H. Peter Anvin [Fri, 31 Aug 2007 18:30:31 +0000 (11:30 -0700)]
[x86 setup] Don't rely on the VESA BIOS being register-clean
The VESA BIOS is specified to be register-clean. However, we have now
found at least one system which violates that. Thus, be as paranoid
about VESA calls as about everything else.
Huge thanks to Will Simoneau for reporting, diagnosing, and testing
this out on Dell Inspiron 5150.
Cc: Will Simoneau <simoneau@ele.uri.edu> Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Page migration: Do not accept invalid nodes in the target nodeset
Page migration currently does not check if the target of the move contains
nodes that that are invalid (if root attempts to migrate pages)
and may try to allocate from invalid nodes if these are specified
leading to oopses.
Return -EINVAL if an offline node is specified.
Signed-off-by: Christoph Lameter <clameter@sgi.com> Cc: Shaohua Li <shaohua.li@intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Gibson [Fri, 31 Aug 2007 06:56:40 +0000 (23:56 -0700)]
hugepage: fix broken check for offset alignment in hugepage mappings
For hugepage mappings, the file offset, like the address and size, needs to
be aligned to the size of a hugepage.
In commit 68589bc353037f233fe510ad9ff432338c95db66, the check for this was
moved into prepare_hugepage_range() along with the address and size checks.
But since BenH's rework of the get_unmapped_area() paths leading up to
commit 4b1d89290b62bb2db476c94c82cf7442aab440c8, prepare_hugepage_range()
is only called for MAP_FIXED mappings, not for other mappings. This means
we're no longer ever checking for an aligned offset - I've confirmed that
mmap() will (apparently) succeed with a misaligned offset on both powerpc
and i386 at least.
This patch restores the check, removing it from prepare_hugepage_range()
and putting it back into hugetlbfs_file_mmap(). I'm putting it there,
rather than in the get_unmapped_area() path so it only needs to go in one
place, than separately in the half-dozen or so arch-specific
implementations of hugetlb_get_unmapped_area().
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Cc: Adam Litke <agl@us.ibm.com> Cc: Andi Kleen <ak@suse.de> Cc: "David S. Miller" <davem@davemloft.net> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Shane Huang [Fri, 31 Aug 2007 06:56:38 +0000 (23:56 -0700)]
i2c-piix4: Fix SB700 PCI device ID
We find that SB700 and SB800 use the same SMBus device ID as SB600, which is
0x4385, instead of the already submitted 0x4395.
Besides removing the wrong SB700 device ID, add SB800 support to kernel, by
renaming the PCI_DEVICE_ID_ATI_IXP600_SMBUS into
PCI_DEVICE_ID_ATI_SBX00_SMBUS.
Signed-off-by: Shane Huang <shane.huang@amd.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Oleg Nesterov [Fri, 31 Aug 2007 06:56:35 +0000 (23:56 -0700)]
sigqueue_free: fix the race with collect_signal()
Spotted by taoyue <yue.tao@windriver.com> and Jeremy Katz <jeremy.katz@windriver.com>.
collect_signal: sigqueue_free:
list_del_init(&first->list);
if (!list_empty(&q->list)) {
// not taken
}
q->flags &= ~SIGQUEUE_PREALLOC;
__sigqueue_free(first); __sigqueue_free(q);
Now, __sigqueue_free() is called twice on the same "struct sigqueue" with the
obviously bad implications.
In particular, this double free breaks the array_cache->avail logic, so the
same sigqueue could be "allocated" twice, and the bug can manifest itself via
the "impossible" BUG_ON(!SIGQUEUE_PREALLOC) in sigqueue_free/send_sigqueue.
Hopefully this can explain these mysterious bug-reports, see
Alexey Dobriyan reports this patch makes the difference for the testcase, but
nobody has an access to the application which opened the problems originally.
Also, this patch removes tasklist lock/unlock, ->siglock is enough.
This shows that a driver's irq handler was running both in hard interrupt
and process contexts with irqs enabled. The latter was done during
free_irq() call and was possible only with CONFIG_DEBUG_SHIRQ enabled.
This was fixed by another patch.
But similar problem is possible with request_irq(): any locks taken from
irq handler could be vulnerable - especially with soft interrupts. This
patch fixes it by disabling local interrupts during handler's run. (It
seems, disabling softirqs should be enough, but it needs more checking
on possible races or other special cases).
Ryusuke Konishi [Fri, 31 Aug 2007 06:56:33 +0000 (23:56 -0700)]
eCryptfs: fix possible fault in ecryptfs_sync_page
This will avoid a possible fault in ecryptfs_sync_page().
In the function, eCryptfs calls sync_page() method of a lower filesystem
without checking its existence. However, there are many filesystems that
don't have this method including network filesystems such as NFS, AFS, and
so forth. They may fail when an eCryptfs page is waiting for lock.
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp> Acked-by: Michael Halcrow <mhalcrow@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Andrew Victor [Fri, 31 Aug 2007 06:56:32 +0000 (23:56 -0700)]
Fix typo in atmel_spi.c
Fix cut 'n paste bug in Atmel SPI driver.
Signed-off-by: Andrew Victor <andrew@sanpeople.com> Acked-by: David Brownell <david-b@pacbell.net> Acked-by: Haavard Skinnemoen <hskinnemoen@atmel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Ralf Baechle [Fri, 31 Aug 2007 06:56:30 +0000 (23:56 -0700)]
Add MAINTAINERS entry for IOC3 serial driver
The IOC3 is a multifunction device but not in sense of the PCI
specification. Currently its ethernet and serial functionality are
supported by two separate drivers authored and maintained by different
people, so MAINTAINERS should reflect that.
Cc: Patrick Gefre <pfg@sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
PM: Fix dependencies of CONFIG_SUSPEND and CONFIG_HIBERNATION
Dependencies of CONFIG_SUSPEND and CONFIG_HIBERNATION introduced by commit 296699de6bdc717189a331ab6bbe90e05c94db06 "Introduce CONFIG_SUSPEND for
suspend-to-Ram and standby" are incorrect, as they don't cover the facts that
(1) not all architectures support suspend and (2) SMP hibernation is only
possible on X86 and PPC64 (if CONFIG_PPC64_SWSUSP is set).
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
slub: do not fail if we cannot register a slab with sysfs
Do not BUG() if we cannot register a slab with sysfs. Just print an error.
The only consequence of not registering is that the slab cache is not
visible via /sys/slab. A BUG() may not be visible that early during boot
and we have had multiple issues here already.
Signed-off-by: Christoph Lameter <clameter@sgi.com> Acked-by: David S. Miller <davem@davemloft.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Brownell [Fri, 31 Aug 2007 06:56:24 +0000 (23:56 -0700)]
SPI driver hotplug/coldplug fixes
Update various SPI drivers so they properly support
- coldplug through "modprobe $(cat /sys/devices/.../modalias)"
- hotplug through "modprobe $(MODALIAS)"
The basic rule for platform, SPI, and (new style) I2C drivers is just
to make sure that modprobing the driver name works. In this case, all
the relevant drivers are platform drivers, and this patch either
(a) Changes the driver name, if no in-tree code would break;
this is simpler and thus preferable in the long term.
(b) Adds MODULE_ALIAS directives, when in-tree platforms declare
devices using the current driver name; less desirable.
Most systems will link SPI controller drivers statically, but
there's no point in being needlessly broken.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net> Cc: Jean Delvare <khali@linux-fr.org> Acked-by: Andrei Konovalov <akonovalov@ru.mvista.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The problem is that in do_exit(), task_struct.exit_code is set to 'code' only
after taskstats_exit() has been called. So we need to move the assignment
before taskstats_exit().
Signed-off-by: Jonathan Lim <jlim@sgi.com> Cc: Balbir Singh <balbir@in.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jan Kara [Fri, 31 Aug 2007 06:56:22 +0000 (23:56 -0700)]
Fix possible NULL pointer dereference in udf_table_free_blocks()
Fix possible NULL pointer dereference when freeing blocks in case table of
free space is used. Also fix handling of the case when we need to move
extent from one block to another one to make space for indirect extent.
BTW: Nobody seem to have ever used this code.
Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jan Kara [Fri, 31 Aug 2007 06:56:22 +0000 (23:56 -0700)]
UDF: handle wrong superblock better
If UDF superblock is incorrect, we can fail to find a table of free /
allocated space and consequently Oops. Handle this situation more
gracefully by ignoring the broken UDF partition.
Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
In migration fallback path, write_page() or lock_page() will be called.
This causes sleep with holding rcu_read_lock().
For avoding that, just do rcu_lock if the page is Anon.(this is enough.)
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> Acked-by: Christoph Lameter <clameter@sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jeff Dike [Fri, 31 Aug 2007 06:56:20 +0000 (23:56 -0700)]
uml: fix x86_64 core dump crash
Stop UML crashing when trying to dump a process core on x86_64. This is the
minimal fix to stop the crash - more things are broken here, and patches are
forthcoming.
The immediate thing to do is define ELF_CORE_COPY_REGS and
ELF_CORE_COPY_FPREGS. Defining ELF_CORE_COPY_FPREGS allows dump_fpu to go
away. It is defined in terms of save_fp_registers, so that needs to be added.
Signed-off-by: Jeff Dike <jdike@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Jeff Dike [Fri, 31 Aug 2007 06:56:17 +0000 (23:56 -0700)]
uml: fix linker script alignment bugs
Fix a class of bugs in the UML linker scripts which caused section boundary
variables to sometimes not line up with their sections.
Signed-off-by: Jeff Dike <jdike@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Some compilers (especially older gcc releases) may skip inlining
sometimes which will lead to link failures. Force the inlining of
keyfunctions in slub_def.h to avoid these issues.
Signed-off-by: Christoph Lameter <clameter@sgi.com> Acked-by: Jan Dittmer <jdi@l4x.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Fri, 31 Aug 2007 07:52:43 +0000 (00:52 -0700)]
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
[SPARC64]: Fix several bugs in MSI handling.
[SPARC64]: Fix type and constant sizes wrt. sun4u IMAP/ICLR handling.
Linus Torvalds [Fri, 31 Aug 2007 07:52:22 +0000 (00:52 -0700)]
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[PKTGEN]: Remove write-only variable.
[NETFILTER]: xt_tcpudp: fix wrong struct in udp_checkentry
[NET_SCHED] sch_prio.c: remove duplicate call of tc_classify()
[BRIDGE]: Fix OOPS when bridging device without ethtool.
[BRIDGE]: Packets leaking out of disabled/blocked ports.
[TCP]: Allow minimum RTO to be configurable via routing metrics.
SCTP: Fix to handle invalid parameter length correctly
SCTP: Abort on COOKIE-ECHO if backlog is exceeded.
SCTP: Correctly disable listening when backlog is 0.
SCTP: Do not retransmit chunks that are newer then rtt.
SCTP: Uncomfirmed transports can't become Inactive
SCTP: Pick the correct port when binding to 0.
SCTP: Use net_ratelimit to suppress error messages print too fast
SCTP: Fix to encode PROTOCOL VIOLATION error cause correctly
SCTP: Fix sctp_addto_chunk() to add pad with correct length
SCTP: Assign stream sequence numbers to the entire message
SCTP: properly clean up fragment and ordering queues during FWD-TSN.
[PKTGEN]: Fix multiqueue oops.
[BNX2]: Add write posting comment.
[BNX2]: Use msleep().
David S. Miller [Fri, 31 Aug 2007 05:27:28 +0000 (22:27 -0700)]
[SPARC64]: Fix several bugs in MSI handling.
1) sun4{u,v}_build_msi() have improper return value handling.
We should always return negative error codes, instead of
using the magic value "0" which could in fact be a valid
MSI number.
2) sun4{u,v}_build_msi() should return -ENOMEM instead of
calling prom_prom() halt with kzalloc() of the interrupt
data fails.
3) We 'remembered' the MSI number using a singleton in the
struct device archdata area, this doesn't work for MSI-X
which can cause multiple MSIs assosciated with one device.
Delete that archdata member, and instead store the MSI
number in the IRQ chip data area.
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Tue, 28 Aug 2007 21:25:32 +0000 (14:25 -0700)]
[SPARC64]: Fix type and constant sizes wrt. sun4u IMAP/ICLR handling.
Sometimes we were using 32-bit values and the top bits were
getting inadvertantly chopped off. This will matter for the
forthcoming Fire controller MSI support.
Signed-off-by: David S. Miller <davem@davemloft.net>
Pavel Emelyanov [Fri, 31 Aug 2007 05:46:36 +0000 (22:46 -0700)]
[PKTGEN]: Remove write-only variable.
The pktgen_thread.pid is set to current->pid and is never used
after this. So remove this at all.
Found during isolating the explicit pid/tgid usage.
Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Acked-by: Sukadev Bhattiprolu <sukadev@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Jesper Bengtsson [Fri, 31 Aug 2007 05:36:43 +0000 (22:36 -0700)]
[NETFILTER]: xt_tcpudp: fix wrong struct in udp_checkentry
It doesn't seem to have any effect on the x86 architecture but it does
have effect on the Axis CRIS architecture.
Signed-off-by: Jesper Bengtsson <jesper.bengtsson@axis.com> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Lucas Nussbaum [Fri, 31 Aug 2007 05:35:46 +0000 (22:35 -0700)]
[NET_SCHED] sch_prio.c: remove duplicate call of tc_classify()
When CONFIG_NET_CLS_ACT is enabled, tc_classify() is called twice in
prio_classify(). This causes "interesting" behaviour: with the setup
below, packets are duplicated, sent twice to ifb0, and then loop in and
out of ifb0.
The patch uses the previously calculated return value in the switch,
which is probably what Patrick had in mind in commit bdba91ec70fb5ccbdeb1c7068319adc6ea9e1a7d -- maybe Patrick can
double-check this?
-- example setup --
ifconfig ifb0 up
tc qdisc add dev ifb0 root netem delay 2s
tc qdisc add dev $ETH root handle 1: prio
tc filter add dev $ETH parent 1: protocol ip prio 10 u32 \
match ip dst 172.24.110.6/32 flowid 1:1 \
action mirred egress redirect dev ifb0
ping -c1 172.24.110.6
Signed-off-by: Lucas Nussbaum <lucas.nussbaum@imag.fr> Signed-off-by: David S. Miller <davem@davemloft.net>
[BRIDGE]: Fix OOPS when bridging device without ethtool.
Bridge code calls ethtool to get speed. The conversion to using
only ethtool_ops broke the case of devices without ethtool_ops.
This is a new regression in 2.6.23.
Rearranged the switch to a logical order, and use gcc initializer.
Ps: speed should have been part of the network device structure from
the start rather than burying it in ethtool.
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Acked-by: Matthew Wilcox <matthew@wil.cx> Signed-off-by: David S. Miller <davem@davemloft.net>
[BRIDGE]: Packets leaking out of disabled/blocked ports.
This patch fixes some packet leakage in bridge. The bridging code was
allowing forward table entries to be generated even if a device was
being blocked. The fix is to not add forwarding database entries
unless the port is active.
The bug arose as part of the conversion to processing STP frames
through normal receive path (in 2.6.17).
Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org> Acked-by: John W. Linville <linville@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Fri, 31 Aug 2007 05:10:28 +0000 (22:10 -0700)]
[TCP]: Allow minimum RTO to be configurable via routing metrics.
Cell phone networks do link layer retransmissions and other
things that cause unnecessary timeout retransmits. So allow
the minimum RTO to be inflated per-route to deal with this.
Signed-off-by: David S. Miller <davem@davemloft.net>
Hugh Dickins [Fri, 31 Aug 2007 03:26:50 +0000 (04:26 +0100)]
fix maxcpus=1 oops in show_stat()
Alexey Dobriyan reports that maxcpus=1 is still broken in 2.6.23-rc4:
if CONFIG_HOTPLUG_CPU is not set, x86_64 bootup oopses in show_stat() -
for_each_possible_cpu accesses a per-cpu area which was never set up.
Alexey identified commit 61ec7567db103d537329b0db9a887db570431ff4
(ACPI: boot correctly with "nosmp" or "maxcpus=0") as the origin;
but it's not really to blame, just exposes a bug in 2.6.23-rc1's commit 8b3b295502444340dd0701855ac422fbf32e161d (Especially when !CONFIG_HOTPLUG_CPU,
avoid needlessy allocating resources for CPUs that can never become available).
rc1's test for max_cpus < 2 in start_kernel() wasn't working because
max_cpus was still NR_CPUS at that point: until rc4 moved the maxcpus
parsing earlier. Now it sets cpu_possible_map to 1 before allocating
all possible per-cpu areas; then smp_init() expands cpu_possible_map
to cpu_present_map (0xf in my case) later on.
rc1's commit has good intentions, but expects cpu_present_map to be
limited by maxcpus, which is only the case on i386. cpus_and(possible,
possible,present) might be good, but needs an audit of cpu_present_map
uses - there may well be assumptions that any cpu present is possible.
So stay safe for now and just revert those #ifndef CONFIG_HOTPLUG_CPU
optimizations in rc1's commit.
Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: Alexey Dobriyan <adobriyan@sw.ru> Cc: Len Brown <lenb@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Jan Beulich <jbeulich@novell.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Stephen Smalley [Wed, 29 Aug 2007 12:51:50 +0000 (08:51 -0400)]
SELinux: clear parent death signal on SID transitions
Clear parent death signal on SID transitions to prevent unauthorized
signaling between SIDs.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Eric Paris <eparis@parisplace.org> Signed-off-by: James Morris <jmorris@localhost.localdomain>
Wei Yongjun [Mon, 6 Aug 2007 05:55:58 +0000 (13:55 +0800)]
SCTP: Fix to handle invalid parameter length correctly
If an INIT with invalid parameter length look like this:
Parameter Type : 1
Parameter Length: 800
and not contain any payload, SCTP will ignore this parameter and send
back a INIT-ACK.
This patch is fix to handle this invalid parameter length correctly.
Vlad Yasevich [Thu, 30 Aug 2007 18:10:59 +0000 (03:10 +0900)]
SCTP: Abort on COOKIE-ECHO if backlog is exceeded.
Currently we abort on the INIT chunk we our backlog is currenlty
exceeded. Delay this about untill COOKIE-ECHO to give the user
time to accept the socket. Also, make sure that we treat
sk_max_backlog of 0 as no connections allowed.
Vlad Yasevich [Fri, 24 Aug 2007 10:37:46 +0000 (19:37 +0900)]
SCTP: Do not retransmit chunks that are newer then rtt.
When performing a retransmit, do not include the chunk if
it was sent less then 1 rtt ago. The reason is that we
may receive the SACK very soon and wouldn't retransmit.
Suggested by Randy Stewart.
Vlad Yasevich [Fri, 24 Aug 2007 10:30:25 +0000 (19:30 +0900)]
SCTP: Uncomfirmed transports can't become Inactive
Do not set Unconfirmed transports to Inactive state. This may
result in an inactive association being destroyed since we start
counting errors on "inactive" transports against the association.
This was found at the SCTP interop event.
Vlad Yasevich [Tue, 21 Aug 2007 05:24:30 +0000 (14:24 +0900)]
SCTP: Pick the correct port when binding to 0.
sctp_bindx() allows the use of unspecified port. The problem is
that every address we bind to ends up selecting a new port if
the user specified port 0. This patch allows re-use of the
already selected port when the port from bindx was 0.
Wei Yongjun [Mon, 27 Aug 2007 03:19:24 +0000 (11:19 +0800)]
SCTP: Use net_ratelimit to suppress error messages print too fast
When multi bundling SHUTDOWN-ACK message is received in ESTAB state,
this will cause "sctp protocol violation state" message print many times.
If SHUTDOWN-ACK is bundled 300 times in one packet, message will be
print 300 times. The same problem also exists when received unexpected
HEARTBEAT-ACK message which is bundled message times.
This patch used net_ratelimit() to suppress error messages print too fast.
Wei Yongjun [Tue, 21 Aug 2007 07:50:01 +0000 (15:50 +0800)]
SCTP: Fix to encode PROTOCOL VIOLATION error cause correctly
PROTOCOL VIOLATION error cause in ABORT is bad encode when make abort
chunk. When SCTP encode ABORT chunk with PROTOCOL VIOLATION error cause,
it just add the error messages to PROTOCOL VIOLATION error cause, the
rest four bytes(struct sctp_paramhdr) is just add to the chunk, not
change the length of error cause. This cause the ABORT chunk to be a bad
format. The chunk is like this:
ABORT chunk
Chunk type: ABORT (6)
Chunk flags: 0x00
Chunk length: 72 (*1)
Protocol violation cause
Cause code: Protocol violation (0x000d)
Cause length: 62 (*2)
Cause information: 5468652063756D756C61746976652074736E2061636B2062...
Cause padding: 0000
[Needless] 00030010
Chunk Length(*1) = 72 but Cause length(*2) only 62, not include the
extend 4 bytes.
((72 - sizeof(chunk_hdr)) = 68) != (62 +3) / 4 * 4
Linus Torvalds [Thu, 30 Aug 2007 16:58:46 +0000 (09:58 -0700)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] PS3: Fix bug where the major version part is not compared
[POWERPC] Update defconfigs
[POWERPC] spufs: Don't call spu_run_init from spu_reacquire_runnable
[POWERPC] spufs: Fix update of mailbox status register during backed wbox write
[POWERPC] spu_manage: fix spu_unit_number for celleb device tree
[POWERPC] Update defconfigs
[POWERPC] Flush registers to proper task context
Rusty Russell [Wed, 29 Aug 2007 20:35:08 +0000 (06:35 +1000)]
Fix lguest page-pinning logic ("lguest: bad stack page 0xc057a000")
If the stack pointer is 0xc057a000, then the first stack page is at
0xc0579000 (the stack pointer is decremented before use). Not
calculating this correctly caused guests with CONFIG_DEBUG_PAGEALLOC=y
to be killed with a "bad stack page" message: the initial kernel stack
was just proceeding the .smp_locks section which
CONFIG_DEBUG_PAGEALLOC marks read-only when freeing.
Thanks to Frederik Deweerdt for the bug report!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Wei Yongjun [Mon, 6 Aug 2007 05:55:47 +0000 (13:55 +0800)]
SCTP: Fix sctp_addto_chunk() to add pad with correct length
At function sctp_addto_chunk(), it do pad before add payload to chunk if
chunk length is not 4-byte alignment. But it do pad with a bad length.
This patch fixed this probleam.
Masakazu Mokuno [Wed, 29 Aug 2007 11:30:25 +0000 (20:30 +0900)]
[POWERPC] PS3: Fix bug where the major version part is not compared
Fix the bug that the major version part of the firmware version number
is ignored in the comparison done by ps3_compare_firmware_version
because the difference of two 64-bit quantities is returned as an int.
Pavel Pisa [Wed, 29 Aug 2007 22:23:38 +0000 (23:23 +0100)]
[ARM] 4561/1: i.MX/MX1 GPIO parenthes omission and input setup fix
During GPIO testing on PiMX1 board there has been revealed
problem with some pins input functions. The GIUS bit has
to be set for inputs to work reliably too. It is surprising
that input worked on some inputs with incorrect setup before.
DR is not mandatory, but it ensures stable constant level
on internal traces.
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz> Acked-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Andre Detsch [Tue, 21 Aug 2007 02:06:22 +0000 (10:06 +0800)]
[POWERPC] spufs: Don't call spu_run_init from spu_reacquire_runnable
This fixes a major bug which was happening when a SPU thread advances
its execution right after being restored to a SPU. A potentially
outdated NPC value was being (re)written to the SPU.
So, spu_run_init, in this case, was either not doing anything relevant,
or breaking the execution of the SPU thread.
This fixes a common problem of losing a mailbox write when it was done
to a saved context.
Signed-off-by: Andre Detsch <adetsch@br.ibm.com> Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Arnd Bergmann [Tue, 21 Aug 2007 02:06:22 +0000 (10:06 +0800)]
[POWERPC] spufs: Fix update of mailbox status register during backed wbox write
When a process writes into the inbound spu mailbox (wbox) while the
context is saved, we accidentally break the contents of the mb_stat_R
register by clearing other entries of the mailbox status register. This
can cause the user side to hang.
This change fixes the problem by only altering the appropriate bits
of the mailbox status register during a backing-store write.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com> Signed-off-by: Jeremy Kerr <jk@ozlabs.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Andrew Morton [Thu, 30 Aug 2007 04:04:33 +0000 (00:04 -0400)]
Input: iforce - fix 'unused variable' warning
drivers/input/joystick/iforce/iforce-packets.c: In function `iforce_get_id_packet':
drivers/input/joystick/iforce/iforce-packets.c:249: warning: unused variable `status'
Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Christian Krafft [Wed, 29 Aug 2007 23:33:53 +0000 (01:33 +0200)]
[POWERPC] spu_manage: fix spu_unit_number for celleb device tree
This fixes a regression introduced with 2.6.23-rc4 after on some
confusion about the device tree interfaces.
IBM QS21 device trees provide "physical-id", so we changed the code to
run on that and remain compatible with all IBM machines.
However, the Toshiba Celleb device tree provides the "unit-id" property,
which was in the Linux code, but never used in this way on IBM hardware.
Legacy device tree used the reg property for the physical id of an spe.
This patch fixes find_spu_unit_number to look for the spu id in that order.
The length is checked to avoid misinterpretation in case the attributes
unit-id or reg do not contain the id.
Signed-off-by: Christian Krafft <krafft@de.ibm.com> Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com> Cc: Jeremy Kerr <jk@ozlabs.org>
Vlad Yasevich [Thu, 2 Aug 2007 20:51:42 +0000 (16:51 -0400)]
SCTP: Assign stream sequence numbers to the entire message
Currently we only assign the sequence number to a packet that
we are about to transmit. This however breaks the Partial
Reliability extensions, because it's possible for us to
never transmit a packet, i.e. it expires before we get to send
it. In such cases, if the message contained multiple SCTP
fragments, and we did manage to send the first part of the
message, the Stream sequence numbers would get into invalid
state and cause receiver to stall.
SCTP: properly clean up fragment and ordering queues during FWD-TSN.
When we recieve a FWD-TSN (meaning the peer has abandoned the data),
we need to clean up any partially received messages that may be
hanging out on the re-assembly or re-ordering queues. This is
a MUST requirement that was not properly done before.
Kumar Gala [Wed, 29 Aug 2007 02:15:53 +0000 (21:15 -0500)]
[POWERPC] Flush registers to proper task context
When we flush register state for FP, Altivec, or SPE in flush_*_to_thread
we need to respect the task_struct that the caller has passed to us.
Most cases we are called with current, however sometimes (ptrace) we may
be passed a different task_struct.
This showed up when using gdbserver debugging a simple program that used
floating point. When gdb tried to show the FP regs they all showed up as
0, because the child's FP registers were never properly flushed to memory.
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Robert Olsson [Tue, 28 Aug 2007 22:43:14 +0000 (15:43 -0700)]
[PKTGEN]: Fix multiqueue oops.
Initially pkt_dev can be NULL this causes netif_subqueue_stopped to
oops. The patch below should cure it. But maybe the pktgen TX logic
should be reworked to better support the new multiqueue support.
Signed-off-by: Robert Olsson <robert.olsson@its.uu.se> Signed-off-by: David S. Miller <davem@davemloft.net>
Samuel [Tue, 28 Aug 2007 18:56:34 +0000 (19:56 +0100)]
[ARM] 4557/1: Fix PXA irq gpio initialization
As pointed out by Jrgen, we are overflowing the number of GPIOs
in pxa_init_irq_gpio(). I'm seeing the same problem on my HTC
Universal PXA270 based PDA.
According to Eric, the function argument is the number of GPIOs,
so we should keep the semantics and reduce the number of
iteration by 1.
Signed-off-by: Samuel Ortiz <sameo@openedhand.com> Acked-by: Jrgen Schindele <linux@schindele.name> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Arjan van de Ven [Tue, 28 Aug 2007 21:34:43 +0000 (14:34 -0700)]
[BNX2]: Use msleep().
bnx2.c (incorrectly) sets current->state directly to
TASK_UNINTERRUPTIBLE, without going through set_task_state(). However
all the code wants to do is an msleep so just make it do that instead...
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com> Acked-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Andrew Vasquez [Mon, 27 Aug 2007 22:25:01 +0000 (15:25 -0700)]
dm-mpath-rdac: don't stomp on a requests transfer bit
Without this, we get qla2xxx complaining about "ISP System Error".
What's happening here is the firmware is detecting a Xfer-ready from the
storage when in fact the data-direction for a mode-select should be a
write (DATA_OUT).
The following patch fixes the problem (typo). Verified by Brian, as
well.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com> Verified-by: Brian De Wolf <bldewolf@csupomona.edu> Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 27 Aug 2007 22:06:28 +0000 (15:06 -0700)]
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
[SPARC32]: Make flush_tlb_kernel_range() an inline function.
[SERIAL]: Fix 32-bit warnings in sunzilog.c and sunsu.c
[SPARC32]: Kill unused vars and macros from prom/console.c
[SPARC32]: Add __cmpdi2() libcall implementation ala. MIPS.
[VIDEO]: Do not prom_halt() in cg3 and bw2 device probe.
[SUNVDC]: Use slice 0xff on VD_DISK_TYPE_DISK.
Linus Torvalds [Mon, 27 Aug 2007 22:06:01 +0000 (15:06 -0700)]
Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NET]: Mark Paul Moore as maintainer of labelled networking.
[VLAN/BRIDGE]: Fix "skb_pull_rcsum - Fatal exception in interrupt"
[ISDN]: Get rid of some pointless allocation casts in common and bsd comp.
[NET]: Avoid pointless allocation casts in BSD compression module
[IRDA]: Do not do pointless kmalloc return value cast in KingSun driver
[NET]: Fix crash in dev_mc_sync()/dev_mc_unsync()
[PPPOL2TP]: Fix endianness annotations.
[IOAT]: ioatdma needs to to play nice in a multi-dma-client world
[SLIP]: trivial sparse warning fix
[EQL]: sparse warning fix
[NET]: is_power_of_2 in net/core/neighbour.c
[TCP]: Describe tcp_init_cwnd() thoroughly in a comment.
[NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless
[KBUILD]: Sanitize tc_ematch headers.
[IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302.
Hugh Dickins [Mon, 27 Aug 2007 15:06:19 +0000 (16:06 +0100)]
fix bogus hotplug cpu warning
Fix bogus DEBUG_PREEMPT warning on x86_64, when cpu brought online after
bootup: current_is_keventd is right to note its use of smp_processor_id
is preempt-safe, but should use raw_smp_processor_id to avoid the warning.
Hugh Dickins [Mon, 27 Aug 2007 15:04:39 +0000 (16:04 +0100)]
reverse CONFIG_ACPI_PROC_EVENT default
Sigh. Again an ACPI assault on the Thinkpad's Fn+F4 to suspend to RAM.
The default and text for CONFIG_THINKPAD_ACPI_INPUT_ENABLED were fixed
in -rc3, but now commit 14e04fb34ffa82ee61ae69f98d8fca12d2e8e31c ("ACPI:
Schedule /proc/acpi/event for removal") introduces the ACPI_PROC_EVENT
config entry, and defaults it to 'n' to disable it again.
Change default to y, and add comment to make it clearer that n is for
future distros.
Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Len Brown <len.brown@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
maxcpus=N is now having no effect on x86_64, and freezing bootup on i386
(because of inconsistency with the separate maxcpus parsing down in
arch/i386, I guess). That's because early_param parsing is a little
different from __setup parsing, and needs the "=" omitted: then it seems
to work as the original commit intended (no mention of IO-APIC in
/proc/interrupts when maxcpus=0).
Signed-off-by: Hugh Dickins <hugh@veritas.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Len Brown <len.brown@intel.com> Cc: Andi Kleen <ak@suse.de> Cc: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Mon, 27 Aug 2007 16:42:21 +0000 (09:42 -0700)]
Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] Fix SLB initialization at boot time
[POWERPC] Fix undefined reference to device_power_up/resume
[POWERPC] cell: Update cell_defconfig for 2.6.23
[POWERPC] axonram: Do not delete gendisks queue in error path
[POWERPC] axonram: Module modification for latest firmware API changes
[POWERPC] cell: Support pinhole-reset on IBM cell blades
[POWERPC] spu_manage: Use newer physical-id attribute
[POWERPC] pasemi: Another IOMMU bugfix for 64K PAGE_SIZE
Linus Torvalds [Mon, 27 Aug 2007 16:30:52 +0000 (09:30 -0700)]
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6
* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kyle/parisc-2.6:
[PARISC] Add NOTES section
[PARISC] Use compat_sys_getdents
[PARISC] Do not allow STI_CONSOLE to be modular
[PARISC] Clean up sti_flush
[PARISC] Add dummy isa_(bus|virt)_to_(virt|bus) inlines
[PARISC] Add empty <asm-parisc/vga.h>
David S. Miller [Sat, 25 Aug 2007 22:17:31 +0000 (15:17 -0700)]
[SERIAL]: Fix 32-bit warnings in sunzilog.c and sunsu.c
resource_size_t can be either a u64 or a u32, and we can't
really know for sure, so when printing such a value out
always use long-long printf formatting and cast the argument
to that type.
Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Sat, 25 Aug 2007 05:05:44 +0000 (22:05 -0700)]
[SUNVDC]: Use slice 0xff on VD_DISK_TYPE_DISK.
While debugging issues with the VDS server I made the
driver use partition 2 to get at the whole disk since
this is the "whole disk" partition in the Sun disk
label.
We really should use slice 0xff which really means
the whole physical disk in the VIO disk protocol.
Otherwise things won't work well on a disk image
that doesn't have a proper disk label on it.
Signed-off-by: David S. Miller <davem@davemloft.net>
Evgeniy Polyakov [Sat, 25 Aug 2007 06:36:29 +0000 (23:36 -0700)]
[VLAN/BRIDGE]: Fix "skb_pull_rcsum - Fatal exception in interrupt"
I tried to preserve bridging code as it was before, but logic is quite
strange - I think we should free skb on error, since it is already
unshared and thus will just leak.
projects / linux-2.6 / log