Linus Torvalds [Thu, 26 Oct 2006 03:21:16 +0000 (20:21 -0700)]
Merge branch 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6
* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
[PATCH] x86-64: Only look at per_cpu data for online cpus.
[PATCH] x86-64: Simplify the vector allocator.
Linus Torvalds [Thu, 26 Oct 2006 03:20:03 +0000 (20:20 -0700)]
Merge branch 'merge' of master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc
* 'merge' of master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc:
[POWERPC] Make sure __cpu_preinit_ppc970 gets called on 970GX processors
[POWERPC] Fix CHRP platforms with only 8259
[POWERPC] IPIC: Fix spinlock recursion in set_irq_handler
[POWERPC] Fix the UCC rx/tx clock of QE
[POWERPC] cell: update defconfig
[POWERPC] spufs: fix another off-by-one bug in spufs_mbox_read
[POWERPC] spufs: fix signal2 file to report signal2
[POWERPC] Fix device_is_compatible() const warning
[POWERPC] Cell timebase bug workaround
[POWERPC] Support feature fixups in modules
[POWERPC] Support feature fixups in vdso's
[POWERPC] Support nested cpu feature sections
[POWERPC] Consolidate feature fixup code
[POWERPC] Fix hang in start_ldr if _end or _edata is unaligned
[POWERPC] Fix spelling errors in ucc_fast.c and ucc_slow.c
[POWERPC] Don't require execute perms on wrapper when building zImage.initrd
[POWERPC] Add 970GX cputable entry
[POWERPC] Fix build breakage with CONFIG_PPC32
[POWERPC] Fix compiler warning message on get_property call
[POWERPC] Simplify stolen time calculation
Al Viro [Tue, 24 Oct 2006 10:15:29 +0000 (11:15 +0100)]
[PATCH] uml: mconsole fixes
* when we have stop/sysrq/go, we get pt_regs of whatever executes
mc_work_proc(). Would be better to see what we had at the time of
interrupt that got us stop.
* stop/stop/stop..... will give stack overflow. Shouldn't allow stop
from mconsole_stop().
* stop/stop/go leaves us inside mconsole_stop() with
os_set_fd_block(req->originating_fd, 0);
reactivate_fd(req->originating_fd, MCONSOLE_IRQ);
just done by nested mconsole_stop(). Ditto.
* once we'd seen stop, there's a period when INTR commands are executed
out of order (as they should; we might have the things stuck badly
enough to never reach mconsole_stop(), but still not badly enough to
block mconsole_interrupt(); in that situation we _want_ things like
"cad" to be executed immediately). Once we enter monsole_stop(), all
INTR commands will be executed in order, mixed with PROC ones. We'd
better let user see that such change of behaviour has happened.
(Suggested by lennert).
* stack footprint of monsole_interrupt() is an atrocity; AFAICS we can
safely make struct mc_request req; static in function there.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Acked-by: Jeff Dike <jdike@addtoit.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
On CHRP platforms with only a 8259 controller, we should set the
default IRQ host to the 8259 driver's one for the IRQ probing
fallbacks to work in case the IRQ tree is incorrect (like on
Pegasos for example). Without this fix, we get a bunch of WARN_ON's
during boot.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 23 Oct 2006 16:35:22 +0000 (11:35 -0500)]
[POWERPC] IPIC: Fix spinlock recursion in set_irq_handler
This causes ipic_set_irq_type to set the handler directly rather
than call set_irq_handler, which causes spinlock recursion because
the lock is already held when ipic_set_irq_type is called.
I'm also not convinced that ipic_set_irq_type should be changing the
handler at all. There seem to be several controllers that don't and
several that do. Those that do would break what appears to be a common
usage of calling set_irq_chip_and_handler followed by set_irq_type, if a
non-standard handler were to be used. OTOH, irq_create_of_mapping()
doesn't set the handler, but only calls set_irq_type().
This patch gets things working in the spinlock-debugging-enabled case,
but I'm curious as to where the handler setting is ideally supposed to be
done. I don't see any documentation on set_irq_type() that clarifies
what the semantics are supposed to be.
Signed-off-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Liu Dave-r63238 [Wed, 18 Oct 2006 08:36:56 +0000 (16:36 +0800)]
[POWERPC] Fix the UCC rx/tx clock of QE
MPC8323EMDS board ethernet interface with RMII uses the CLK16 divisor
for the rx and tx clock, but the ucc_set_qe_mux_rxtx() function doesn't
handle the CLK16 setting of the CMXUCR3 and CMXUCR4 registers. This
fixes it.
Signed-off-by: Dave Liu <daveliu@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Arnd Bergmann [Tue, 24 Oct 2006 16:01:42 +0000 (18:01 +0200)]
[POWERPC] spufs: fix another off-by-one bug in spufs_mbox_read
Currently, spufs_mbox_read transfers more bytes than requested on a
read. If you ask for four bytes, you get eight. This fixes it to
transfer the largest multiple of four bytes that is less than or equal
to the number you asked for.
Note: one nasty property of this file in spufs is that you can only
read multiples of four bytes in the first place, since there is no way
to atomically put back a few bytes into the hardware register. Thus,
reading less than four bytes returns -EINVAL. Asking for more than
four returns the largest possible multiple of four.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Fix a const'ification related warning with device_is_compatible()
and friends related to get_property() not properly having const
on it's input device node argument.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
The Cell CPU timebase has an erratum. When reading the entire 64 bits
of the timebase with one mftb instruction, there is a handful of cycles
window during which one might read a value with the low order 32 bits
already reset to 0x00000000 but the high order bits not yet incremeted
by one. This fixes it by reading the timebase again until the low order
32 bits is no longer 0. That might introduce occasional latencies if
hitting mftb just at the wrong time, but no more than 70ns on a cell
blade, and that was considered acceptable.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
This patch adds support for feature fixups in modules. This involves
adding support for R_PPC64_REL64 relocs to the 64 bits module loader.
It also modifies modpost.c to ignore the powerpc fixup sections (or it
would warn when used in .init.text).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
This patch reworks the feature fixup mecanism so vdso's can be fixed up.
The main issue was that the construct:
.long label (or .llong on 64 bits)
will not work in the case of a shared library like the vdso. It will
generate an empty placeholder in the fixup table along with a reloc,
which is not something we can deal with in the vdso.
The idea here (thanks Alan Modra !) is to instead use something like:
1:
.long label - 1b
That is, the feature fixup tables no longer contain addresses of bits of
code to patch, but offsets of such code from the fixup table entry
itself. That is properly resolved by ld when building the .so's. I've
modified the fixup mecanism generically to use that method for the rest
of the kernel as well.
Another trick is that the 32 bits vDSO included in the 64 bits kernel
need to have a table in the 64 bits format. However, gas does not
support 32 bits code with a statement of the form:
.llong label - 1b (Or even just .llong label)
That is, it cannot emit the right fixup/relocation for the linker to use
to assign a 32 bits address to an .llong field. Thus, in the specific
case of the 32 bits vdso built as part of the 64 bits kernel, we are
using a modified macro that generates:
.long 0xffffffff
.llong label - 1b
Note that is assumes that the value is negative which is enforced by
the .lds (those offsets are always negative as the .text is always
before the fixup table and gas doesn't support emiting the reloc the
other way around).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
This patch adds some macros that can be used with an explicit label in
order to nest cpu features. This should be used very careful but is
necessary for the upcoming cell TB fixup.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
There are currently two versions of the functions for applying the
feature fixups, one for CPU features and one for firmware features. In
addition, they are both in assembly and with separate implementations
for 32 and 64 bits. identify_cpu() is also implemented in assembly and
separately for 32 and 64 bits.
This patch replaces them with a pair of C functions. The call sites are
slightly moved on ppc64 as well to be called from C instead of from
assembly, though it's a very small change, and thus shouldn't cause any
problem.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
Olaf Hering [Fri, 20 Oct 2006 13:57:15 +0000 (15:57 +0200)]
[POWERPC] Fix hang in start_ldr if _end or _edata is unaligned
Quick fix for lack of memset(__bss_start, 0, _end-__bss_start) in
load_kernel(). If edata is unaligned, the loop will overwrite all
memory because r3 and r4 will never be equal.
Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Paul Mackerras <paulus@samba.org>
Gerrit Renker [Tue, 24 Oct 2006 23:17:51 +0000 (16:17 -0700)]
[DCCP]: Update documentation references.
Updates the references to spec documents throughout the code, taking into
account that
* the DCCP, CCID 2, and CCID 3 drafts all became RFCs in March this year
* RFC 1063 was obsoleted by RFC 1191
* draft-ietf-tcpimpl-pmtud-0x.txt was published as an Informational
RFC, RFC 2923 on 2000-09-22.
All references verified.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com> Signed-off-by: David S. Miller <davem@davemloft.net>
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.
When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.
Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.
With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Tue, 24 Oct 2006 23:14:04 +0000 (16:14 -0700)]
[NETFILTER]: Fix ip6_tables protocol bypass bug
As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.
When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.
Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
[PATCH] x86-64: Only look at per_cpu data for online cpus.
When I generalized __assign_irq_vector I failed to pay attention
to what happens when you access a per cpu data structure for
a cpu that is not online. It is an undefined case making any
code that does it have undefined behavior as well.
The code still needs to be able to allocate a vector across cpus
that are not online to properly handle combinations like lowest
priority interrupt delivery and cpu_hotplug. Not that we can do
that today but the infrastructure shouldn't prevent it.
So this patch updates the places where we touch per cpu data
to only touch online cpus, it makes cpu vector allocation
an atomic operation with respect to cpu hotplug, and it updates
the cpu start code to properly initialize vector_irq so we
don't have inconsistencies.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Andi Kleen <ak@suse.de>
There is no reason to remember a per cpu position of which vector
to try. Keeping a global position is simpler and more likely to
result in a global vector allocation even if I don't need or require
it. For level triggered interrupts this means we are less likely to
acknowledge another cpus irq, and cause the level triggered irq to
harmlessly refire.
This simplification makes it easier to only access data structures
of online cpus, by having fewer special cases to deal with.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Andi Kleen <ak@suse.de>
Patrick McHardy [Tue, 24 Oct 2006 22:34:00 +0000 (15:34 -0700)]
[XFRM]: Fix xfrm_state accounting
xfrm_state_num needs to be increased for XFRM_STATE_ACQ states created
by xfrm_state_find() to prevent the counter from going negative when
the state is destroyed.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Russell King [Sun, 22 Oct 2006 15:04:29 +0000 (16:04 +0100)]
[ARM] Comment out missing configuration symbols
HAS_TOUCHSCREEN_ADS7843_LH7 and HAS_TOUCHSCREEN_ADC_LH7 are referenced
but not defined in the LH7A40x configuration. Comment them out to
prevent them causing warnings.
Marc Singer said:
Feel free to remove the Kconfig lines. I'll add it back with
the rest of the config entries.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Anton Vorontsov [Thu, 19 Oct 2006 23:58:49 +0000 (00:58 +0100)]
[ARM] 3898/1: corgi_bl fix module loading
Fix module loading:
corgi_bl: module license 'GPLv2' taints kernel.
corgi_bl: Unknown symbol platform_driver_unregister
corgi_bl: Unknown symbol __symbol_get
corgi_bl: Unknown symbol platform_driver_register
Cc: Richard Purdie <rpurdie@rpsys.net> Signed-off-by: pHilipp Zabel <philipp.zabel@gmail.com> Signed-off-by: Anton Vorontsov <cbou@mail.ru> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Anton Vorontsov [Thu, 19 Oct 2006 23:56:28 +0000 (00:56 +0100)]
[ARM] 3897/1: corgi_bl fix module compiling
Fix module compiling:
WARNING: drivers/video/backlight/corgi_bl.o - Section mismatch:
reference to .init.text: from .data between '$d' (at offset 0x0) and
'bl_mutex'
Cc: Richard Purdie <rpurdie@rpsys.net> Signed-off-by: Anton Vorontsov <cbou@mail.ru> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Linus Torvalds [Mon, 23 Oct 2006 21:25:30 +0000 (14:25 -0700)]
Revert unintentional and bogus change to drivers/pci/quirks.c
In commit 4e8a5201506423e0241202de1349422af4260296 ("[PKT_SCHED] netem:
Orphan SKB when adding to queue.") Davem mistakenly also included a
temporary diff in his tree that disabled the pci_fixup_video VGA quirk,
which broke sparc64.
This reverts that part of the commit. Sayeth Davem:
"Greg KH has a patch coming to you soon which will move that VGA code
back into x86/x86_64/IA64 specific areas and will fix the sparc64
problem properly."
Special thanks to Claudio Martins <ctpm@ist.utl.pt> for noticing the
error in the first place.
Cc: Claudio Martins <ctpm@ist.utl.pt> Cc: David Miller <davem@davemloft.net> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Russell King [Sun, 22 Oct 2006 14:57:18 +0000 (15:57 +0100)]
[PATCH] Remove __must_check for device_for_each_child()
Eliminate more __must_check madness.
The return code from device_for_each_child() depends on the values
which the helper function returns. If the helper function always
returns zero, it's utterly pointless to check the return code from
device_for_each_child().
The only code which knows if the return value should be checked is
the caller itself, so forcing the return code to always be checked
is silly. Hence, remove the __must_check annotation.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Linus Torvalds [Mon, 23 Oct 2006 17:58:33 +0000 (10:58 -0700)]
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa
* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa:
[ALSA] hda-intel - Add check of MSI availabity
[ALSA] version 1.0.13
[ALSA] Fix addition of user-defined boolean controls
[ALSA] Fix AC97 power-saving mode
[ALSA] Fix re-use of va_list
[ALSA] hda_intel: add ATI RS690 HDMI audio support
[ALSA] hda-codec - Add model entry for ASUS U5F laptop
[ALSA] Fix dependency of snd-adlib driver in Kconfig
[ALSA] Various fixes for suspend/resume of ALSA PCI drivers
[ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
[ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return value
[ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return value
[ALSA] sound/isa/cmi8330.c: check kmalloc() return value
[ALSA] sound/isa/gus/interwave.c: check kmalloc() return value
* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[PKT_SCHED] netem: Orphan SKB when adding to queue.
[NET]: kernel-doc fix for sock.h
[NET]: Reduce sizeof(struct flowi) by 20 bytes.
[IPv6] fib: initialize tb6_lock in common place to give lockdep a key
[ATM] nicstar: Fix a bogus casting warning
[ATM] firestream: handle thrown error
[ATM]: No need to return void
[ATM]: handle sysfs errors
[DCCP] ipv6: Fix opt_skb leak.
[DCCP]: Fix Oops in DCCPv6
Takashi Iwai [Mon, 23 Oct 2006 11:40:59 +0000 (13:40 +0200)]
[ALSA] hda-intel - Add check of MSI availabity
Check the availability of MSI and turn off MSI automatically when it's
not available on the hardware. MSI seems broken on some hardwares
but the kernel doesn't know exactly, thus we have to turn the MSI
feature off on the sound driver manually.
Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Srinivasa Ds [Wed, 18 Oct 2006 12:04:49 +0000 (17:34 +0530)]
[POWERPC] Fix build breakage with CONFIG_PPC32
low_cpu_die is called from the CPU hotplug code on 32-bit powermacs,
but it is only defined if CONFIG_PM || CONFIG_CPU_FREQ_PMAC. This
changes the ifdef so it is defined for CONFIG_HOTPLUG_CPU on 32-bit
machines.
Signed-off-by: Srinivasa DS <srinivasa@in.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Zang Roy-r61911 [Wed, 18 Oct 2006 03:18:58 +0000 (11:18 +0800)]
[POWERPC] Fix compiler warning message on get_property call
This fixes the warning message from the return value of function
get_property(), by making sure that the variable that receives the
value is marked as const.
Signed-off-by: Roy Zang <tie-fei.zang@freescale.com>
-- Signed-off-by: Paul Mackerras <paulus@samba.org>
Stephen Rothwell [Tue, 17 Oct 2006 13:08:35 +0000 (23:08 +1000)]
[POWERPC] Simplify stolen time calculation
In calculating stolen time, we were trying to actually account for time
spent in the hypervisor. We don't really have enough information to do
that accurately, so don't try. Instead, we now calculate stolen time as
time that the current cpu thread is not actually dispatching instructions.
On chips without a PURR, we cannot do this, so stolen time will always
be zero. On chips with a PURR, this is merely the difference between
the elapsed PURR values and the elapsed TB values.
This gives us much more sane vaules from tools such as mpstat, even if
they are still a bit strange e.g. 2 busy threads on one cpu will both
appear to have 50% user time and 50% stolen time while 1 busy thread on
a cpu will look like 100% user on one of them and 100% idle on the other.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
David S. Miller [Mon, 23 Oct 2006 04:00:33 +0000 (21:00 -0700)]
[PKT_SCHED] netem: Orphan SKB when adding to queue.
The networking emulator can queue SKBs for a very long
time, so if you're using netem on the sender side for
large bandwidth/delay product testing, the SKB socket
send queue sizes become artificially larger.
Correct this by calling skb_orphan() in netem_enqueue().
Signed-off-by: David S. Miller <davem@davemloft.net>
Takashi Iwai [Wed, 18 Oct 2006 17:09:46 +0000 (19:09 +0200)]
[ALSA] Fix re-use of va_list
The va_list is designed to be used only once. The current code
may pass va_list arguments multiple times and may cause Oops.
Copy/release the arguments temporarily to avoid this problem.
Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Takashi Iwai [Wed, 11 Oct 2006 16:52:53 +0000 (18:52 +0200)]
[ALSA] Various fixes for suspend/resume of ALSA PCI drivers
- Check the return value of pci_enable_device() and request_irq()
in the suspend. If any error occurs there, disable the device
using snd_card_disconnect().
- Call pci_set_power_state() properly with pci_choose_state().
- Fix the order to call pci_set_power_state().
- Removed obsolete house-made PM codes in some drivers.
Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Takashi Iwai [Wed, 11 Oct 2006 16:49:13 +0000 (18:49 +0200)]
[ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
Fixed the assignment of PCM devices for Realtek codecs.
The secondary analog capture should be statically asigned to the
third device regardless whether SPDIF exists or not.
Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Jaroslav Kysela <perex@suse.cz>
Eric Dumazet [Sun, 22 Oct 2006 03:24:01 +0000 (20:24 -0700)]
[NET]: Reduce sizeof(struct flowi) by 20 bytes.
As suggested by David, just kill off some unused fields in dnports to
reduce sizef(struct flowi). If they come back, they should be moved to
nl_u.dn_u in order not to enlarge again struct flowi
[ Modified to really delete this stuff instead of using #if 0. -DaveM ]
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com> Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Sat, 21 Oct 2006 02:44:17 +0000 (19:44 -0700)]
[DCCP] ipv6: Fix opt_skb leak.
Based upon a patch from Jesper Juhl. Try to match the
TCP IPv6 code this was copied from as much as possible,
so that it's easy to see where to add the ipv6 pktoptions
support code.
Signed-off-by: David S. Miller <davem@davemloft.net>
Gerrit Renker [Wed, 11 Oct 2006 15:26:54 +0000 (16:26 +0100)]
[DCCP]: Fix Oops in DCCPv6
I think I got the cause for the Oops observed in
http://www.mail-archive.com/dccp@vger.kernel.org/msg00578.html
The problem is always with applications listening on PF_INET6 sockets. Apart
from the mentioned oops, I observed another one one, triggered at irregular
intervals via timer interrupt:
The latter function is the problem and is also the last function to be called
in said kernel panic.
In any case, there is a real problem with allocating the right request_sock
which is what this patch tackles.
It fixes the following problem:
- application listens on PF_INET6
- DCCPv4 packet comes in, is handed over to dccp_v4_do_rcv, from there
to dccp_v4_conn_request
Now: socket is PF_INET6, packet is IPv4. The following code then furnishes the
connection with IPv6 - request_sock operations:
req = reqsk_alloc(sk->sk_prot->rsk_prot);
The first problem is that all further incoming packets will get a Reset since
the connection can not be looked up.
The second problem is worse:
--> reqsk_alloc is called instead of inet6_reqsk_alloc
--> consequently inet6_rsk_offset is never set (dangling pointer)
--> the request_sock_ops are nevertheless still dccp6_request_ops
--> destructor is called via reqsk_free
--> dccp_v6_reqsk_destructor tries to free random memory location (inet6_rsk_offset not set)
--> panic
I have tested this for a while, DCCP sockets are now handled correctly in all
three scenarios (v4/v6 only/v4-mapped).
Commiter note: I've added the dccp_request_sock_ops forward declaration to keep
the tree building and to reduce the size of the patch for 2.6.19,
later I'll move the functions to the top of the affected source
code to match what we have in the TCP counterpart, where this
problem hasn't existed in the first place, dumb me not to have
done the same thing on DCCP land 8)
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
This patch increases the timeout for PCI split transactions on PHB1 on
the first Calgary to work around an issue with the aic94xx
adapter. Fixes kernel.org bugzilla #7180
(http://bugzilla.kernel.org/show_bug.cgi?id=7180)
Based on excellent debugging and a patch by Darrick J. Wong
<djwong@us.ibm.com>
Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com> Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Andi Kleen <ak@suse.de> Acked-by: Darrick J. Wong <djwong@us.ibm.com>
Ralf Baechle [Sat, 21 Oct 2006 22:17:35 +0000 (23:17 +0100)]
[MIPS] Fix aliasing bug in copy_to_user_page / copy_from_user_page
The current implementation uses a sequence of a cacheflush and a copy.
This is racy in case of a multithreaded debuggee and renders GDB
virtually unusable.
Aside this fixes a performance hog rendering access to /proc/cmdline very
slow and resulting in a enough cache stalls for the 34K AP/SP programming
model to make the bare metal code on the non-Linux VPE miss RT deadlines.
The main part of this patch was originally written by Ralf Baechle;
Atushi Nemoto did the the debugging.
Linus Torvalds [Sat, 21 Oct 2006 20:41:41 +0000 (13:41 -0700)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
[PATCH] libata-sff: Allow for wacky systems
[PATCH] ahci: readability tweak
[PATCH] libata: typo fix
[PATCH] ATA must depend on BLOCK
[PATCH] libata: use correct map_db values for ICH8
Linus Torvalds [Sat, 21 Oct 2006 20:40:29 +0000 (13:40 -0700)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (22 commits)
[PATCH] ibmveth: Fix index increment calculation
[PATCH] Fix timer race
[PATCH] Remove useless comment from sb1250
[PATCH] ucc_geth: changes to ucc_geth driver as a result of qe_lib changes and bugfixes
[PATCH] sky2: 88E803X transmit lockup
[PATCH] e1000: Reset all functions after a PCI error
[PATCH] WAN/pc300: handle, propagate minor errors
[PATCH] Update smc91x driver with ARM Versatile board info
[PATCH] wireless: WE-20 compatibility for ESSID and NICKN ioctls
[PATCH] zd1211rw: fix build-break caused by association race fix
[PATCH] sotftmac: fix a slab corruption in WEP restricted key association
[PATCH] airo: check if need to freeze
[PATCH] wireless: More WE-21 potential overflows...
[PATCH] zd1201: Possible NULL dereference
[PATCH] orinoco: fix WE-21 buffer overflow
[PATCH] airo.c: check returned values
[PATCH] bcm43xx-softmac: Fix system hang for x86-64 with >1GB RAM
[PATCH] bcm43xx-softmac: check returned value from pci_enable_device
[PATCH] softmac: Fix WX and association related races
[PATCH] bcm43xx: fix race condition in periodic work handler
...
Linus Torvalds [Sat, 21 Oct 2006 20:36:46 +0000 (13:36 -0700)]
Merge branch 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6
* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
[PATCH] x86-64: Revert timer routing behaviour back to 2.6.16 state
[PATCH] x86-64: Overlapping program headers in physical addr space fix
[PATCH] x86-64: Put more than one cpu in TARGET_CPUS
[PATCH] x86: Revert new unwind kernel stack termination
[PATCH] x86-64: Use irq_domain in ioapic_retrigger_irq
[PATCH] i386: Disable nmi watchdog on all ThinkPads
[PATCH] x86-64: Revert interrupt backlink changes
[PATCH] x86-64: Fix ENOSYS in system call tracing
[PATCH] i386: Fix fake return address
[PATCH] x86-64: x86_64 add NX mask for PTE entry
[PATCH] x86-64: Speed up dwarf2 unwinder
[PATCH] x86: Use -maccumulate-outgoing-args
[PATCH] x86-64: fix page align in e820 allocator
[PATCH] x86-64: Fix for arch/x86_64/pci/Makefile CFLAGS
[PATCH] i386: fix .cfi_signal_frame copy-n-paste error
[PATCH] x86-64: typo in __assign_irq_vector when updating pos for vector and offset
[PATCH] x86-64: x86_64 hot-add memory srat.c fix
[PATCH] i386: Update defconfig
[PATCH] x86-64: Update defconfig
Trond Myklebust [Sat, 21 Oct 2006 17:24:24 +0000 (10:24 -0700)]
[PATCH] NFS: Cache invalidation fixup
If someone has renamed a directory on the server, triggering the d_move
code in d_materialise_unique(), then we need to invalidate the cached
directory information in the source parent directory.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: Miklos Szeredi <miklos@szeredi.hu> Cc: Maneesh Soni <maneesh@in.ibm.com> Cc: Dipankar Sarma <dipankar@in.ibm.com> Cc: Neil Brown <neilb@cse.unsw.edu.au> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Trond Myklebust [Sat, 21 Oct 2006 17:24:20 +0000 (10:24 -0700)]
[PATCH] VFS: Make d_materialise_unique() enforce directory uniqueness
If the caller tries to instantiate a directory using an inode that already
has a dentry alias, then we attempt to rename the existing dentry instead
of instantiating a new one. Fail with an ELOOP error if the rename would
affect one of our parent directories.
This behaviour is needed in order to avoid issues such as
http://bugzilla.kernel.org/show_bug.cgi?id=7178
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> Cc: Miklos Szeredi <miklos@szeredi.hu> Cc: Maneesh Soni <maneesh@in.ibm.com> Cc: Dipankar Sarma <dipankar@in.ibm.com> Cc: Neil Brown <neilb@cse.unsw.edu.au> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Matthew Wilcox [Sat, 21 Oct 2006 17:24:19 +0000 (10:24 -0700)]
[PATCH] cciss: Fix warnings (and bug on 1TB discs)
CCISS was producing warnings about shifts being greater than the size of
the type and pointers being of incompatible type. Turns out this is
because it's calling do_div on a 32-bit quantity. Upon further
investigation, the sector_t total_size is being assigned to an int, and
then we're calling do_div on that int. Obviously, sector_div is called for
here, and I took the chance to refactor the code a little.
Signed-off-by: Matthew Wilcox <matthew@wil.cx> Acked-by: Mike Miller <mike.miller@hp.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Paul Jackson [Sat, 21 Oct 2006 17:24:17 +0000 (10:24 -0700)]
[PATCH] cpuset: mempolicy migration typo fix
Mistyped an ifdef CONFIG_CPUSETS - fixed.
I doubt that anyone ever noticed. The impact of this typo was
that if someone:
1) was using MPOL_BIND to force off node allocations
2) while using cpusets to constrain memory placement
3) when that cpuset was migrating that jobs memory
4) while the tasks in that job were actively forking
then there was a rare chance that future allocations using
that MPOL_BIND policy would be node local, not off node.
Signed-off-by: Paul Jackson <pj@sgi.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
[PATCH] Slab: Do not fallback to nodes that have not been bootstrapped yet
The zonelist may contain zones of nodes that have not been bootstrapped and
we will oops if we try to allocate from those zones. So check if the node
information for the slab and the node have been setup before attempting an
allocation. If it has not been setup then skip that zone.
Usually we will not encounter this situation since the slab bootstrap code
avoids falling back before we have setup the respective nodes but we seem
to have a special needs for pppc.
Signed-off-by: Christoph Lameter <clameter@sgi.com> Acked-by: Andy Whitcroft <apw@shadowen.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Mike Kravetz <kravetz@us.ibm.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Acked-by: Mel Gorman <mel@csn.ul.ie> Acked-by: Will Schmidt <will_schmidt@vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
David Gibson [Sat, 21 Oct 2006 17:24:13 +0000 (10:24 -0700)]
[PATCH] ibmveth: Fix index increment calculation
The recent commit 751ae21c6cd1493e3d0a4935b08fb298b9d89773 introduced a bug
in the producer/consumer index calculation in the ibmveth driver -
incautious use of the post-increment ++ operator resulted in an increment
being immediately reverted. This patch corrects the logic.
Without this patch, the driver oopses almost immediately after activation
on at least some machines.
Signed-off-by: David Gibson <dwg@au1.ibm.com> Acked-by: Santiago Leon <santil@us.ibm.com> Cc: Jeff Garzik <jeff@garzik.org> Cc: Martin Schwidefsky <schwidefsky@de.ibm.com> Cc: Andy Whitcroft <apw@shadowen.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Daniel Walker [Sat, 21 Oct 2006 17:24:10 +0000 (10:24 -0700)]
[PATCH] clocksource: acpi_pm: add another greylist chipset
I have an acpi_pm that goes backwards, but it's not intel. I tested the
verified read and my acpi_pm started to function properly. So I added it
to the greylist. I'm assuming that's the right spot.
I also added an unlikely() to the while, cause it seems appropriate.
Signed-off-by: Daniel Walker <dwalker@mvista.com> Acked-by: John Stultz <johnstul@us.ibm.com> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
projects / linux-2.6 / log