aboutsummaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2008-12-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: tproxy: fixe a possible read from an invalid location in the socket match zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr() mac80211: use unaligned safe memcmp() in-place of compare_ether_addr() ipw2200: fix netif_*_queue() removal regression iwlwifi: clean key table in iwl_clear_stations_table function tcp: tcp_vegas ssthresh bug fix can: omit received RTR frames for single ID filter lists ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table netx-eth: initialize per device spinlock tcp: make urg+gso work for real this time enc28j60: Fix sporadic packet loss (corrected again) hysdn: fix writing outside the field on 64 bits b1isa: fix b1isa_exit() to really remove registered capi controllers can: Fix CAN_(EFF|RTR)_FLAG handling in can_filter Phonet: do not dump addresses from other namespaces netlabel: Fix a potential NULL pointer dereference bnx2: Add workaround to handle missed MSI. xfrm: Fix kernel panic when flush and dump SPD entries
2008-12-08ide: build-fix for CONFIG_BLK_DEV_IDEDMA_PMAC=nBartlomiej Zolnierkiewicz
IDE pmac host driver build fails with CONFIG_BLK_DEV_IDEDMA_PMAC=n as reported by Kamalesh: > drivers/ide/pmac.c: In function 'pmac_ide_set_pio_mode': > drivers/ide/pmac.c:527: error: implicit declaration of function 'kauai_lookup_timing' > drivers/ide/pmac.c:527: error: 'shasta_pio_timings' undeclared (first use in this function) > drivers/ide/pmac.c:527: error: (Each undeclared identifier is reported only once > drivers/ide/pmac.c:527: error: for each function it appears in.) > drivers/ide/pmac.c:534: error: 'kauai_pio_timings' undeclared (first use in this function) > drivers/ide/pmac.c: In function 'pmac_ide_do_resume': > drivers/ide/pmac.c:914: error: 'IDE_WAKEUP_DELAY' undeclared (first use in this function) > drivers/ide/pmac.c: At top level: > drivers/ide/pmac.c:1007: error: 'pmac_ide_init_dma' undeclared here (not in a function) > drivers/ide/pmac.c: In function 'pmac_ide_setup_device': > drivers/ide/pmac.c:1107: error: 'IDE_WAKEUP_DELAY' undeclared (first use in this function) > drivers/ide/pmac.c: In function 'pmac_ide_macio_attach': > drivers/ide/pmac.c:1209: error: 'pmac_ide_hwif_t' has no member named 'dma_regs' > drivers/ide/pmac.c:1210: error: 'pmac_ide_hwif_t' has no member named 'dma_regs' > make[2]: *** [drivers/ide/pmac.o] Error 1 Fix it by removing the superfluous config option. Reported-and-tested-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com> Cc: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-08Revert "ide: respect current DMA setting during resume"Bartlomiej Zolnierkiewicz
This reverts commit e9eb8388306364295308132265c00bea685f409f since it could break resume (thanks to Paul Collins for the report). I'll look into sorting this out properly for 2.6.29 but for 2.6.28 it is the best to just revert my patch. Reported-by: Paul Collins <paul@burly.ondioline.org> Cc: rjw@sisk.pl Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-05drivers/message/i2o/iop.c: cleanup kerneldocQinghuang Feng
no argument named @msg in i2o_msg_get_wait(), remove it. Signed-off-by: Qinghuang Feng <qhfeng.kernel@gmail.com> Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-05Fix incorrect use of loose in i2o_block.cNick Andrew
Fix incorrect use of loose in i2o_block.c It should be 'lose', not 'loose'. Signed-off-by: Nick Andrew <nick@nick-andrew.net> Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-05Fix incorrect use of loose in tty/serial driversNick Andrew
[Folded together as one diff from 3] It should be 'lose', not 'loose'. Signed-off-by: Nick Andrew <nick@nick-andrew.net> Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-05Revert "ACPI: battery: Convert discharge energy rate to current properly"Linus Torvalds
This reverts commit 558073dd56707864f09d563b64e7c37c021e89d2, along with the failed try to fix the regression it caused ("ACPI: Fix ACPI battery regression introduced by commit 558073"), which just made things worse. Commit aaad077638be1a25871bcae5e43952d6b63abfca (that failed "Fix ACPI battery regression") got the voltage conversion confused, and fixed the problem with Rafael's battery monitor apparently just by mistake. So revert them both, getting us back to the 2.6.27 state in this, and let's revisit it when people understand what's going on. Noted-by: Paul Martin <pm@debian.org> Requested-by: Rafael J. Wysocki <rjw@sisk.pl> Cc: Len Brown <len.brown@intel.com> Cc: Alexey Starikovskiy <astarikovskiy@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-05zd1211rw: use unaligned safe memcmp() in-place of compare_ether_addr()Shaddy Baddah
Under my 2.6.28-rc6 sparc64, when associating to an AP through my zd1211rw device, I was seeing kernel log messages like (not exact output): Kernel unaligned access at TPC[10129b68] zd_mac_rx+0x144/0x32c [zd1211rw] For the zd1211rw module, on RX, the 80211 packet will be located after the PLCP header in the skb data buffer. The PLCP header being 5 bytes long, the 80211 header will start unaligned from an aligned skb buffer. As per Documentation/unaligned-memory-access.txt, we must replace the not unaligned() safe compare_ether_addr() with memcmp() to protect architectures that require alignment. Signed-off-by: Shaddy Baddah <shaddy_baddah@hotmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2008-12-05ipw2200: fix netif_*_queue() removal regressionZhu Yi
In "ipw2200: Call netif_*_queue() interfaces properly", netif_stop_queue() and netif_wake_queue() were removed with the reason "netif_carrier_{on,off}() handles starting and stopping packet flow into the driver". The patch also removes a valid condition check that ipw_tx_skb() cannot be called if device is not in STATUS_ASSOCIATED state. But netif_carrier_off() doesn't guarantee netdev->hard_start_xmit won't be called because linkwatch event is handled in a delayed workqueue. This caused a kernel oops reported by Frank Seidel: https://bugzilla.novell.com/show_bug.cgi?id=397390 This patch fixes the problem by moving the STATUS_ASSOCIATED check back to ipw_tx_skb(). It also adds a missing netif_carrier_off() call to ipw_disassociate(). Signed-off-by: Zhu Yi <yi.zhu@intel.com> Signed-off-by: Chatre, Reinette <reinette.chatre@intel.com> Tested-by: Frank Seidel <fseidel@suse.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2008-12-05iwlwifi: clean key table in iwl_clear_stations_table functionTomas Winkler
This patch cleans uCode key table bit map iwl_clear_stations_table since all stations are cleared also the key table must be. Since the keys are not removed properly on suspend by mac80211 this may result in exhausting key table on resume leading to memory corruption during removal This patch also fixes a memory corruption problem reported in http://marc.info/?l=linux-wireless&m=122641417231586&w=2 and tracked in http://bugzilla.kernel.org/show_bug.cgi?id=12040. When the key is removed a second time the offset is set to 255 - this index is not valid for the ucode_key_table and corrupts the eeprom pointer (which is 255 bits from ucode_key_table). Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Zhu Yi <yi.zhu@intel.com> Reported-by: Carlos R. Mafra <crmafra2@gmail.com> Reported-by: Lukas Hejtmanek <xhejtman@ics.muni.cz> Signed-off-by: John W. Linville <linville@tuxdriver.com>
2008-12-04Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/viro/bdev * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/bdev: [PATCH] fix bogus argument of blkdev_put() in pktcdvd [PATCH 2/2] documnt FMODE_ constants [PATCH 1/2] kill FMODE_NDELAY_NOW [PATCH] clean up blkdev_get a little bit [PATCH] Fix block dev compat ioctl handling [PATCH] kill obsolete temporary comment in swsusp_close()
2008-12-04Merge branch 'drm-gem-update' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-gem-update' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/i915: Return error in i915_gem_set_to_gtt_domain if we're not in the GTT. drm/i915: Retry execbuffer pinning after clearing the GTT drm/i915: Move the execbuffer domain computations together drm/i915: Rename object_set_domain to object_set_to_gpu_domain drm/i915: Make a single set-to-cpu-domain path and use it wherever needed. drm/i915: Make a single set-to-gtt-domain path. drm/i915: If interrupted while setting object domains, still emit the flush. drm/i915: Move flushing list cleanup from flush request retire to request emit. drm/i915: Respect GM965/GM45 bit-17-instead-of-bit-11 option for swizzling.
2008-12-04ACPI: Fix ACPI battery regression introduced by commit 558073Rafael J. Wysocki
Commit 558073dd56707864f09d563b64e7c37c021e89d2 ("ACPI: battery: Convert discharge energy rate to current properly") caused the battery subsystem to report wrong values of the remaining time on battery power and the time until fully charged on Toshiba Portege R500 (and presumably on other boxes too). Fix the issue by correcting the conversion from mW to mA. Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-04[PATCH] fix bogus argument of blkdev_put() in pktcdvdAl Viro
final close of ->bdev should match the initial open, i.e. get FMODE_READ | FMODE_NDELAY; FMODE_READ|FMODE_WRITE has been a braino. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-12-04[PATCH 1/2] kill FMODE_NDELAY_NOWChristoph Hellwig
Update FMODE_NDELAY before each ioctl call so that we can kill the magic FMODE_NDELAY_NOW. It would be even better to do this directly in setfl(), but for that we'd need to have FMODE_NDELAY for all files, not just block special files. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2008-12-03netx-eth: initialize per device spinlockUwe Kleine-König
The spinlock used in the netx-eth driver was never properly initialized. This was noticed using CONFIG_DEBUG_SPINLOCK=y Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-03enc28j60: Fix sporadic packet loss (corrected again)Baruch Siach
Packet data read from the RX buffer the when the RSV is at the end of the RX buffer does not warp around. This causes packet loss, as the actual data is never read. Fix this by calculating the right packet data location. Thanks to Shachar Shemesh for suggesting the fix. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Acked-by: Claudio Lanconelli <lanconelli.claudio@eptar.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-03hysdn: fix writing outside the field on 64 bitsPascal Terjan
ifa_local is assumed to be unsigned long which lead to writing the address at dev->dev_addr-2 instead of +2 noticed thanks to gcc: drivers/isdn/hysdn/hysdn_net.c: In function `net_open': drivers/isdn/hysdn/hysdn_net.c:91: warning: array subscript is below array bounds Signed-off-by: Pascal Terjan <pterjan@mandriva.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-03b1isa: fix b1isa_exit() to really remove registered capi controllersWilfried Klaebe
On "/etc/init.d/capiutils stop", this oops happened. The oops happens on reading /proc/capi/controllers because capi_ctrl->procinfo is called for the wrongly not unregistered controller, which points to b1isa_procinfo(), which was removed on module unload. b1isa_exit() did not call b1isa_remove() for its controllers because io[0] == 0 on module unload despite having been 0x340 on module load. Besides, just removing the controllers that where added on module load time and not those that were added later via b1isa_add_card() is wrong too - the place where all added cards are found is isa_dev[]. relevant dmesg lines: [ 0.000000] Linux version 2.6.27.4 (w@shubashi) (gcc version 4.3.2 (Debian 4.3.2-1) ) #3 Thu Oct 30 16:49:03 CET 2008 [ 67.403555] CAPI Subsystem Rev 1.1.2.8 [ 68.529154] capifs: Rev 1.1.2.3 [ 68.563292] capi20: Rev 1.1.2.7: started up with major 68 (middleware+capifs) [ 77.026936] b1: revision 1.1.2.2 [ 77.049992] b1isa: revision 1.1.2.3 [ 77.722655] kcapi: Controller [001]: b1isa-340 attached [ 77.722671] b1isa: AVM B1 ISA at i/o 0x340, irq 5, revision 255 [ 81.272669] b1isa-340: card 1 "B1" ready. [ 81.272683] b1isa-340: card 1 Protocol: DSS1 [ 81.272689] b1isa-340: card 1 Linetype: point to multipoint [ 81.272695] b1isa-340: B1-card (3.11-03) now active [ 81.272702] kcapi: card [001] "b1isa-340" ready. [ 153.721281] kcapi: card [001] down. [ 154.151889] BUG: unable to handle kernel paging request at e87af000 [ 154.152081] IP: [<e87af000>] [ 154.153292] *pde = 2655b067 *pte = 00000000 [ 154.153307] Oops: 0000 [#1] [ 154.153360] Modules linked in: rfcomm l2cap ppdev lp ipt_MASQUERADE tun capi capifs kernelcapi ac battery nfsd exportfs nfs lockd nfs_acl sunrpc sit tunnel4 bridge stp llc ipt_REJECT ipt_LOG xt_tcpudp xt_state iptable_filter iptable_mangle iptable_nat nf_nat nf_conntrack_ipv4 nf_conntrack ip_tables x_tables nls_utf8 isofs nls_base zlib_inflate loop ipv6 netconsole snd_via82xx dvb_usb_dib0700 gameport dib7000p dib7000m dvb_usb snd_ac97_codec ac97_bus dvb_core mt2266 snd_pcm tuner_xc2028 dib3000mc dibx000_common mt2060 dib0070 snd_page_alloc snd_mpu401_uart snd_seq_midi snd_seq_midi_event btusb snd_rawmidi bluetooth snd_seq snd_timer snd_seq_device snd via686a i2c_viapro soundcore i2c_core parport_pc parport button dm_mirror dm_log dm_snapshot floppy sg ohci1394 uhci_hcd ehci_hcd 8139too mii ieee1394 usbcore sr_mod cdrom sd_mod thermal processor fan [last unloaded: b1] [ 154.153360] [ 154.153360] Pid: 4132, comm: capiinit Not tainted (2.6.27.4 #3) [ 154.153360] EIP: 0060:[<e87af000>] EFLAGS: 00010286 CPU: 0 [ 154.153360] EIP is at 0xe87af000 [ 154.153360] EAX: e6b9ccc8 EBX: e6b9ccc8 ECX: e87a0c67 EDX: e87af000 [ 154.153360] ESI: e142bbc0 EDI: e87a56e0 EBP: e0505f0c ESP: e0505ee4 [ 154.153360] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 [ 154.153360] Process capiinit (pid: 4132, ti=e0504000 task=d1196cf0 task.ti=e0504000) [ 154.153360] Stack: e879f650 00000246 e0505ef4 c01472eb e0505f0c 00000246 e7001780 fffffff4 [ 154.153360] fffffff4 e142bbc0 e0505f48 c01a56c6 00000400 b805e000 d102dc80 e142bbe0 [ 154.153360] 00000000 e87a56e0 00000246 e12617ac 00000000 00000000 e1261760 fffffffb [ 154.153360] Call Trace: [ 154.153360] [<e879f650>] ? controller_show+0x20/0x90 [kernelcapi] [ 154.153360] [<c01472eb>] ? trace_hardirqs_on+0xb/0x10 [ 154.153360] [<c01a56c6>] ? seq_read+0x126/0x2f0 [ 154.153360] [<c01a55a0>] ? seq_read+0x0/0x2f0 [ 154.153360] [<c01c033c>] ? proc_reg_read+0x5c/0x90 [ 154.153360] [<c0189919>] ? vfs_read+0x99/0x140 [ 154.153360] [<c01c02e0>] ? proc_reg_read+0x0/0x90 [ 154.153360] [<c0189a7d>] ? sys_read+0x3d/0x70 [ 154.153360] [<c0103c3d>] ? sysenter_do_call+0x12/0x35 [ 154.153360] ======================= [ 154.153360] Code: Bad EIP value. [ 154.153360] EIP: [<e87af000>] 0xe87af000 SS:ESP 0068:e0505ee4 [ 154.153360] ---[ end trace 23750b6c2862de94 ]--- Signed-off-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Karsten Keil <kkeil@suse.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-04drm/i915: Return error in i915_gem_set_to_gtt_domain if we're not in the GTT.Eric Anholt
It's only for flushing caches appropriately for GTT access, not for actually getting it there. Prevents potential smashing of cpu read/write domains on unbound objects. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Retry execbuffer pinning after clearing the GTTKeith Packard
If we fail to pin all of the buffers in an execbuffer request, go through and clear the GTT and try again to see if its just a matter of fragmentation Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Move the execbuffer domain computations togetherKeith Packard
This eliminates the dev_set_domain function and just in-lines it where its used, with the goal of moving the manipulation and use of invalidate_domains and flush_domains closer together. This also avoids calling add_request unless some domain has been flushed. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Rename object_set_domain to object_set_to_gpu_domainKeith Packard
Now that the CPU and GTT domain operations are isolated to their own functions, the previously general-purpose set_domain function is now used only to set GPU domains. It also has no failure cases, which is important as this eliminates any possible interruption of the computation of new object domains and subsequent emmission of the flushing instructions into the ring. Signed-off-by: Keith Packard <keithp@keithp.com> Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Make a single set-to-cpu-domain path and use it wherever needed.Eric Anholt
This fixes several domain management bugs, including potential lack of cache invalidation for pread, potential failure to wait for set_domain(CPU, 0), and more, along with producing more intelligible code. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Make a single set-to-gtt-domain path.Eric Anholt
This fixes failure to flush caches in the relocation update path, and failure to wait in the set_domain ioctl, each of which could lead to incorrect rendering. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: If interrupted while setting object domains, still emit the flush.Eric Anholt
Otherwise, we would leave the objects in an inconsistent state, such as write_domain == 0 but on the flushing list. Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Move flushing list cleanup from flush request retire to request emit.Eric Anholt
obj_priv->write_domain is "write domain if the GPU went idle now", not "write domain at this moment." By postponing the clear, we confused the concept, required more storage, and potentially emitted more flushes than are required. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-04drm/i915: Respect GM965/GM45 bit-17-instead-of-bit-11 option for swizzling.Eric Anholt
This fixes readpixels and buffer corruption when swapped out and in by disabling tiling on them. Now that we know that the bit 17 mode isn't just a mistake of older chipsets, we'll need to work on a clever fix so that we can get the performance of tiling on these chipsets, but that will require intrusive changes targeted at the next kernel release, not this one. Signed-off-by: Eric Anholt <eric@anholt.net> Signed-off-by: Dave Airlie <airlied@redhat.com>
2008-12-03Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-blockLinus Torvalds
* 'for-linus' of git://git.kernel.dk/linux-2.6-block: block: fix setting of max_segment_size and seg_boundary mask block: internal dequeue shouldn't start timer block: set disk->node_id before it's being used When block layer fails to map iov, it calls bio_unmap_user to undo
2008-12-03iTCO_wdt: fix typo when setting TCO_EN bitLinus Torvalds
The code used '&= 0x00002000' when it tried to set the TCO_EN bit, which obviously didn't set that bit at all, but instead just reset all the other bits in the SMI_EN register. This bug seemingly caused various random behavior, with Frans Pop reporting that X.org just silently hung at startup and Rafael Wysocki reports the fan spinning with full speed. See http://lkml.org/lkml/2008/12/3/178 http://bugzilla.kernel.org/show_bug.cgi?id=12162 The problem seems to have been triggered by "[WATCHDOG] iTCO_wdt : problem with rebooting on new ICH9 based motherboards" (commit 7cd5b08be3c489df11b559fef210b81133764ad4), but the bogus code existed before that too (in the "supermicro_old_pre_stop()" function), it just apparently never showed up due to different logic. In that commit the broken code got moved around and now gets executed much more. Reported-by: Rafael J. Wysocki <rjw@sisk.pl> Tested-by: Frans Pop <elendil@planet.nl> Cc: Wim Van Sebroeck <wim@iguana.be> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-03block: fix setting of max_segment_size and seg_boundary maskMilan Broz
Fix setting of max_segment_size and seg_boundary mask for stacked md/dm devices. When stacking devices (LVM over MD over SCSI) some of the request queue parameters are not set up correctly in some cases by default, namely max_segment_size and and seg_boundary mask. If you create MD device over SCSI, these attributes are zeroed. Problem become when there is over this mapping next device-mapper mapping - queue attributes are set in DM this way: request_queue max_segment_size seg_boundary_mask SCSI 65536 0xffffffff MD RAID1 0 0 LVM 65536 -1 (64bit) Unfortunately bio_add_page (resp. bio_phys_segments) calculates number of physical segments according to these parameters. During the generic_make_request() is segment cout recalculated and can increase bio->bi_phys_segments count over the allowed limit. (After bio_clone() in stack operation.) Thi is specially problem in CCISS driver, where it produce OOPS here BUG_ON(creq->nr_phys_segments > MAXSGENTRIES); (MAXSEGENTRIES is 31 by default.) Sometimes even this command is enough to cause oops: dd iflag=direct if=/dev/<vg>/<lv> of=/dev/null bs=128000 count=10 This command generates bios with 250 sectors, allocated in 32 4k-pages (last page uses only 1024 bytes). For LVM layer, it allocates bio with 31 segments (still OK for CCISS), unfortunatelly on lower layer it is recalculated to 32 segments and this violates CCISS restriction and triggers BUG_ON(). The patch tries to fix it by: * initializing attributes above in queue request constructor blk_queue_make_request() * make sure that blk_queue_stack_limits() inherits setting (DM uses its own function to set the limits because it blk_queue_stack_limits() was introduced later. It should probably switch to use generic stack limit function too.) * sets the default seg_boundary value in one place (blkdev.h) * use this mask as default in DM (instead of -1, which differs in 64bit) Bugs related to this: https://bugzilla.redhat.com/show_bug.cgi?id=471639 http://bugzilla.kernel.org/show_bug.cgi?id=8672 Signed-off-by: Milan Broz <mbroz@redhat.com> Reviewed-by: Alasdair G Kergon <agk@redhat.com> Cc: Neil Brown <neilb@suse.de> Cc: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Cc: Tejun Heo <htejun@gmail.com> Cc: Mike Miller <mike.miller@hp.com> Signed-off-by: Jens Axboe <jens.axboe@oracle.com>
2008-12-03[MTD] [NAND] fix OOPS accessing flash operations over STM flash on PXADenis V. Lunev
STM 2Gb flash is a large-page NAND flash. Set operations accordingly. This field is dereferenced without a check in several places resulting in OOPS. Signed-off-by: Denis V. Lunev <den@openvz.org> Acked-by: Eric Miao <ymiao3@marvell.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
2008-12-03bnx2: Add workaround to handle missed MSI.Michael Chan
The bnx2 chips do not support per MSI vector masking. On 5706/5708, new MSI address/data are stored only when the MSI enable bit is toggled. As a result, SMP affinity no longer works in the latest kernel. A more serious problem is that the driver will no longer receive interrupts when the MSI receiving CPU goes offline. The workaround in this patch only addresses the problem of CPU going offline. When that happens, the driver's timer function will detect that it is making no forward progress on pending interrupt events and will recover from it. Eric Dumazet reported the problem. We also found that if an interrupt is internally asserted while MSI and INTA are disabled, the chip will end up in the same state after MSI is re-enabled. The same workaround is needed for this problem. Signed-off-by: Michael Chan <mchan@broadcom.com> Tested-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2008-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdogLinus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: [WATCHDOG] hpwdt: Fix kdump when using hpwdt [WATCHDOG] hpwdt: set the mapped BIOS address space as executable [WATCHDOG] iTCO_wdt: add PCI ID's for ICH9 & ICH10 chipsets [WATCHDOG] iTCO_wdt : correct status clearing [WATCHDOG] iTCO_wdt : problem with rebooting on new ICH9 based motherboards [WATCHDOG] fix mtx1_wdt compilation failure
2008-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6: sparc64: Fix offset calculation in compute_size() rtc: rtc-starfire fixes
2008-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits) MAINTAINERS: add netdev to ATM ATM: horizon, fix hrz_probe fail path pppol2tp: Add missing sock_put() in pppol2tp_release() net: Fix soft lockups/OOM issues w/ unix garbage collector macvlan: don't broadcast PAUSE frames to macvlan devices Phonet: fix oops in phonet_address_del() on non-Phonet device netfilter: ctnetlink: fix GFP_KERNEL allocation under spinlock sungem: Fix PCS_MIICTRL register write in gem_init_phy(). net: make skb_truesize_bug() call WARN() net: hp-plus uses eip_poll net/wireless/reg.c: fix bad WARN_ON in if statement ath5k: disable beacon filter when station is not associated ath5k: fix Security issue in DebugFS part of ath5k ath9k: correct expected max RX buffer size ath9k: Fix SW-IOMMU bounce buffer starvation mac80211 : Fix setting ad-hoc mode and non-ibss channel iwlagn: fix DMA sync phylib: Add Vitesse VSC8221 SGMII PHY rose: zero length frame filtering in af_rose.c bridge: netfilter: fix update_pmtu crash with GRE ...
2008-12-02Merge branch 'for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Update defconfigs for 2.6.28-rc7 macfb: Do not overflow fb_fix_screeninfo.id
2008-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6: alim15x3: fix sparse warning ide: remove dead code from drive_is_ready() ide: fix build for DEBUG_PM ide: respect current DMA setting during resume ide: add SAMSUNG SP0822N with firmware WA100-10 to ivb_list[] amd74xx: workaround unreliable AltStatus register for nVidia controllers ide: fix the ide_release_lock imbalance
2008-12-02Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6Linus Torvalds
* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: [SCSI] stex: switch to block timeout [SCSI] make scsi_eh_try_stu use block timeout [SCSI] megaraid_sas: switch to block timeout [SCSI] ibmvscsi: switch to block timeout [SCSI] aacraid: switch to block timeout [SCSI] zfcp: prevent double decrement on host_busy while being busy [SCSI] zfcp: fix deadlock between wq triggered port scan and ERP [SCSI] zfcp: eliminate race between validation and locking [SCSI] zfcp: verify for correct rport state before scanning for SCSI devs [SCSI] zfcp: returning an ERR_PTR where a NULL value is expected [SCSI] zfcp: Fix opening of wka ports [SCSI] zfcp: fix remote port status check [SCSI] fc_transport: fix old bug on bitflag definitions [SCSI] Fix hang in starved list processing
2008-12-02sgi-gru: call fs_initcall() if statically linkedDean Nelson
If xpc.ko and gru.ko are both statically linked into the kernel, then xpc_init() can get called before gru_init() and make a call to one of the gru's exported functions before the gru has initialized itself. The end result is a NULL dereference. Signed-off-by: Dean Nelson <dcn@sgi.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-12-02alim15x3: fix sparse warningHannes Eder
Fix this sparse warning: drivers/ide/alim15x3.c:594:2: warning: returning void-valued expression Signed-off-by: Hannes Eder <hannes@hanneseder.net> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02ide: remove dead code from drive_is_ready()Bartlomiej Zolnierkiewicz
We guarantee 400ns delay at the time of issuing the command. Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02ide: fix build for DEBUG_PMBartlomiej Zolnierkiewicz
Also while at it: * Drop unused arguments from ide_complete_power_step(). * Move DEBUG_PM printk() from ide_end_drive_cmd() to ide_complete_power_step(). Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02ide: respect current DMA setting during resumeBartlomiej Zolnierkiewicz
Respect current DMA setting during resume, otherwise PIO timings may get destroyed if host uses shared PIO/MWDMA timings. Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02ide: add SAMSUNG SP0822N with firmware WA100-10 to ivb_list[]Bartlomiej Zolnierkiewicz
Should fix kernel.org bug #10225: http://bugzilla.kernel.org/show_bug.cgi?id=10225 Reported-by: Matthias B. <haferfrost@web.de> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Acked-by: Sergei Shtyltov <sshtylyov@ru.mvista.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02amd74xx: workaround unreliable AltStatus register for nVidia controllersBartlomiej Zolnierkiewicz
It seems that on some nVidia controllers using AltStatus register can be unreliable so default to Status register if the PCI device is in Compatibility Mode. In order to achieve this: * Add ide_pci_is_in_compatibility_mode() inline helper to <linux/ide.h>. * Add IDE_HFLAG_BROKEN_ALTSTATUS host flag and set it in amd74xx host driver for nVidia controllers in Compatibility Mode. * Teach actual_try_to_identify() and drive_is_ready() about the new flag. This fixes the regression caused by removal of CONFIG_IDEPCI_SHARE_IRQ config option in 2.6.25 and using AltStatus register unconditionally when available (kernel.org bugs #11659 and #10216). [ Moreover for CONFIG_IDEPCI_SHARE_IRQ=y (which is what most people and distributions use) it never worked correctly. ] Thanks to Remy LABENE and Lars Winterfeld for help with debugging the problem. More info at: http://bugzilla.kernel.org/show_bug.cgi?id=11659 http://bugzilla.kernel.org/show_bug.cgi?id=10216 Reported-by: Remy LABENE <remy.labene@free.fr> Tested-by: Remy LABENE <remy.labene@free.fr> Tested-by: Lars Winterfeld <lars.winterfeld@tu-ilmenau.de> Acked-by: Borislav Petkov <petkovbb@gmail.com> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02ide: fix the ide_release_lock imbalanceMichael Schmitz
ide_release_lock() spits out lots of: ide_release_lock: bug warnings on Atari Falcon. Fix the ide_release_lock imbalance. Signed-off-by: Michael Schmitz <schmitz@biophys.uni-duesseldorf.de> Cc: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
2008-12-02macfb: Do not overflow fb_fix_screeninfo.idFinn Thain
Don't overflow the 16-character fb_fix_screeninfo id string (fixes some console erasing and blanking artifacts). Have the ID default to "Unknown" on machines with no built-in video and no nubus devices. Check for fb_alloc_cmap failure. Signed-off-by: Finn Thain <fthain@telegraphics.com.au> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2008-12-02[MTD] [NAND] drivers/mtd/nand/pasemi_nand.c: Add missing pci_dev_putJulia Lawall
pci_get_device increments a reference count that should be decremented using pci_dev_put. The semantic patch that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // <smpl> @r exists@ local idexpression x; statement S,S1; position p1,p2,p3; expression E,E1; type T,T1; expression *ptr != NULL; @@ ( if ((x@p1 = pci_get_device(...)) == NULL) S | x@p1 = pci_get_device(...); ) ... when != pci_dev_put(...,(T)x,...) when != if (...) { <+... pci_dev_put(...,(T)x,...) ...+> } when != true x == NULL || ... when != x = E when != E = (T)x when any ( if (x == NULL || ...) S1 | if@p2 (...) { ... when != pci_dev_put(...,(T1)x,...) when != if (...) { <+... pci_dev_put(...,(T1)x,...) ...+> } when != x = E1 when != E1 = (T1)x ( return \(0\|<+...x...+>\|ptr\); | return@p3 ...; ) } ) @ script:python @ p1 << r.p1; p3 << r.p3; @@ print "* file: %s pci_get_device: %s return: %s" % (p1[0].file,p1[0].line,p3[0].line) // </smpl> Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
2008-12-01Merge branch 'for_linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (25 commits) em28xx: remove backward compat macro added on a previous fix V4L/DVB (9748): em28xx: fix compile warning V4L/DVB (9743): em28xx: fix oops audio V4L/DVB (9742): em28xx-alsa: implement another locking schema V4L/DVB (9732): sms1xxx: use new firmware for Hauppauge WinTV MiniStick V4L/DVB (9691): gspca: Move the video device to a separate area. V4L/DVB (9690): gspca: Lock the subdrivers via module_get/put. V4L/DVB (9689): gspca: Memory leak when disconnect while streaming. V4L/DVB (9668): em28xx: fix a race condition with hald V4L/DVB (9664): af9015: don't reconnect device in USB-bus V4L/DVB (9647): em28xx: void having two concurrent control URB's V4L/DVB (9646): em28xx: avoid allocating/dealocating memory on every control urb V4L/DVB (9645): em28xx: Avoid memory leaks if registration fails V4L/DVB (9639): Make dib0700 remote control support work with firmware v1.20 V4L/DVB (9635): v4l: s2255drv fix firmware test on big-endian V4L/DVB (9634): Make sure the i2c gate is open before powering down tuner V4L/DVB (9632): make em28xx aux audio input work V4L/DVB (9631): Make s2api work for ATSC support V4L/DVB (9627): em28xx: Avoid i2c register error for boards without eeprom V4L/DVB (9608): Fix section mismatch warning for dm1105 during make ...