia64/kernel/crash.c:139: error: for each function it appears in.)
arch/ia64/kernel/crash.c: At top level:
arch/ia64/kernel/crash.c:84: warning: 'kdump_wait_cpu_freeze' defined but not 
used
make[1]: *** [arch/ia64/kernel/crash.o] Error 1
make: *** [arch/ia64/kernel] Error 2

Signed-off-by: Magnus Damm [EMAIL PROTECTED]
Acked-by: Simon Horman [EMAIL PROTECTED]
Acked-by: Jay Lan [EMAIL PROTECTED]
Cc: Tony Luck [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 arch/ia64/kernel/crash.c |   11 +++
 arch/ia64/kernel/machine_kexec.c |2 ++
 2 files changed, 9 insertions(+), 4 deletions(-)

--- linux-2.6.20.1.orig/arch/ia64/kernel/crash.c
+++ linux-2.6.20.1/arch/ia64/kernel/crash.c
@@ -79,6 +79,7 @@ crash_save_this_cpu()
final_note(buf);
 }
 
+#ifdef CONFIG_SMP
 static int
 kdump_wait_cpu_freeze(void)
 {
@@ -91,6 +92,7 @@ kdump_wait_cpu_freeze(void)
}
return 1;
 }
+#endif
 
 void
 machine_crash_shutdown(struct pt_regs *pt)
@@ -132,11 +134,12 @@ kdump_cpu_freeze(struct unw_frame_info *
atomic_inc(kdump_cpu_freezed);
kdump_status[cpuid] = 1;
mb();
-   if (cpuid == 0) {
-   for (;;)
-   cpu_relax();
-   } else
+#ifdef CONFIG_HOTPLUG_CPU
+   if (cpuid != 0)
ia64_jump_to_sal(sal_boot_rendez_state[cpuid]);
+#endif
+   for (;;)
+   cpu_relax();
 }
 
 static int
--- linux-2.6.20.1.orig/arch/ia64/kernel/machine_kexec.c
+++ linux-2.6.20.1/arch/ia64/kernel/machine_kexec.c
@@ -70,12 +70,14 @@ void machine_kexec_cleanup(struct kimage
 
 void machine_shutdown(void)
 {
+#ifdef CONFIG_HOTPLUG_CPU
int cpu;
 
for_each_online_cpu(cpu) {
if (cpu != smp_processor_id())
cpu_down(cpu);
}
+#endif
kexec_disable_iosapic();
 }
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 059/101] bcm43xx: Fix assertion failures in interrupt handler

2007-03-07 Thread Greg KH

From: Pavel Roskin [EMAIL PROTECTED]

In the bcm43xx interrupt handler, sanity checks are wrongly done before the
verification that the interrupt is for the bcm43xx.

Signed-off-by: Pavel Roskin [EMAIL PROTECTED]
Signed-off-by: Larry Finger [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/wireless/bcm43xx/bcm43xx_main.c |6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-2.6.20.1.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ linux-2.6.20.1/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -1864,9 +1864,6 @@ static irqreturn_t bcm43xx_interrupt_han
 
spin_lock(bcm-irq_lock);
 
-   assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
-   assert(bcm-current_core-id == BCM43xx_COREID_80211);
-
reason = bcm43xx_read32(bcm, BCM43xx_MMIO_GEN_IRQ_REASON);
if (reason == 0x) {
/* irq not for us (shared irq) */
@@ -1877,6 +1874,9 @@ static irqreturn_t bcm43xx_interrupt_han
if (!reason)
goto out;
 
+   assert(bcm43xx_status(bcm) == BCM43xx_STAT_INITIALIZED);
+   assert(bcm-current_core-id == BCM43xx_COREID_80211);
+
bcm-dma_reason[0] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA0_REASON)
  0x0001DC00;
bcm-dma_reason[1] = bcm43xx_read32(bcm, BCM43xx_MMIO_DMA1_REASON)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 097/101] revert drivers/net/tulip/dmfe: support basic carrier detection

2007-03-07 Thread Greg KH

From: Andrew Morton [EMAIL PROTECTED]

Revert 7628b0a8c01a02966d2228bdf741ddedb128e8f8.  Thomas Bachler
reports:

  Commit 7628b0a8c01a02966d2228bdf741ddedb128e8f8 (drivers/net/tulip/dmfe:
  support basic carrier detection) breaks networking on my Davicom DM9009. 
  ethtool always reports there is no link.  tcpdump shows incoming packets,
  but TX is disabled.  Reverting the above patch fixes the problem.


Cc: Samuel Thibault [EMAIL PROTECTED]
Cc: Jeff Garzik [EMAIL PROTECTED]
Cc: Valerie Henson [EMAIL PROTECTED]
Cc: Thomas Bachler [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/net/tulip/dmfe.c |9 +
 1 file changed, 1 insertion(+), 8 deletions(-)

--- linux-2.6.20.1.orig/drivers/net/tulip/dmfe.c
+++ linux-2.6.20.1/drivers/net/tulip/dmfe.c
@@ -187,7 +187,7 @@ struct rx_desc {
 struct dmfe_board_info {
u32 chip_id;/* Chip vendor/Device ID */
u32 chip_revision;  /* Chip revision */
-   struct DEVICE *dev; /* net device */
+   struct DEVICE *next_dev;/* next device */
struct pci_dev *pdev;   /* PCI device */
spinlock_t lock;
 
@@ -399,8 +399,6 @@ static int __devinit dmfe_init_one (stru
/* Init system  device */
db = netdev_priv(dev);
 
-   db-dev = dev;
-
/* Allocate Tx/Rx descriptor memory */
db-desc_pool_ptr = pci_alloc_consistent(pdev, sizeof(struct tx_desc) * 
DESC_ALL_CNT + 0x20, db-desc_pool_dma_ptr);
db-buf_pool_ptr = pci_alloc_consistent(pdev, TX_BUF_ALLOC * 
TX_DESC_CNT + 4, db-buf_pool_dma_ptr);
@@ -428,7 +426,6 @@ static int __devinit dmfe_init_one (stru
dev-poll_controller = poll_dmfe;
 #endif
dev-ethtool_ops = netdev_ethtool_ops;
-   netif_carrier_off(db-dev);
spin_lock_init(db-lock);
 
pci_read_config_dword(pdev, 0x50, pci_pmr);
@@ -1053,7 +1050,6 @@ static void netdev_get_drvinfo(struct ne
 
 static const struct ethtool_ops netdev_ethtool_ops = {
.get_drvinfo= netdev_get_drvinfo,
-   .get_link   = ethtool_op_get_link,
 };
 
 /*
@@ -1148,7 +1144,6 @@ static void dmfe_timer(unsigned long dat
/* Link Failed */
DMFE_DBUG(0, Link Failed, tmp_cr12);
db-link_failed = 1;
-   netif_carrier_off(db-dev);
 
/* For Force 10/100M Half/Full mode: Enable Auto-Nego mode */
/* AUTO or force 1M Homerun/Longrun don't need */
@@ -1171,8 +1166,6 @@ static void dmfe_timer(unsigned long dat
if ( (db-media_mode  DMFE_AUTO) 
dmfe_sense_speed(db) )
db-link_failed = 1;
-   else
-   netif_carrier_on(db-dev);
dmfe_process_mode(db);
/* SHOW_MEDIA_TYPE(db-op_mode); */
}

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 029/101] IPV6: HASHTABLES: Use appropriate seed for caluculating ehash index.

2007-03-07 Thread Greg KH
From: YOSHIFUJI Hideaki [EMAIL PROTECTED]

Tetsuo Handa [EMAIL PROTECTED] told me that connect(2) with TCPv6
socket almost always took a few minutes to return when we did not have any
ports available in the range of net.ipv4.ip_local_port_range.

The reason was that we used incorrect seed for calculating index of
hash when we check established sockets in __inet6_check_established().

Signed-off-by: YOSHIFUJI Hideaki [EMAIL PROTECTED]
Signed-off-by: David S. Miller [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/ipv6/inet6_hashtables.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.20.1.orig/net/ipv6/inet6_hashtables.c
+++ linux-2.6.20.1/net/ipv6/inet6_hashtables.c
@@ -172,7 +172,7 @@ static int __inet6_check_established(str
const struct in6_addr *saddr = np-daddr;
const int dif = sk-sk_bound_dev_if;
const __portpair ports = INET_COMBINED_PORTS(inet-dport, lport);
-   const unsigned int hash = inet6_ehashfn(daddr, inet-num, saddr,
+   const unsigned int hash = inet6_ehashfn(daddr, lport, saddr,
inet-dport);
struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
struct sock *sk2;

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 033/101] UHCI: fix port resume problem

2007-03-07 Thread Greg KH
From: Alan Stern [EMAIL PROTECTED]

This patch (as863) fixes a problem encountered sometimes when resuming
a port on a UHCI controller.  The hardware may turn off the
Resume-Detect bit before turning off the Suspend bit, leading usbcore
to think that the port is still suspended and the resume has failed.
The patch makes uhci_finish_suspend() wait until both bits are safely
off.

Signed-off-by: Alan Stern [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/usb/host/uhci-hub.c |   11 +++
 1 file changed, 7 insertions(+), 4 deletions(-)

--- linux-2.6.20.1.orig/drivers/usb/host/uhci-hub.c
+++ linux-2.6.20.1/drivers/usb/host/uhci-hub.c
@@ -33,6 +33,9 @@ static __u8 root_hub_hub_des[] =
 /* status change bits:  nonzero writes will clear */
 #define RWC_BITS   (USBPORTSC_OCC | USBPORTSC_PEC | USBPORTSC_CSC)
 
+/* suspend/resume bits: port suspended or port resuming */
+#define SUSPEND_BITS   (USBPORTSC_SUSP | USBPORTSC_RD)
+
 /* A port that either is connected or has a changed-bit set will prevent
  * us from AUTO_STOPPING.
  */
@@ -96,8 +99,8 @@ static void uhci_finish_suspend(struct u
int status;
int i;
 
-   if (inw(port_addr)  (USBPORTSC_SUSP | USBPORTSC_RD)) {
-   CLR_RH_PORTSTAT(USBPORTSC_SUSP | USBPORTSC_RD);
+   if (inw(port_addr)  SUSPEND_BITS) {
+   CLR_RH_PORTSTAT(SUSPEND_BITS);
if (test_bit(port, uhci-resuming_ports))
set_bit(port, uhci-port_c_suspend);
 
@@ -107,7 +110,7 @@ static void uhci_finish_suspend(struct u
 * Experiments show that some controllers take longer, so
 * we'll poll for completion. */
for (i = 0; i  10; ++i) {
-   if (!(inw(port_addr)  USBPORTSC_RD))
+   if (!(inw(port_addr)  SUSPEND_BITS))
break;
udelay(1);
}
@@ -289,7 +292,7 @@ static int uhci_hub_control(struct usb_h
wPortStatus |= USB_PORT_STAT_CONNECTION;
if (status  USBPORTSC_PE) {
wPortStatus |= USB_PORT_STAT_ENABLE;
-   if (status  (USBPORTSC_SUSP | USBPORTSC_RD))
+   if (status  SUSPEND_BITS)
wPortStatus |= USB_PORT_STAT_SUSPEND;
}
if (status  USBPORTSC_OC)

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 013/101] USB: fix concurrent buffer access in the hub driver

2007-03-07 Thread Greg KH

This patch (as849) fixes a bug in the USB hub driver.  A single
pre-allocated buffer is used for all port status reads, but nothing
guarantees exclusive use of the buffer.  A mutex is added to provide
this guarantee.

Signed-off-by: Alan Stern [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/usb/core/hub.c |6 ++
 1 file changed, 6 insertions(+)

--- linux-2.6.20.1.orig/drivers/usb/core/hub.c
+++ linux-2.6.20.1/drivers/usb/core/hub.c
@@ -44,6 +44,7 @@ struct usb_hub {
struct usb_hub_status   hub;
struct usb_port_status  port;
}   *status;/* buffer for status reports */
+   struct mutexstatus_mutex;   /* for the status buffer */
 
int error;  /* last reported error */
int nerrors;/* track consecutive errors */
@@ -538,6 +539,7 @@ static int hub_hub_status(struct usb_hub
 {
int ret;
 
+   mutex_lock(hub-status_mutex);
ret = get_hub_status(hub-hdev, hub-status-hub);
if (ret  0)
dev_err (hub-intfdev,
@@ -547,6 +549,7 @@ static int hub_hub_status(struct usb_hub
*change = le16_to_cpu(hub-status-hub.wHubChange); 
ret = 0;
}
+   mutex_unlock(hub-status_mutex);
return ret;
 }
 
@@ -620,6 +623,7 @@ static int hub_configure(struct usb_hub 
ret = -ENOMEM;
goto fail;
}
+   mutex_init(hub-status_mutex);
 
hub-descriptor = kmalloc(sizeof(*hub-descriptor), GFP_KERNEL);
if (!hub-descriptor) {
@@ -1418,6 +1422,7 @@ static int hub_port_status(struct usb_hu
 {
int ret;
 
+   mutex_lock(hub-status_mutex);
ret = get_port_status(hub-hdev, port1, hub-status-port);
if (ret  4) {
dev_err (hub-intfdev,
@@ -1429,6 +1434,7 @@ static int hub_port_status(struct usb_hu
*change = le16_to_cpu(hub-status-port.wPortChange); 
ret = 0;
}
+   mutex_unlock(hub-status_mutex);
return ret;
 }
 

--
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [2.6 patch] remove the broken PCI_MULTITHREAD_PROBE option

2007-03-27 Thread Greg KH
On Tue, Mar 27, 2007 at 01:03:51PM +0200, Cornelia Huck wrote:
 On Tue, 27 Mar 2007 03:02:51 +0200,
 Adrian Bunk [EMAIL PROTECTED] wrote:
 
  This patch removes the PCI_MULTITHREAD_PROBE option that had already 
  been marked as broken.
  
  Signed-off-by: Adrian Bunk [EMAIL PROTECTED]
  
  ---
  
   Documentation/pci.txt|4 ---
   drivers/base/dd.c|   41 ++-
   drivers/pci/Kconfig  |   25 ---
   drivers/pci/pci-driver.c |   15 --
   include/linux/device.h   |1 
   5 files changed, 3 insertions(+), 83 deletions(-)
 
 Greg, what about driver-core-per-subsystem-multithreaded-probing.patch?
 PCI_MULTITHREAD_PROBE shoudn't be broken with that, only in mainline?

Do you want to enable PCI multithreaded probing using your patch?  I
don't think the world is ready for pci multithreaded probing as was
determined by the zillion of bug reports from people who like to enable
config options that state in big letters, THIS WILL BREAK YOUR BOX...

And I'm still questioning if we should add your patch at all, as I don't
think any other subsystems need it.  Do you?

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: (usagi-core 32640) Re: [linux-usb-devel] [PATCH 0/2] [SERIAL] [USB] fixed to skip NULL entry in struct serial usb_serial_port.

2007-03-27 Thread Greg KH
On Mon, Mar 26, 2007 at 09:38:15AM +0900, Noriaki TAKAMIYA wrote:
 Hi,
 
  Sun, 25 Mar 2007 08:55:21 -0700
  [Subject: (usagi-core 32640) Re: [linux-usb-devel] [PATCH 0/2] [SERIAL] 
  [USB] fixed to skip NULL entry in struct serial usb_serial_port.]
  Greg KH [EMAIL PROTECTED] wrote...
 
 Yes, this problem was already fixed.
  
  Great, thanks for testing.  So I guess both of these patches are no
  longer necessary, right?
 
   I think so. But I wonder if usb_get_serial_port_data() should check
   the argument for the other drivers.

I don't think it is really necessary, do you?

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: new sysfs layout and ethernet device names

2007-03-27 Thread Greg KH
On Tue, Mar 27, 2007 at 11:17:43PM -0400, Bill Nottingham wrote:
 Kay Sievers ([EMAIL PROTECTED]) said: 
  If you *do* try to use one of these names, the rename will succeed...
  partway. The link in /sys/class/net is renamed, the directory is
  not (as it obviously can't rename on top of whatever is already there.)
  Various networking tools then break in assorted ways due to the
  naming disconnect.
  
  Going back to the deprecated layout makes these names available again -
  it's possible (although not necessarily likely) that the new layout
  will break someone's device configuration if they upgrade kernels,
  even if the rest of their tools are updated for the new layout.
  
  There will be a directory at the bus-device with the name of the
  class, that glues together the bus-devices and the class-devices in
  the unified tree:
   
  http://git.kernel.org/?p=linux/kernel/git/gregkh/patches.git;a=blob;f=driver/driver-core-fix-namespace-issue-with-devices-assigned-to-classes.patch;hb=HEAD
  
  So the network-interface(s) will be in their own directory net,
  below the bus-device, and don't conflict with the existing attributes.
 
 So, the layout will change again?

If you follow the rules in Documentation/ABI/testing/sysfs-class your
program will not have any problems.

And yes, it will change by adding another subdirectory in the device
tree, but just follow the link from the /sys/class/ directorys and you
will be fine.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: new sysfs layout and ethernet device names

2007-03-29 Thread Greg KH
On Wed, Mar 28, 2007 at 08:41:38PM -0400, Bill Nottingham wrote:
 Greg KH ([EMAIL PROTECTED]) said: 
  If you follow the rules in Documentation/ABI/testing/sysfs-class your
  program will not have any problems.
 
 Oh, of *course*. We add interfaces and then claim years later,
 after code has been written, Oh, you shouldn't be using that! in
 documentation. Meanwhile, such code using the old interface will still
 a) continue to compile b) continue to run without any sort of warnings.
 
 If interfaces have to change, so be it. But changing the rules for
 using them years after it's implemented and then claiming you didn't
 read the instructions is pretty lame.

That documentation has been in the kernel tree for almost a full year:
commit c18f6365fdbaf30611a8822afcd7097865dcaa32
Author: Greg Kroah-Hartman [EMAIL PROTECTED]
Date:   Thu Apr 27 14:10:12 2006 -0700

[PATCH] Add kernel-userspace ABI stability documentation

And Kay and I have been saying to not to rely on directories for over
two years now...

Anyway, yes, older code should still just work if you enable the
CONFIG_SYSFS_DEPRECATED config option in the kernel, that is what it is
there for.

If you have any problems with that option enabled, please let me know
and I will be glad to fix it up.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: new sysfs layout and ethernet device names

2007-03-29 Thread Greg KH
On Thu, Mar 29, 2007 at 11:29:05PM -0400, Bill Nottingham wrote:
 Greg KH ([EMAIL PROTECTED]) said: 
   If interfaces have to change, so be it. But changing the rules for
   using them years after it's implemented and then claiming you didn't
   read the instructions is pretty lame.
  
  That documentation has been in the kernel tree for almost a full year:
 
 It has a date on it. I'm not blind. That doesn't change the fact that
 that documentation:
 
  Date:   Thu Apr 27 14:10:12 2006 -0700
 
 postdates the interface it's describing by at *least* two years. Which
 was the point of my mail that you conveniently ignored - retroactively
 deciding which parts of the interface you export to userspace shouldn't be
 used falls way short of best practices.

I am not disagreeing with that, that is why the config option is
present.

  Anyway, yes, older code should still just work if you enable the
  CONFIG_SYSFS_DEPRECATED config option in the kernel, that is what it is
  there for.
 
 It appears to... the point was that (as far as the code is concerned)
 it's a silent break. Of course, code that expects the 'current' layout
 will then break when this new change is made, unless you add
 CONFIG_SYSFS_SLIGHTLY_LESS_DEPRECATED?

Well, the idea is that over time, older things will move under this
config option.  If you disable it, you will have a cleaner sysfs tree,
but if you enable it, it should all just look the same.

Now some people have proposed versioning the sysfs interface (1, 2, 3,
etc.) and have a config option for that.  I don't know if that's really
necessary just yet, but am considering it for future changes.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [bug] hung bootup in various drivers, was: 2.6.21-rc5: known regressions

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 02:04:16PM +0200, Ingo Molnar wrote:
 
 i just found a new category of driver regressions in 2.6.21, doing 
 allyesconfig bzImage bootup tests: the init methods of various drivers 
 hangs in driver_unregister().
 
 It is caused by this problem: the semantics of driver_unregister() [also 
 implicitly called in pci_driver_unregister()] has apparently changed 
 recently. If a driver does:
 
   pci_register_driver(my_driver);
   ...
   if (some_failure) {
   pci_unregister_driver(my_driver);
   ...
   }
 
 it will hang the bootup in the following piece of code:
 
  drivers/base/driver.c:
 
   void driver_unregister(struct device_driver * drv)
   {
  bus_remove_driver(drv);
  wait_for_completion(drv-unloaded);
 
 the completion is never done - because nobody removes the bus while the 
 init is still happening, obviously. (and bootup is serialized anyway)
 
 now, the majority of drivers does the driver unregistry from its 
 module-cleanup function, so it's not affected by this problem. But if 
 you apply the debug patch attached further below, and do an allyesconfig 
 bzImage bootup, there's 3 hits already:
 
  BUG: at drivers/base/driver.c:187 driver_unregister()
   [c0105ff9] show_trace_log_lvl+0x19/0x2e
   [c01063e2] show_trace+0x12/0x14
   [c01063f8] dump_stack+0x14/0x16
   [c063f7e6] driver_unregister+0x3d/0x43
   [c0488048] pci_unregister_driver+0x10/0x5f
   [c1b5f7c7] slgt_init+0x9b/0x1ca
   [c1b31a2d] init+0x15d/0x2bd
   [c0105bc3] kernel_thread_helper+0x7/0x10
 
  BUG: at drivers/base/driver.c:187 driver_unregister()
   [c0105ff9] show_trace_log_lvl+0x19/0x2e
   [c01063e2] show_trace+0x12/0x14
   [c01063f8] dump_stack+0x14/0x16
   [c063f7e6] driver_unregister+0x3d/0x43
   [c0488048] pci_unregister_driver+0x10/0x5f
   [c0619505] init_ipmi_si+0x70a/0x738
   [c1b31a2d] init+0x15d/0x2bd
   [c0105bc3] kernel_thread_helper+0x7/0x10
 
  BUG: at drivers/base/driver.c:187 driver_unregister()
   [c0105ff9] show_trace_log_lvl+0x19/0x2e
   [c01063e2] show_trace+0x12/0x14
   [c01063f8] dump_stack+0x14/0x16
   [c063f7e6] driver_unregister+0x3d/0x43
   [c0488048] pci_unregister_driver+0x10/0x5f
   [c1b6d2d8] tlan_probe+0x2dd/0x30e
   [c1b31a2d] init+0x15d/0x2bd
   [c0105bc3] kernel_thread_helper+0x7/0x10
 
 possibly more could trigger. Each of these 3 places caused an actual 
 bootup hang on my testbox, so these are real regressions and need to be 
 fixed.
 
 because there are a good number of drivers that do 
 pci_unregister_device() from their init function, and because i cannot 
 see anything obviously wrong in doing an unregister call after a 
 failure, i think it's driver_unregister() that needs to be fixed. Greg, 
 what do you think?

Yes, we should allow the ability to call unregister_driver from within
the module_init function.

But I don't understand what is causing you to see this problem.  Who is
holding the reference on the struct device at this point in time?  Is it
the fact that userspace has some files open and it hasn't released them
yet?

I don't see anything implicit in the driver_unregister() path that
should not work from within the module_init() path.  Kay, am I missing
anything here?

(patch left below for Kay's benefit)

thanks,

greg k-h

 Index: linux/drivers/base/driver.c
 ===
 --- linux.orig/drivers/base/driver.c
 +++ linux/drivers/base/driver.c
 @@ -183,7 +183,8 @@ int driver_register(struct device_driver
  void driver_unregister(struct device_driver * drv)
  {
   bus_remove_driver(drv);
 - wait_for_completion(drv-unloaded);
 + if (!drv-unloaded.done)
 + WARN_ON(1);
  }
  
  /**
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [bug] fixed_init(): BUG: at drivers/base/core.c:120 device_release(), was: 2.6.21-rc5: known regressions

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 02:06:57PM +0200, Ingo Molnar wrote:
 
 there's a new type of message in allyesconfig-bzImage bootup test:
 
 Calling initcall 0xc1b6d692: fixed_init+0x0/0x33()
 Fixed PHY: Registered new driver
 Device '[EMAIL PROTECTED]:1' does not have a release() function, it is broken 
 and must be fixed.
 BUG: at drivers/base/core.c:120 device_release()
  [c0105ff9] show_trace_log_lvl+0x19/0x2e
  [c01063e2] show_trace+0x12/0x14
  [c01063f8] dump_stack+0x14/0x16
  [c063cddf] device_release+0x7c/0x7e
  [c0476c32] kobject_cleanup+0x44/0x5e
  [c0476c57] kobject_release+0xb/0xd
  [c04773ef] kref_put+0x63/0x71
  [c0476757] kobject_put+0x14/0x16
  [c063ceef] put_device+0x11/0x13
  [c063d943] device_unregister+0x12/0x15
  [c07337d1] fixed_mdio_register_device+0x210/0x23b
  [c1b6d6b0] fixed_init+0x1e/0x33
  [c1b31a2d] init+0x15d/0x2bd
  [c0105bc3] kernel_thread_helper+0x7/0x10
  ===
 Device '[EMAIL PROTECTED]:1' does not have a release() function, it is broken 
 and must be fixed.
 BUG: at drivers/base/core.c:120 device_release()
  [c0105ff9] show_trace_log_lvl+0x19/0x2e
  [c01063e2] show_trace+0x12/0x14
  [c01063f8] dump_stack+0x14/0x16
  [c063cddf] device_release+0x7c/0x7e
  [c0476c32] kobject_cleanup+0x44/0x5e
  [c0476c57] kobject_release+0xb/0xd
  [c04773ef] kref_put+0x63/0x71
  [c0476757] kobject_put+0x14/0x16
  [c063ceef] put_device+0x11/0x13
  [c063d943] device_unregister+0x12/0x15
  [c07337d1] fixed_mdio_register_device+0x210/0x23b
  [c1b6d6c1] fixed_init+0x2f/0x33
  [c1b31a2d] init+0x15d/0x2bd
  [c0105bc3] kernel_thread_helper+0x7/0x10

That means that whatever driver has fixed_mdio_register_device() in it
is broken and needs to be fixed.

It is independant from your previous question about unregistering the
device from within module_init().

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [RFD driver-core] Lifetime problems of the current driver model

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 06:43:02PM +0900, Tejun Heo wrote:
 Hello, all.
 
 This document tries to describe lifetime problems of the current
 device driver model primarily from the point view of device drivers
 and establish consensus, or at least, start discussion about how to
 solve these problems.  This is primarily based on my experience with
 IDE and SCSI layers and my knowledge on other drivers is limited, so I
 might have generalized too aggressively.  Feel free to point out.

Very nice summary of the problems we are trying to address here,
thanks for doing this.

 2. How do we solve this?
 
 2-1. Rule #a and #b
 
 If you think about it, the impedance matching between rule #a and #b
 should be done somewhere.  Maybe doing it in each low level driver is
 what's intended when the driver model is designed but it's
 impractically painful and the reality reflects that by doing it in
 midlayers.
 
 It's better if we do it in higher layers.  For example, SCSI has a
 mechanism to reject new requests and drain request_queue to allow low
 level driver to just unregister an existing device.  IDE currently
 doesn't have such feature but it would need to do almost the same
 thing to support hotplug.  If request_queue just had a feature to
 drain and kill itself, both SCSI and IDE could use it.  It would be
 simpler and less error-prone.  On the other hand, if it's pushed
 downward, it will cause much more pain in all the low level drivers.

No, we should not push this kind of thing down to the lower drivers.

In fact, my goal is to try to keep a normal driver writer from having
to know anything about the driver model, except for how to add and
remove a sysfs file that is bound to the device controlled by the
driver.

And for the majority of the busses, this is true, it's only people like
you who are mucking around in the bus specific code that know how hard
this whole thing is :)

 Orphaning sysfs nodes on unregistration is a big step in this
 direction.  With sysfs reference counting out of the picture,
 implementing 'disconnect immediate' interface only on a few components
 (including request_queue) should suffice for most block device
 drivers.  I'm not familiar with other drivers but I don't think
 they'll be very different.
 
 All in all, I'm hoping something like the following can be done in
 device drivers, midlayer or low level.
 
 * For binding
 
  alloc resources;
  init controller;
  register to upper layers;
 
 * For unbinding
 
  unregister from upper layers; (no lingering references or objects)
  deinit controller;
  release resources;
 
 This basically nullifies lifetime rule #b from the POV of drivers.

I agree, that should be our goal.  And for almost all busses, this is
true today, right?

 2-2. Rule #b and #c
 
 One way to solve this problem is to subordinate lifetime rule #b to
 rule #c.  Each kobject points to its owning module such that grabbing
 a kobject automatically grabs the module.  The problem with this
 approach is that it requires wide update and makes kobject_get
 heavier.

Why would kobject_get become heavier?

 Another more appealing approach is to do nothing.  Solving the problem
 between rule #a and #b in the way described above means virtually
 nullifying rule #b.  With rule #b gone, rule #c can't conflict with
 it.  IOW, no reference from upper layer would be remaining after a
 driver unregisters itself from the upper layer - the module can be
 safely unloaded.

Yes, but you have to watch out for devices that add their own files with
callbacks to that driver.  That is a problem today that Oliver has tried
to address with his recent patches.

 3. How do we get there from here?
 
 The current device driver model is used by most device drivers - huge
 amount of code.  We can't update them at once.

No, the majority of the logic is in the busses, and we can update them
pretty easily.

 Fortunately, the
 suggested solution can easily be implemented gradually.  We can add
 'disconnect now' interface to upper driver interface one-by-one and
 convert its users gradually.  The existing reference counting
 mechanism can be left alone and used to verify that the conversion is
 correct by verifying reference count is 0 after unregistering.
 
 Once the conversion is complete (maybe after a year), we can remove
 the reference counting mechanism from device driver interface.

I'd be interested in seeing how we can do this.  Do you have any
specific patches started in this area?

 4. Some afterthoughts
 
 * Doing this would make module reference counting more flexible.
  Instead of being confined by implementation, it can be used to
  define when to allow and disallow module unloading.  (you can't
  unload a block driver module if a fs on it is mounted but sysfs
  access doesn't matter.)

Well, remember, module unloading is racy and unrecommended to use anyway
:)

Also, look at the network drivers who all have their own special type of
lock, with no module reference count increment when 

Re: [RFD driver-core] Lifetime problems of the current driver model

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 10:38:00PM +0900, Tejun Heo wrote:
 James Bottomley wrote:
  On Fri, 2007-03-30 at 18:43 +0900, Tejun Heo wrote:
  Orphaning sysfs nodes on unregistration is a big step in this
  direction.  With sysfs reference counting out of the picture,
  implementing 'disconnect immediate' interface only on a few components
  (including request_queue) should suffice for most block device
  drivers.  I'm not familiar with other drivers but I don't think
  they'll be very different.
  
  I agree with this statement.  The big question in my mind is how do we
  do it?
  
  The essential problem, and the reason why the lifetime rules are
  entangled is that fundamentally, sysfs entries are managed by kobjects.
  The things the device drivers are interested in is struct device, which
  is usually embedded in driver data structures.  Unfortunately, the
  required kobject is usually embedded in struct device meaning that the
  relevant driver structure cannot be freed while the sysfs entry still
  exists.
  
  It seems to me that the only way to Orphan the sysfs entries is to
  separate the kobject and the struct device so their lifetime rules are
  no longer entangled.  Then we can free the driver structure with the
  embedded struct device while still keeping the necessary kobject around
  to perform orphaned sysfs operations.
  
  So it seems to me that what we need to do is to give struct device its
  own kref and a pointer to a kobject.  Then we can manage the separate
  lifetimes independently.  The device would basically allocate and take a
  reference to the kobject on device_add() and relinquish it again (and
  null out the kobject pointer) on device_del().  The complexity here is
  that we now have to allocate the kobject somewhere else ... probably in
  device_add() (it doesn't come for free with the device structures).
 
 My plan was to make sysfs more independent from struct device/kobject.
 e.g. Something like the following.
 
 * kobject_get() on attr/symlink creation
 * open() doesn't need extra kobject reference
 * deleting a node makes it release the kobject reference and the kobject
 pointer is nullified.

Hm, this sounds good, but I think it will be racy.

Although separating the very tight tie between sysfs and kobject would
be very good to have.  Pat originally wanted to do that years ago,
but he's now lost to the land of a million sheep...

So I don't object to this goal at all.

 This way the sysfs reference counting can be put completely out of
 picture without impacting the rest of code.  Handling symlink and
 suicidal attributes might need some extra attention but I think they can
 be done.

Ok, I'll but I really want to see that code :)

 In the long term, I think sysfs should be independent from driver model
 and kobject such that an entity which wants to use sysfs but is not a
 device doesn't have to dance with kobject just to use sysfs.

I agree.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [bug] hung bootup in various drivers, was: 2.6.21-rc5: known regressions

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 07:46:19PM +0200, Ingo Molnar wrote:
 
 * Greg KH [EMAIL PROTECTED] wrote:
 
BUG: at drivers/base/driver.c:187 driver_unregister()
 [c0105ff9] show_trace_log_lvl+0x19/0x2e
 [c01063e2] show_trace+0x12/0x14
 [c01063f8] dump_stack+0x14/0x16
 [c063f7e6] driver_unregister+0x3d/0x43
 [c0488048] pci_unregister_driver+0x10/0x5f
 [c1b5f7c7] slgt_init+0x9b/0x1ca
 [c1b31a2d] init+0x15d/0x2bd
 [c0105bc3] kernel_thread_helper+0x7/0x10
 
  Yes, we should allow the ability to call unregister_driver from within 
  the module_init function.
  
  But I don't understand what is causing you to see this problem.  Who 
  is holding the reference on the struct device at this point in time?  
  Is it the fact that userspace has some files open and it hasn't 
  released them yet?
 
 at least in the slgt_init() case the affected codepath is trivial:
 
 if ((rc = pci_register_driver(pci_driver))  0) {
 printk(%s pci_register_driver error=%d\n, driver_name, rc);
 return rc;
 }
 pci_registered = 1;
 
 if (!slgt_device_list) {
 printk(%s no devices found\n,driver_name);
 pci_unregister_driver(pci_driver);
 return -ENODEV;
 
 slgt_device_list is NULL because no matching PCI ID is on my system (i 
 dont have this hardware), so the -probe() function did not get called 
 at all.

Sorry, no, I realize how this could happen in the driver, I just don't
see what in the driver core would be keeping this driver from having
it's release function called at the unregister() time.

Something has grabbed a reference to the driver...

Oh wait, is this code a module or built into the kernel?

If it's built in, there's still a reference counting bug in the
module/driver hookup logic as we really don't have a module yet we are
still thinking we do as we represent it in /sys/module and create the
linkages.

I created some horrible patches to try to track this down, as it was
reported on lkml (look for Subject: kref refcounting breakage in mainline )
but never got it working correctly.

I bet if you build that code as a module, it will work just fine, can
you try it?

Kay, did you ever get a chance to look into this reference counting
issue?

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 2.6.20.4] Flush MSI-X table writes (rev 3)

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 01:33:45PM -0600, Eric W. Biederman wrote:
 Greg KH [EMAIL PROTECTED] writes:
 
  Sorry, but this isn't going to go into 2.6.20 any time soon as it
  doesn't fit the rules for the -stable tree.
 
  But I'll take an updated version for my pci tree to go to Linus after
  2.6.21 is out.
 
 Greg this does fix a bug that affects 2.6.21.  We have hardware in 2.6.21 that
 is affected And it at least seems to meet the obviously correct
 criteria.  So at least for 2.6.21 I think it is interesting.

We do?  What hardware has this reported problem showed up on?  I haven't
seen any bug reports yet.

And I think it's way too late for something like this.  If it's really
needed, I don't have a problem adding it to the 2.6.21-stable tree in a
few weeks.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 2.6.21-rc5] Flush MSI-X table writes (rev 3)

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 12:47:47PM -0700, Andrew Morton wrote:
 On Fri, 30 Mar 2007 13:04:02 -0600
 [EMAIL PROTECTED] (Eric W. Biederman) wrote:
 
  Mitch Williams [EMAIL PROTECTED] writes:
  
   This patch fixes a kernel bug which is triggered when using the
   irqbalance daemon with MSI-X hardware.
  
   Because both MSI-X interrupt messages and MSI-X table writes are posted,
   it's possible for them to cross while in-flight.  This results in
   interrupts being received long after the kernel thinks they're disabled,
   and in interrupts being sent to stale vectors after rebalancing.
  
   This patch performs a read flush after writes to the MSI-X table for
   mask and unmask operations.  Since the SMP affinity is set while
   the interrupt is masked, and since it's unmasked immediately after,
   no additional flushes are required in the various affinity setting
   routines.
  
   This patch has been validated with (unreleased) network hardware which
   uses MSI-X.
  
   Revised with input from Eric Biederman.
  
  Acked-by: Eric W. Biederman [EMAIL PROTECTED]
 
 Did we end up deciding whether this is (needed*safe) enough for 2.6.21?

I say no for now, I have seen no bug reports for any hardware that is
not in a lab for this.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 2.6.21-rc5] Flush MSI-X table writes (rev 3)

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 01:00:22PM -0700, Andrew Morton wrote:
 On Fri, 30 Mar 2007 12:49:56 -0700
 Greg KH [EMAIL PROTECTED] wrote:
 
Acked-by: Eric W. Biederman [EMAIL PROTECTED]
   
   Did we end up deciding whether this is (needed*safe) enough for 2.6.21?
  
  I say no for now, I have seen no bug reports for any hardware that is
  not in a lab for this.
 
 Well.  Presumably that hardware will be in the field during the lifetime of
 2.6.21-based kernels.
 
 Perhaps we should put this into 2.6.22 then backport it to 2.6.21.x once it
 seems safe to do so.  If we decide to go this way, we'll need to ask Mitch
 to remind us to do the backport at the appropriate time, else we'll surely
 forget.

Yes, that's what I just asked him to do a message ago :)

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [PATCH 2.6.21-rc5] Flush MSI-X table writes (rev 3)

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 01:21:03PM -0700, Williams, Mitch A wrote:
 Greg KH wrote: 
  
  Perhaps we should put this into 2.6.22 then backport it to 
 2.6.21.x once it
  seems safe to do so.  If we decide to go this way, we'll 
 need to ask Mitch
  to remind us to do the backport at the appropriate time, 
 else we'll surely
  forget.
 
 Yes, that's what I just asked him to do a message ago :)
 
 Be happy to -- just give me a good definition of appropriate
 time.

After it goes into Linus's tree, which will be usually the week after
2.6.21 is out.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 00/37] 2.6.20-stable review

2007-03-30 Thread Greg KH
This is the start of the stable review cycle for the 2.6.20.5 release.
There are 37 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a Signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email [EMAIL PROTECTED] to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Tuesday, April 3, 00:00:00 UTC.  Anything
received after that time might be too late.

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 01/37] ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4)

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Albert Lee [EMAIL PROTECTED]

ide: clear bmdma status in ide_intr() for ICHx controllers (revised #4)

patch 1/2 (revised):
- Fix drive-waiting_for_dma to work with CDB-intr devices.
- Do the dma status clearing in ide_intr() and add a new
  hwif-ide_dma_clear_irq for Intel ICHx controllers.

Revised per Alan, Sergei and Bart's advice.

Patch against 2.6.20-rc6. Tested ok on my ICH4 and pdc20275 adapters.
Please review/apply, thanks.

Signed-off-by: Albert Lee [EMAIL PROTECTED]
Cc: Sergei Shtylyov [EMAIL PROTECTED]
Cc: Alan Cox [EMAIL PROTECTED]
Cc: Adam Hawks [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Bartlomiej Zolnierkiewicz [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/ide/ide-cd.c   |8 ++
 drivers/ide/ide-io.c   |   11 
 drivers/ide/ide.c  |1 
 drivers/ide/pci/piix.c |   63 +
 include/linux/ide.h|1 
 5 files changed, 69 insertions(+), 15 deletions(-)

--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -930,6 +930,10 @@ static ide_startstop_t cdrom_start_packe
HWIF(drive)-OUTB(drive-ctl, IDE_CONTROL_REG);
  
if (CDROM_CONFIG_FLAGS (drive)-drq_interrupt) {
+   /* waiting for CDB interrupt, not DMA yet. */
+   if (info-dma)
+   drive-waiting_for_dma = 0;
+
/* packet command */
ide_execute_command(drive, WIN_PACKETCMD, handler, 
ATAPI_WAIT_PC, cdrom_timer_expiry);
return ide_started;
@@ -972,6 +976,10 @@ static ide_startstop_t cdrom_transfer_pa
/* Check for errors. */
if (cdrom_decode_status(drive, DRQ_STAT, NULL))
return ide_stopped;
+
+   /* Ok, next interrupt will be DMA interrupt. */
+   if (info-dma)
+   drive-waiting_for_dma = 1;
} else {
/* Otherwise, we must wait for DRQ to get set. */
if (ide_wait_stat(startstop, drive, DRQ_STAT,
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -1646,6 +1646,17 @@ irqreturn_t ide_intr (int irq, void *dev
del_timer(hwgroup-timer);
spin_unlock(ide_lock);
 
+   /* Some controllers might set DMA INTR no matter DMA or PIO;
+* bmdma status might need to be cleared even for
+* PIO interrupts to prevent spurious/lost irq.
+*/
+   if (hwif-ide_dma_clear_irq  !(drive-waiting_for_dma))
+   /* ide_dma_end() needs bmdma status for error checking.
+* So, skip clearing bmdma status here and leave it
+* to ide_dma_end() if this is dma interrupt.
+*/
+   hwif-ide_dma_clear_irq(drive);
+
if (drive-unmask)
local_irq_enable_in_hardirq();
/* service this interrupt, may set handler for next interrupt */
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -503,6 +503,7 @@ static void ide_hwif_restore(ide_hwif_t 
hwif-ide_dma_on= tmp_hwif-ide_dma_on;
hwif-ide_dma_off_quietly   = tmp_hwif-ide_dma_off_quietly;
hwif-ide_dma_test_irq  = tmp_hwif-ide_dma_test_irq;
+   hwif-ide_dma_clear_irq = tmp_hwif-ide_dma_clear_irq;
hwif-ide_dma_host_on   = tmp_hwif-ide_dma_host_on;
hwif-ide_dma_host_off  = tmp_hwif-ide_dma_host_off;
hwif-ide_dma_lostirq   = tmp_hwif-ide_dma_lostirq;
--- a/drivers/ide/pci/piix.c
+++ b/drivers/ide/pci/piix.c
@@ -411,17 +411,14 @@ fast_ata_pio:
 }
 
 /**
- * init_chipset_piix   -   set up the PIIX chipset
- * @dev: PCI device to set up
- * @name: Name of the device
+ * piix_is_ichx-   check if ICHx
+ * @dev: PCI device to check
  *
- * Initialize the PCI device as required. For the PIIX this turns
- * out to be nice and simple
+ * returns 1 if ICHx, 0 otherwise.
  */
- 
-static unsigned int __devinit init_chipset_piix (struct pci_dev *dev, const 
char *name)
+static int piix_is_ichx(struct pci_dev *dev)
 {
-switch(dev-device) {
+switch (dev-device) {
case PCI_DEVICE_ID_INTEL_82801EB_1:
case PCI_DEVICE_ID_INTEL_82801AA_1:
case PCI_DEVICE_ID_INTEL_82801AB_1:
@@ -439,19 +436,51 @@ static unsigned int __devinit init_chips
case PCI_DEVICE_ID_INTEL_ICH7_21:
case PCI_DEVICE_ID_INTEL_ESB2_18:
case PCI_DEVICE_ID_INTEL_ICH8_6:
-   {
-   unsigned int extra = 0;
-   pci_read_config_dword(dev, 0x54, extra);
-   pci_write_config_dword(dev, 0x54, extra|0x400);
-   }
-   default:
-   break;
+   return 1;
}
 
return 0;
 }
 

[patch 02/37] ide: remove clearing bmdma status from cdrom_decode_status() (rev #4)

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Albert Lee [EMAIL PROTECTED]

ide: remove clearing bmdma status from cdrom_decode_status() (rev #4)

patch 2/2:
  Remove clearing bmdma status from cdrom_decode_status() since ATA devices
  might need it as well.

  (http://lkml.org/lkml/2006/12/4/201 and http://lkml.org/lkml/2006/11/15/94)

Signed-off-by: Albert Lee [EMAIL PROTECTED]
Cc: Sergei Shtylyov [EMAIL PROTECTED]
Cc: Alan Cox [EMAIL PROTECTED]
Cc: Adam W. Hawks [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Bartlomiej Zolnierkiewicz [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/ide/ide-cd.c   |7 ---
 drivers/ide/pci/piix.c |4 
 include/linux/ide.h|1 -
 3 files changed, 12 deletions(-)

--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -687,15 +687,8 @@ static void ide_dump_status_no_sense(ide
 static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int 
*stat_ret)
 {
struct request *rq = HWGROUP(drive)-rq;
-   ide_hwif_t *hwif = HWIF(drive);
int stat, err, sense_key;

-   /* We may have bogus DMA interrupts in PIO state here */
-   if (HWIF(drive)-dma_status  hwif-atapi_irq_bogon) {
-   stat = hwif-INB(hwif-dma_status);
-   /* Should we force the bit as well ? */
-   hwif-OUTB(stat, hwif-dma_status);
-   }
/* Check for errors. */
stat = HWIF(drive)-INB(IDE_STATUS_REG);
if (stat_ret)
--- a/drivers/ide/pci/piix.c
+++ b/drivers/ide/pci/piix.c
@@ -502,10 +502,6 @@ static void __devinit init_hwif_piix(ide
/* This is a painful system best to let it self tune for now */
return;
}
-   /* ESB2 appears to generate spurious DMA interrupts in PIO mode
-  when in native mode */
-   if (hwif-pci_dev-device == PCI_DEVICE_ID_INTEL_ESB2_18)
-   hwif-atapi_irq_bogon = 1;
 
hwif-autodma = 0;
hwif-tuneproc = piix_tune_drive;
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -797,7 +797,6 @@ typedef struct hwif_s {
unsignedsg_mapped  : 1; /* sg_table and sg_nents are ready */
unsignedno_io_32bit : 1; /* 1 = can not do 32-bit IO ops */
unsignederr_stops_fifo : 1; /* 1=data FIFO is cleared by an 
error */
-   unsignedatapi_irq_bogon : 1; /* Generates spurious DMA 
interrupts in PIO mode */
 
struct device   gendev;
struct completion gendev_rel_comp; /* To deal with device release() */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 03/37] sata_nv: delay on switching between NCQ and non-NCQ commands

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--

From: Robert Hancock [EMAIL PROTECTED]

sata_nv: delay on switching between NCQ and non-NCQ commands

This patch appears to solve some problems with commands timing out in
cases where an NCQ command is immediately followed by a non-NCQ command
(or possibly vice versa). This is a rather ugly solution, but until we
know more about why this is needed, this is about all we can do.

[backport to 2.6.20 by Chuck Ebbert [EMAIL PROTECTED]]

Signed-off-by: Robert Hancock [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/ata/sata_nv.c |   10 ++
 1 file changed, 10 insertions(+)

--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -214,6 +214,7 @@ struct nv_adma_port_priv {
struct nv_adma_prd  *aprd;
dma_addr_t  aprd_dma;
u8  flags;
+   int last_issue_ncq;
 };
 
 #define NV_ADMA_CHECK_INTR(GCTL, PORT) ((GCTL)  ( 1  (19 + (12 * (PORT)
@@ -1151,6 +1152,7 @@ static unsigned int nv_adma_qc_issue(str
 {
struct nv_adma_port_priv *pp = qc-ap-private_data;
void __iomem *mmio = nv_adma_ctl_block(qc-ap);
+   int curr_ncq = (qc-tf.protocol == ATA_PROT_NCQ);
 
VPRINTK(ENTER\n);
 
@@ -1166,6 +1168,14 @@ static unsigned int nv_adma_qc_issue(str
/* write append register, command tag in lower 8 bits
   and (number of cpbs to append -1) in top 8 bits */
wmb();
+
+   if(curr_ncq != pp-last_issue_ncq) {
+   /* Seems to need some delay before switching between NCQ and 
non-NCQ
+  commands, else we get command timeouts and such. */
+   udelay(20);
+   pp-last_issue_ncq = curr_ncq;
+   }
+
writew(qc-tag, mmio + NV_ADMA_APPEND);
 
DPRINTK(Issued tag %u\n,qc-tag);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 18/37] Fix decnet endianness

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--

From: Al Viro [EMAIL PROTECTED]

[PATCH] FRA_{DST,SRC} are le16 for decnet

Signed-off-by: Al Viro [EMAIL PROTECTED]
Signed-off-by: Linus Torvalds [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 net/decnet/dn_rules.c |   12 ++--
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -151,10 +151,10 @@ static int dn_fib_rule_configure(struct 
}
 
if (tb[FRA_SRC])
-   r-src = nla_get_u16(tb[FRA_SRC]);
+   r-src = nla_get_le16(tb[FRA_SRC]);
 
if (tb[FRA_DST])
-   r-dst = nla_get_u16(tb[FRA_DST]);
+   r-dst = nla_get_le16(tb[FRA_DST]);
 
r-src_len = frh-src_len;
r-srcmask = dnet_make_mask(r-src_len);
@@ -176,10 +176,10 @@ static int dn_fib_rule_compare(struct fi
if (frh-dst_len  (r-dst_len != frh-dst_len))
return 0;
 
-   if (tb[FRA_SRC]  (r-src != nla_get_u16(tb[FRA_SRC])))
+   if (tb[FRA_SRC]  (r-src != nla_get_le16(tb[FRA_SRC])))
return 0;
 
-   if (tb[FRA_DST]  (r-dst != nla_get_u16(tb[FRA_DST])))
+   if (tb[FRA_DST]  (r-dst != nla_get_le16(tb[FRA_DST])))
return 0;
 
return 1;
@@ -214,9 +214,9 @@ static int dn_fib_rule_fill(struct fib_r
frh-tos = 0;
 
if (r-dst_len)
-   NLA_PUT_U16(skb, FRA_DST, r-dst);
+   NLA_PUT_LE16(skb, FRA_DST, r-dst);
if (r-src_len)
-   NLA_PUT_U16(skb, FRA_SRC, r-src);
+   NLA_PUT_LE16(skb, FRA_SRC, r-src);
 
return 0;
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 26/37] V4L: saa7146: Fix allocation of clipping memory

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Oliver Endriss [EMAIL PROTECTED]

V4L: saa7146: Fix allocation of clipping memory

Olaf Hering pointed out that SAA7146_CLIPPING_MEM would become
very large for PAGE_SIZE  4K.

In fact, the number of clipping windows is limited to 16,
and calculate_clipping_registers_rect() does not use more
than 256 bytes. SAA7146_CLIPPING_MEM adjusted accordingly.

(cherry picked from commit 7a7cd1920969dd9da4e0d99aab573b3eba24c799)

Thanks-to: Olaf Hering [EMAIL PROTECTED]
Acked-by: Michael Hunold [EMAIL PROTECTED]
Signed-off-by: Oliver Endriss [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 include/media/saa7146_vv.h |3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/include/media/saa7146_vv.h
+++ b/include/media/saa7146_vv.h
@@ -239,7 +239,8 @@ void saa7146_res_free(struct saa7146_fh 
 #define SAA7146_HPS_SYNC_PORT_B0x01
 
 /* some memory sizes */
-#define SAA7146_CLIPPING_MEM   (14*PAGE_SIZE)
+/* max. 16 clipping rectangles */
+#define SAA7146_CLIPPING_MEM   (16 * 4 * sizeof(u32))
 
 /* some defines for the various clipping-modes */
 #define SAA7146_CLIPPING_RECT  0x4

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 24/37] DVB: isl6421: dont reference freed memory

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Thomas Viehweger [EMAIL PROTECTED]

DVB: isl6421: don't reference freed memory

After freeing a block there should be no reference to this block.

(cherry picked from commit 09d4895488d4df5c58b739573846f514ceabc911)

Signed-off-by: Thomas Viehweger [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/dvb/frontends/isl6421.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/media/dvb/frontends/isl6421.c
+++ b/drivers/media/dvb/frontends/isl6421.c
@@ -122,6 +122,7 @@ struct dvb_frontend *isl6421_attach(stru
/* detect if it is present or not */
if (isl6421_set_voltage(fe, SEC_VOLTAGE_OFF)) {
kfree(isl6421);
+   fe-sec_priv = NULL;
return NULL;
}
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 22/37] V4L: Fix SECAM handling on saa7115

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--

From: Mauro Carvalho Chehab [EMAIL PROTECTED]

V4L: Fix SECAM handling on saa7115

(cherry picked from commit a9aaec4e83e687d23b78b38e331bbd6a10b96380)

Signed-off-by: Mauro Carvalho Chehab [EMAIL PROTECTED]
Signed-off-by: Michael Krufky [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/media/video/saa7115.c |2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -960,7 +960,7 @@ static void saa711x_set_v4lstd(struct i2
reg |= 0x10;
} else if (std == V4L2_STD_NTSC_M_JP) {
reg |= 0x40;
-   } else if (std == V4L2_STD_SECAM) {
+   } else if (std  V4L2_STD_SECAM) {
reg |= 0x50;
}
saa711x_write(client, R_0E_CHROMA_CNTL_1, reg);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 30/37] CIFS: Allow reset of file to ATTR_NORMAL when archive bit not set

2007-03-30 Thread Greg KH

-stable review patch.  If anyone has any objections, please let us know.

--
From: Steve French [EMAIL PROTECTED]

[CIFS] Allow reset of file to ATTR_NORMAL when archive bit not set

When a file had a dos attribute of 0x1 (readonly - but dos attribute
of archive was not set) - doing chmod 0777 or equivalent would
try to set a dos attribute of 0 (which some servers ignore)
rather than ATTR_NORMAL (0x20) which most servers accept.
Does not affect servers which support the CIFS Unix Extensions.

[[EMAIL PROTECTED]: removed changelog part of patch]

Cc: Chuck Ebbert [EMAIL PROTECTED]
Acked-by: Prasad Potluri [EMAIL PROTECTED]
Acked-by: Shirish Pargaonkar [EMAIL PROTECTED]
Signed-off-by: Steve French [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 fs/cifs/inode.c |   15 ---
 1 file changed, 12 insertions(+), 3 deletions(-)

--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1133,6 +1133,7 @@ int cifs_setattr(struct dentry *direntry
struct cifsFileInfo *open_file = NULL;
FILE_BASIC_INFO time_buf;
int set_time = FALSE;
+   int set_dosattr = FALSE;
__u64 mode = 0xULL;
__u64 uid = 0xULL;
__u64 gid = 0xULL;
@@ -1269,15 +1270,23 @@ int cifs_setattr(struct dentry *direntry
else if (attrs-ia_valid  ATTR_MODE) {
rc = 0;
if ((mode  S_IWUGO) == 0) /* not writeable */ {
-   if ((cifsInode-cifsAttrs  ATTR_READONLY) == 0)
+   if ((cifsInode-cifsAttrs  ATTR_READONLY) == 0) {
+   set_dosattr = TRUE;
time_buf.Attributes =
cpu_to_le32(cifsInode-cifsAttrs |
ATTR_READONLY);
+   }
} else if ((mode  S_IWUGO) == S_IWUGO) {
-   if (cifsInode-cifsAttrs  ATTR_READONLY)
+   if (cifsInode-cifsAttrs  ATTR_READONLY) {
+   set_dosattr = TRUE;
time_buf.Attributes =
cpu_to_le32(cifsInode-cifsAttrs 
(~ATTR_READONLY));
+   /* Windows ignores set to zero */
+   if(time_buf.Attributes == 0)
+   time_buf.Attributes |=
+   cpu_to_le32(ATTR_NORMAL);
+   }
}
/* BB to be implemented -
   via Windows security descriptors or streams */
@@ -1315,7 +1324,7 @@ int cifs_setattr(struct dentry *direntry
} else
time_buf.ChangeTime = 0;
 
-   if (set_time || time_buf.Attributes) {
+   if (set_time || set_dosattr) {
time_buf.CreationTime = 0;  /* do not change */
/* In the future we should experiment - try setting timestamps
   via Handle (SetFileInfo) instead of by path */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 31/37] CIFS: reset mode when client notices that ATTR_READONLY is no longer set

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Alan Tyson [EMAIL PROTECTED]

[CIFS] reset mode when client notices that ATTR_READONLY is no longer set

[[EMAIL PROTECTED]: removed changelog part of patch]

Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Alan Tyso [EMAIL PROTECTED]
Signed-off-by: Jeff Layton [EMAIL PROTECTED]
Signed-off-by: Steve French [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 fs/cifs/inode.c   |6 ++
 fs/cifs/readdir.c |4 
 2 files changed, 10 insertions(+)

--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -488,6 +488,12 @@ int cifs_get_inode_info(struct inode **p
   mode e.g. 555 */
if (cifsInfo-cifsAttrs  ATTR_READONLY)
inode-i_mode = ~(S_IWUGO);
+   else if ((inode-i_mode  S_IWUGO) == 0)
+   /* the ATTR_READONLY flag may have been */
+   /* changed on server -- set any w bits  */
+   /* allowed by mnt_file_mode */
+   inode-i_mode |= (S_IWUGO 
+ cifs_sb-mnt_file_mode);
/* BB add code here -
   validate if device or weird share or device type? */
}
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -215,6 +215,10 @@ static void fill_in_inode(struct inode *
tmp_inode-i_mode |= S_IFREG;
if (attr  ATTR_READONLY)
tmp_inode-i_mode = ~(S_IWUGO);
+   else if ((tmp_inode-i_mode  S_IWUGO) == 0)
+   /* the ATTR_READONLY flag may have been changed on   */
+   /* server -- set any w bits allowed by mnt_file_mode */
+   tmp_inode-i_mode |= (S_IWUGO  cifs_sb-mnt_file_mode);
} /* could add code here - to validate if device or weird share type? */
 
/* can not fill in nlink here as in qpathinfo version and Unx search */

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 34/37] libata bugfix: HDIO_DRIVE_TASK

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Mark Lord [EMAIL PROTECTED]

libata bugfix: HDIO_DRIVE_TASK

I was trying to use HDIO_DRIVE_TASK for something today,
and discovered that the libata implementation does not copy
over the upper four LBA bits from args[6].

This is serious, as any tools using this ioctl would have their
commands applied to the wrong sectors on the drive, possibly resulting
in disk corruption.

Ideally, newer apps should use SG_IO/ATA_16 directly,
avoiding this bug.  But with libata poised to displace drivers/ide,
better compatibility here is a must.

This patch fixes libata to use the upper four LBA bits passed
in from the ioctl.

The original drivers/ide implementation copies over all bits
except for the master/slave select bit.  With this patch,
libata will copy only the four high-order LBA bits,
just in case there are assumptions elsewhere in libata (?).

Signed-off-by: Mark Lord [EMAIL PROTECTED]
Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/ata/libata-scsi.c |1 +
 1 file changed, 1 insertion(+)

--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -295,6 +295,7 @@ int ata_task_ioctl(struct scsi_device *s
scsi_cmd[8]  = args[3];
scsi_cmd[10] = args[4];
scsi_cmd[12] = args[5];
+   scsi_cmd[13] = args[6]  0x0f;
scsi_cmd[14] = args[0];
 
/* Good values for timeout and retries?  Values below

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 36/37] libata: sata_mv: Fix 50xx irq mask

2007-03-30 Thread Greg KH

-stable review patch.  If anyone has any objections, please let us know.

--
From: Jeff Garzik [EMAIL PROTECTED]

[libata] sata_mv: Fix 50xx irq mask

IRQ mask bits assumed a 60xx or newer generation chip, which is very
wrong for the 50xx series.  Luckily both generations shared the per-port
interrupt mask bits, leaving only the misc chip features bits to be
completely mismatched.

Fix 50xx by ensuring we only program bits that exist.

Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/ata/sata_mv.c |   11 ++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -139,14 +139,19 @@ enum {
PCI_ERR = (1  18),
TRAN_LO_DONE= (1  19),/* 6xxx: IRQ coalescing */
TRAN_HI_DONE= (1  20),/* 6xxx: IRQ coalescing */
+   PORTS_0_3_COAL_DONE = (1  8),
+   PORTS_4_7_COAL_DONE = (1  17),
PORTS_0_7_COAL_DONE = (1  21),/* 6xxx: IRQ coalescing */
GPIO_INT= (1  22),
SELF_INT= (1  23),
TWSI_INT= (1  24),
HC_MAIN_RSVD= (0x7f  25), /* bits 31-25 */
+   HC_MAIN_RSVD_5  = (0x1fff  19), /* bits 31-19 */
HC_MAIN_MASKED_IRQS = (TRAN_LO_DONE | TRAN_HI_DONE |
   PORTS_0_7_COAL_DONE | GPIO_INT | TWSI_INT |
   HC_MAIN_RSVD),
+   HC_MAIN_MASKED_IRQS_5   = (PORTS_0_3_COAL_DONE | PORTS_4_7_COAL_DONE |
+  HC_MAIN_RSVD_5),
 
/* SATAHC registers */
HC_CFG_OFS  = 0,
@@ -2287,7 +2292,11 @@ static int mv_init_host(struct pci_dev *
 
/* and unmask interrupt generation for host regs */
writelfl(PCI_UNMASK_ALL_IRQS, mmio + PCI_IRQ_MASK_OFS);
-   writelfl(~HC_MAIN_MASKED_IRQS, mmio + HC_MAIN_IRQ_MASK_OFS);
+
+   if (IS_50XX(hpriv))
+   writelfl(~HC_MAIN_MASKED_IRQS_5, mmio + HC_MAIN_IRQ_MASK_OFS);
+   else
+   writelfl(~HC_MAIN_MASKED_IRQS, mmio + HC_MAIN_IRQ_MASK_OFS);
 
VPRINTK(HC MAIN IRQ cause/mask=0x%08x/0x%08x 
PCI int cause/mask=0x%08x/0x%08x\n,

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 37/37] generic_serial: fix decoding of baud rate

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Daniel Drake [EMAIL PROTECTED]

Commit d720bc4b8fc5d6d179ef094908d4fbb5e436ffad partially removed a private
implementation of baud speed decoding.  However it doesn't seem to be
complete: after the speed is decoded, it is still being used as an index to
a local speed table (array overrun, no doubt).

This was found by Graham Murray who noticed it caused a 2.6.19 regression
with the SX driver: https://bugs.gentoo.org/170554

Signed-off-by: Daniel Drake [EMAIL PROTECTED]
Acked-by: Alan Cox [EMAIL PROTECTED]
Cc: Russell King [EMAIL PROTECTED]
Signed-off-by: Andrew Morton [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/char/generic_serial.c |7 ---
 1 file changed, 7 deletions(-)

--- a/drivers/char/generic_serial.c
+++ b/drivers/char/generic_serial.c
@@ -711,12 +711,6 @@ void gs_close(struct tty_struct * tty, s
 }
 
 
-static unsigned int gs_baudrates[] = {
-  0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-  9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600
-};
-
-
 void gs_set_termios (struct tty_struct * tty, 
  struct ktermios * old_termios)
 {
@@ -772,7 +766,6 @@ void gs_set_termios (struct tty_struct *
 
baudrate = tty_get_baud_rate(tty);
 
-   baudrate = gs_baudrates[baudrate];
if ((tiosp-c_cflag  CBAUD) == B38400) {
if ( (port-flags  ASYNC_SPD_MASK) == ASYNC_SPD_HI)
baudrate = 57600;

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 35/37] libata: sata_mv: dont touch reserved bits in EDMA config register

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Jeff Garzik [EMAIL PROTECTED]

[libata] sata_mv: don't touch reserved bits in EDMA config register

The code in mv_edma_cfg() reflected its 60xx origins, by doing things
[slightly] incorrectly on the older 50xx and newer 6042/7042 chips.

Clean up the EDMA configuration setup such that, each chip family
carefully initializes its own EDMA setup.

Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Jeff Garzik [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]


---
 drivers/ata/sata_mv.c |   20 
 1 file changed, 12 insertions(+), 8 deletions(-)

--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -843,23 +843,27 @@ static void mv_edma_cfg(struct mv_host_p
u32 cfg = readl(port_mmio + EDMA_CFG_OFS);
 
/* set up non-NCQ EDMA configuration */
-   cfg = ~0x1f;   /* clear queue depth */
-   cfg = ~EDMA_CFG_NCQ;   /* clear NCQ mode */
cfg = ~(1  9);   /* disable equeue */
 
-   if (IS_GEN_I(hpriv))
+   if (IS_GEN_I(hpriv)) {
+   cfg = ~0x1f;   /* clear queue depth */
cfg |= (1  8);/* enab config burst size mask */
+   }
 
-   else if (IS_GEN_II(hpriv))
+   else if (IS_GEN_II(hpriv)) {
+   cfg = ~0x1f;   /* clear queue depth */
cfg |= EDMA_CFG_RD_BRST_EXT | EDMA_CFG_WR_BUFF_LEN;
+   cfg = ~(EDMA_CFG_NCQ | EDMA_CFG_NCQ_GO_ON_ERR); /* clear NCQ */
+   }
 
else if (IS_GEN_IIE(hpriv)) {
-   cfg |= (1  23);   /* dis RX PM port mask */
-   cfg = ~(1  16);  /* dis FIS-based switching (for now) */
+   cfg |= (1  23);   /* do not mask PM field in rx'd FIS */
+   cfg |= (1  22);   /* enab 4-entry host queue cache */
cfg = ~(1  19);  /* dis 128-entry queue (for now?) */
cfg |= (1  18);   /* enab early completion */
-   cfg |= (1  17);   /* enab host q cache */
-   cfg |= (1  22);   /* enab cutthrough */
+   cfg |= (1  17);   /* enab cut-through (dis storforwrd) */
+   cfg = ~(1  16);  /* dis FIS-based switching (for now) */
+   cfg = ~(EDMA_CFG_NCQ | EDMA_CFG_NCQ_GO_ON_ERR); /* clear NCQ */
}
 
writelfl(cfg, port_mmio + EDMA_CFG_OFS);

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


Re: [patch 00/37] 2.6.20-stable review

2007-03-30 Thread Greg KH
On Fri, Mar 30, 2007 at 02:03:34PM -0700, Greg KH wrote:
 This is the start of the stable review cycle for the 2.6.20.5 release.
 There are 37 patches in this series, all will be posted as a response to
 this one.  If anyone has any issues with these being applied, please let
 us know.  If anyone is a maintainer of the proper subsystem, and wants
 to add a Signed-off-by: line to the patch, please respond with it.
 
 These patches are sent out with a number of different people on the Cc:
 line.  If you wish to be a reviewer, please email [EMAIL PROTECTED] to
 add your name to the list.  If you want to be off the reviewer list,
 also email us.

Full patch is now also at:
kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.20.5-rc1.gz

thanks,

greg k-h
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


[patch 29/37] ide: revert ide: fix drive side 80c cable check, take 2 for now

2007-03-30 Thread Greg KH
-stable review patch.  If anyone has any objections, please let us know.

--
From: Bartlomiej Zolnierkiewicz [EMAIL PROTECTED]

[PATCH] ide: revert ide: fix drive side 80c cable check, take 2 for now

ide: fix drive side 80c cable check, take 2 patch from Tejun Heo (commit
fab59375b9543f84d1714f7dd00f5d11e531bd3e) fixed 80c bit test (bit13 of word93)
but we also need to fix master/slave IDENTIFY order (slave device should be
probed first in order to make it release PDIAG- signal) and we should also
check for pre-ATA3 slave devices (which may not release PDIAG- signal).

Unfortunately the fact that IDE driver doesn't reset devices itself helps
only a bit as it seems that some BIOS-es reset ATA devices after programming
the chipset, some BIOS-es can be set to not probe/configure selected devices,
there may be no BIOS in case of add-on cards etc.

Since we are quite late in the release cycle and the required changes will
affect a lot of systems just revert the fix for now.

[ Please also see libata commit f31f0cc2f0b7527072d94d02da332d9bb8d7d94c. ]

Cc: Chuck Ebbert [EMAIL PROTECTED]
Signed-off-by: Bartlomiej Zolnierkiewicz [EMAIL PROTECTED]
Signed-off-by: Greg Kroah-Hartman [EMAIL PROTECTED]

---
 drivers/ide/ide-iops.c |9 +
 1 file changed, 9 insertions(+)

--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -598,6 +598,9 @@ u8 eighty_ninty_three (ide_drive_t *driv
if(HWIF(drive)-udma_four == 0)
return 0;
 
+   printk(KERN_INFO %s: hw_config=%04x\n,
+drive-name, drive-id-hw_config);
+
/* Check for SATA but only if we are ATA5 or higher */
if (drive-id-hw_config == 0  (drive-id-major_rev_num  0x7FE0))
return 1;
@@ -607,8 +610,14 @@ u8 eighty_ninty_three (ide_drive_t *driv
if(!(drive-id-hw_config  0x4000))
return 0;
 #endif /* CONFIG_IDEDMA_IVB */
+/*
+ * FIXME: enable this after fixing master/slave IDENTIFY order,
+ *   also ignore the result if the slave device is pre-ATA3 one
+ */
+#if 0
if (!(drive-id-hw_config  0x2000))
return 0;
+#endif
return 1;
 }
 

-- 
-
To unsubscribe from this list: send the line unsubscribe linux-kernel in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/


<    1   2   3   4   5   6   7   8   9   10   >