From 463d305bc51b8f5d0750a17ec0c9caf5181ec6d4 Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Mon, 22 May 2006 16:36:27 -0700 Subject: [TG3]: Add some missing rx error counters Add some missing rx error counters for 5705 and newer chips. Update version to 3.58. Signed-off-by: Michael Chan Signed-off-by: David S. Miller diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c index e1b33a2..49ad60b 100644 --- a/drivers/net/tg3.c +++ b/drivers/net/tg3.c @@ -69,8 +69,8 @@ #define DRV_MODULE_NAME "tg3" #define PFX DRV_MODULE_NAME ": " -#define DRV_MODULE_VERSION "3.57" -#define DRV_MODULE_RELDATE "Apr 28, 2006" +#define DRV_MODULE_VERSION "3.58" +#define DRV_MODULE_RELDATE "May 22, 2006" #define TG3_DEF_MAC_MODE 0 #define TG3_DEF_RX_MODE 0 @@ -6488,6 +6488,10 @@ static void tg3_periodic_fetch_stats(struct tg3 *tp) TG3_STAT_ADD32(&sp->rx_frame_too_long_errors, MAC_RX_STATS_FRAME_TOO_LONG); TG3_STAT_ADD32(&sp->rx_jabbers, MAC_RX_STATS_JABBERS); TG3_STAT_ADD32(&sp->rx_undersize_packets, MAC_RX_STATS_UNDERSIZE); + + TG3_STAT_ADD32(&sp->rxbds_empty, RCVLPC_NO_RCV_BD_CNT); + TG3_STAT_ADD32(&sp->rx_discards, RCVLPC_IN_DISCARDS_CNT); + TG3_STAT_ADD32(&sp->rx_errors, RCVLPC_IN_ERRORS_CNT); } static void tg3_timer(unsigned long __opaque) -- cgit v0.10.2 From bae25761c92c5eec781b6ea72bbe7e98fc8382a0 Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Mon, 22 May 2006 16:38:38 -0700 Subject: [BNX2]: Fix bug in bnx2_nvram_write() Fix a bug in bnx2_nvram_write() caused by a counter variable not correctly incremented by 4. Signed-off-by: Michael Chan Signed-off-by: David S. Miller diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c index 5ca99e2..509f104 100644 --- a/drivers/net/bnx2.c +++ b/drivers/net/bnx2.c @@ -3061,7 +3061,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, } /* Loop to write the new data from data_start to data_end */ - for (addr = data_start; addr < data_end; addr += 4, i++) { + for (addr = data_start; addr < data_end; addr += 4, i += 4) { if ((addr == page_end - 4) || ((bp->flash_info->buffered) && (addr == data_end - 4))) { -- cgit v0.10.2 From ae181bc44c65fdc93d0d2d908534b22e43f60f56 Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Mon, 22 May 2006 16:39:20 -0700 Subject: [BNX2]: Use kmalloc instead of array Use kmalloc() instead of a local array in bnx2_nvram_write(). Update version to 1.4.40. Signed-off-by: Michael Chan Signed-off-by: David S. Miller diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c index 509f104..54161ae 100644 --- a/drivers/net/bnx2.c +++ b/drivers/net/bnx2.c @@ -55,8 +55,8 @@ #define DRV_MODULE_NAME "bnx2" #define PFX DRV_MODULE_NAME ": " -#define DRV_MODULE_VERSION "1.4.39" -#define DRV_MODULE_RELDATE "March 22, 2006" +#define DRV_MODULE_VERSION "1.4.40" +#define DRV_MODULE_RELDATE "May 22, 2006" #define RUN_AT(x) (jiffies + (x)) @@ -2945,7 +2945,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, int buf_size) { u32 written, offset32, len32; - u8 *buf, start[4], end[4]; + u8 *buf, start[4], end[4], *flash_buffer = NULL; int rc = 0; int align_start, align_end; @@ -2985,12 +2985,19 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, memcpy(buf + align_start, data_buf, buf_size); } + if (bp->flash_info->buffered == 0) { + flash_buffer = kmalloc(264, GFP_KERNEL); + if (flash_buffer == NULL) { + rc = -ENOMEM; + goto nvram_write_end; + } + } + written = 0; while ((written < len32) && (rc == 0)) { u32 page_start, page_end, data_start, data_end; u32 addr, cmd_flags; int i; - u8 flash_buffer[264]; /* Find the page_start addr */ page_start = offset32 + written; @@ -3109,6 +3116,9 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf, } nvram_write_end: + if (bp->flash_info->buffered == 0) + kfree(flash_buffer); + if (align_start || align_end) kfree(buf); return rc; -- cgit v0.10.2 From 4195f81453b9727f82bb8ceae03411b7fe52a994 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Mon, 22 May 2006 16:53:22 -0700 Subject: [NET]: Fix "ntohl(ntohs" bugs Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c index cd810f41..95278b2 100644 --- a/net/ipv4/ipcomp.c +++ b/net/ipv4/ipcomp.c @@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info) skb->h.icmph->code != ICMP_FRAG_NEEDED) return; - spi = ntohl(ntohs(ipch->cpi)); + spi = htonl(ntohs(ipch->cpi)); x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET); if (!x) diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c index f285bbf..8604c74 100644 --- a/net/ipv4/xfrm4_policy.c +++ b/net/ipv4/xfrm4_policy.c @@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl) if (pskb_may_pull(skb, xprth + 4 - skb->data)) { u16 *ipcomp_hdr = (u16 *)xprth; - fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1])); + fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); } break; default: diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c index 05eb67d..4863643 100644 --- a/net/ipv6/ipcomp6.c +++ b/net/ipv6/ipcomp6.c @@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG) return; - spi = ntohl(ntohs(ipcomph->cpi)); + spi = htonl(ntohs(ipcomph->cpi)); x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6); if (!x) return; diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index b549710..891a609 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq) case IPPROTO_COMP: if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr))) return -EINVAL; - *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2))); + *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2))); *seq = 0; return 0; default: -- cgit v0.10.2 From 405a42c5c8bd5731087c0ff01310731a3c1c9c24 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Mon, 22 May 2006 16:54:08 -0700 Subject: [IRDA]: fix 16/32 bit confusion Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller diff --git a/net/irda/iriap.c b/net/irda/iriap.c index 254f907..2d2e2b1 100644 --- a/net/irda/iriap.c +++ b/net/irda/iriap.c @@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self, { struct sk_buff *tx_skb; int n; - __u32 tmp_be32, tmp_be16; + __u32 tmp_be32; + __be16 tmp_be16; __u8 *fp; IRDA_DEBUG(4, "%s()\n", __FUNCTION__); -- cgit v0.10.2 From f5565f4a90bdfea99e4bcd8411ff5272ebdbdbf8 Mon Sep 17 00:00:00 2001 From: Alexey Dobriyan Date: Mon, 22 May 2006 16:54:30 -0700 Subject: [IRDA]: fixup type of ->lsap_state Signed-off-by: Alexey Dobriyan Signed-off-by: David S. Miller diff --git a/include/net/irda/irlmp.h b/include/net/irda/irlmp.h index 86aefb1..c0c895d 100644 --- a/include/net/irda/irlmp.h +++ b/include/net/irda/irlmp.h @@ -112,7 +112,7 @@ struct lsap_cb { struct timer_list watchdog_timer; - IRLMP_STATE lsap_state; /* Connection state */ + LSAP_STATE lsap_state; /* Connection state */ notify_t notify; /* Indication/Confirm entry points */ struct qos_info qos; /* QoS for this connection */ -- cgit v0.10.2 From f41d5bb1d9f49b03af7126d07a511facbe283a92 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Mon, 22 May 2006 16:55:14 -0700 Subject: [NETFILTER]: SNMP NAT: fix memory corruption Fix memory corruption caused by snmp_trap_decode: - When snmp_trap_decode fails before the id and address are allocated, the pointers contain random memory, but are freed by the caller (snmp_parse_mangle). - When snmp_trap_decode fails after allocating just the ID, it tries to free both address and ID, but the address pointer still contains random memory. The caller frees both ID and random memory again. - When snmp_trap_decode fails after allocating both, it frees both, and the callers frees both again. The corruption can be triggered remotely when the ip_nat_snmp_basic module is loaded and traffic on port 161 or 162 is NATed. Found by multiple testcases of the trap-app and trap-enc groups of the PROTOS c06-snmpv1 testsuite. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c index c622538..688a2f2 100644 --- a/net/ipv4/netfilter/ip_nat_snmp_basic.c +++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c @@ -1003,12 +1003,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx, return 1; +err_addr_free: + kfree((unsigned long *)trap->ip_address); + err_id_free: kfree(trap->id); -err_addr_free: - kfree((unsigned long *)trap->ip_address); - return 0; } @@ -1126,11 +1126,10 @@ static int snmp_parse_mangle(unsigned char *msg, struct snmp_v1_trap trap; unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check); - /* Discard trap allocations regardless */ - kfree(trap.id); - kfree((unsigned long *)trap.ip_address); - - if (!ret) + if (ret) { + kfree(trap.id); + kfree((unsigned long *)trap.ip_address); + } else return ret; } else { -- cgit v0.10.2 From 42f142371e48fbc44956d57b4e506bb6ce673cd7 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Tue, 23 May 2006 02:07:22 -0700 Subject: [SPARC64]: Respect gfp_t argument to dma_alloc_coherent(). Using asm-generic/dma-mapping.h does not work because pushing the call down to pci_alloc_coherent() causes the gfp_t argument of dma_alloc_coherent() to be ignored. Fix this by implementing things directly, and adding a gfp_t argument we can use in the internal call down to the PCI DMA implementation of pci_alloc_coherent(). This fixes massive memory corruption when using the sound driver layer, which passes things like __GFP_COMP down into these routines and (correctly) expects that to work. Signed-off-by: David S. Miller diff --git a/arch/sparc64/kernel/pci_iommu.c b/arch/sparc64/kernel/pci_iommu.c index 8efbc13..82e5455 100644 --- a/arch/sparc64/kernel/pci_iommu.c +++ b/arch/sparc64/kernel/pci_iommu.c @@ -218,7 +218,7 @@ static inline void iommu_free_ctx(struct pci_iommu *iommu, int ctx) * DMA for PCI device PDEV. Return non-NULL cpu-side address if * successful and set *DMA_ADDRP to the PCI side dma address. */ -static void *pci_4u_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp) +static void *pci_4u_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp, gfp_t gfp) { struct pcidev_cookie *pcp; struct pci_iommu *iommu; @@ -232,7 +232,7 @@ static void *pci_4u_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr if (order >= 10) return NULL; - first_page = __get_free_pages(GFP_ATOMIC, order); + first_page = __get_free_pages(gfp, order); if (first_page == 0UL) return NULL; memset((char *)first_page, 0, PAGE_SIZE << order); diff --git a/arch/sparc64/kernel/pci_sun4v.c b/arch/sparc64/kernel/pci_sun4v.c index 9e94db2..2b7a1f3 100644 --- a/arch/sparc64/kernel/pci_sun4v.c +++ b/arch/sparc64/kernel/pci_sun4v.c @@ -154,7 +154,7 @@ static void pci_arena_free(struct pci_iommu_arena *arena, unsigned long base, un __clear_bit(i, arena->map); } -static void *pci_4v_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp) +static void *pci_4v_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr_t *dma_addrp, gfp_t gfp) { struct pcidev_cookie *pcp; struct pci_iommu *iommu; @@ -169,7 +169,7 @@ static void *pci_4v_alloc_consistent(struct pci_dev *pdev, size_t size, dma_addr npages = size >> IO_PAGE_SHIFT; - first_page = __get_free_pages(GFP_ATOMIC, order); + first_page = __get_free_pages(gfp, order); if (unlikely(first_page == 0UL)) return NULL; diff --git a/include/asm-sparc64/dma-mapping.h b/include/asm-sparc64/dma-mapping.h index c7d5804..a8d39f2 100644 --- a/include/asm-sparc64/dma-mapping.h +++ b/include/asm-sparc64/dma-mapping.h @@ -4,7 +4,146 @@ #include #ifdef CONFIG_PCI -#include + +/* we implement the API below in terms of the existing PCI one, + * so include it */ +#include +/* need struct page definitions */ +#include + +static inline int +dma_supported(struct device *dev, u64 mask) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_dma_supported(to_pci_dev(dev), mask); +} + +static inline int +dma_set_mask(struct device *dev, u64 dma_mask) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_set_dma_mask(to_pci_dev(dev), dma_mask); +} + +static inline void * +dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle, + gfp_t flag) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_iommu_ops->alloc_consistent(to_pci_dev(dev), size, dma_handle, flag); +} + +static inline void +dma_free_coherent(struct device *dev, size_t size, void *cpu_addr, + dma_addr_t dma_handle) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_free_consistent(to_pci_dev(dev), size, cpu_addr, dma_handle); +} + +static inline dma_addr_t +dma_map_single(struct device *dev, void *cpu_addr, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_map_single(to_pci_dev(dev), cpu_addr, size, (int)direction); +} + +static inline void +dma_unmap_single(struct device *dev, dma_addr_t dma_addr, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_unmap_single(to_pci_dev(dev), dma_addr, size, (int)direction); +} + +static inline dma_addr_t +dma_map_page(struct device *dev, struct page *page, + unsigned long offset, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_map_page(to_pci_dev(dev), page, offset, size, (int)direction); +} + +static inline void +dma_unmap_page(struct device *dev, dma_addr_t dma_address, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_unmap_page(to_pci_dev(dev), dma_address, size, (int)direction); +} + +static inline int +dma_map_sg(struct device *dev, struct scatterlist *sg, int nents, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + return pci_map_sg(to_pci_dev(dev), sg, nents, (int)direction); +} + +static inline void +dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nhwentries, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_unmap_sg(to_pci_dev(dev), sg, nhwentries, (int)direction); +} + +static inline void +dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_dma_sync_single_for_cpu(to_pci_dev(dev), dma_handle, + size, (int)direction); +} + +static inline void +dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle, size_t size, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_dma_sync_single_for_device(to_pci_dev(dev), dma_handle, + size, (int)direction); +} + +static inline void +dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg, int nelems, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_dma_sync_sg_for_cpu(to_pci_dev(dev), sg, nelems, (int)direction); +} + +static inline void +dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg, int nelems, + enum dma_data_direction direction) +{ + BUG_ON(dev->bus != &pci_bus_type); + + pci_dma_sync_sg_for_device(to_pci_dev(dev), sg, nelems, (int)direction); +} + +static inline int +dma_mapping_error(dma_addr_t dma_addr) +{ + return pci_dma_mapping_error(dma_addr); +} + #else struct device; diff --git a/include/asm-sparc64/pci.h b/include/asm-sparc64/pci.h index 7c5a589..e1ea67b 100644 --- a/include/asm-sparc64/pci.h +++ b/include/asm-sparc64/pci.h @@ -42,7 +42,7 @@ static inline void pcibios_penalize_isa_irq(int irq, int active) struct pci_dev; struct pci_iommu_ops { - void *(*alloc_consistent)(struct pci_dev *, size_t, dma_addr_t *); + void *(*alloc_consistent)(struct pci_dev *, size_t, dma_addr_t *, gfp_t); void (*free_consistent)(struct pci_dev *, size_t, void *, dma_addr_t); dma_addr_t (*map_single)(struct pci_dev *, void *, size_t, int); void (*unmap_single)(struct pci_dev *, dma_addr_t, size_t, int); @@ -59,7 +59,7 @@ extern struct pci_iommu_ops *pci_iommu_ops; */ static inline void *pci_alloc_consistent(struct pci_dev *hwdev, size_t size, dma_addr_t *dma_handle) { - return pci_iommu_ops->alloc_consistent(hwdev, size, dma_handle); + return pci_iommu_ops->alloc_consistent(hwdev, size, dma_handle, GFP_ATOMIC); } /* Free and unmap a consistent DMA buffer. -- cgit v0.10.2 From e46e490368f87032a6e54969194413339b35a385 Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 22 May 2006 22:35:24 -0700 Subject: [PATCH] sys_sync_file_range(): move exported flags outside __KERNEL__ These flags are needed by userspace - move them outside __KERNEL__ (Pointed out by dwmw2) Cc: David Woodhouse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/include/linux/fs.h b/include/linux/fs.h index 3de2bfb..f813bc8 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -213,6 +213,10 @@ extern int dir_notify_enable; #define FIBMAP _IO(0x00,1) /* bmap access */ #define FIGETBSZ _IO(0x00,2) /* get the block size used for bmap */ +#define SYNC_FILE_RANGE_WAIT_BEFORE 1 +#define SYNC_FILE_RANGE_WRITE 2 +#define SYNC_FILE_RANGE_WAIT_AFTER 4 + #ifdef __KERNEL__ #include @@ -758,9 +762,6 @@ extern int fcntl_setlease(unsigned int fd, struct file *filp, long arg); extern int fcntl_getlease(struct file *filp); /* fs/sync.c */ -#define SYNC_FILE_RANGE_WAIT_BEFORE 1 -#define SYNC_FILE_RANGE_WRITE 2 -#define SYNC_FILE_RANGE_WAIT_AFTER 4 extern int do_sync_file_range(struct file *file, loff_t offset, loff_t endbyte, unsigned int flags); -- cgit v0.10.2 From f2d395865faa2a7cd4620b07178e58cbb160ba08 Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Mon, 22 May 2006 22:35:25 -0700 Subject: [PATCH] knfsd: Fix two problems that can cause rmmod nfsd to die Both cause the 'entries' count in the export cache to be non-zero at module removal time, so unregistering that cache fails and results in an oops. 1/ exp_pseudoroot (used for NFSv4 only) leaks a reference to an export entry. 2/ sunrpc_cache_update doesn't increment the entries count when it adds an entry. Thanks to "david m. richter" for triggering the problem and finding one of the bugs. Cc: "david m. richter" Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 4e05781..3eec300 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -1066,9 +1066,11 @@ exp_pseudoroot(struct auth_domain *clp, struct svc_fh *fhp, rv = nfserr_perm; else if (IS_ERR(exp)) rv = nfserrno(PTR_ERR(exp)); - else + else { rv = fh_compose(fhp, exp, fsid_key->ek_dentry, NULL); + exp_put(exp); + } cache_put(&fsid_key->h, &svc_expkey_cache); return rv; } diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c index 3ac4193..7026b08 100644 --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -159,6 +159,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail, detail->update(tmp, new); tmp->next = *head; *head = tmp; + detail->entries++; cache_get(tmp); is_new = cache_fresh_locked(tmp, new->expiry_time); cache_fresh_locked(old, 0); -- cgit v0.10.2 From 5c4c33318d26620fa552f15bbb6d0f9775a1b4df Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Mon, 22 May 2006 22:35:26 -0700 Subject: [PATCH] md: fix possible oops when starting a raid0 array This loop that sets up the hash_table has problems. Careful examination will show that the last time through, everything but the first line is pointless. This is because all it does is change 'cur' and 'size' and neither of these are used after the loop. This should ring warning bells... That last time through the loop, size += conf->strip_zone[cur].size can index off the end of the strip_zone array. Depending on what it finds there, it might exit the loop cleanly, or it might spin going further and further beyond the array until it hits an unmapped address. This patch rearranges the code so that the last, pointless, iteration of the loop never happens. i.e. the one statement of the last loop that is needed is moved the the end of the previous loop - or to before the loop starts - and the loop counter starts from 1 instead of 0. Cc: "Don Dupuis" Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c index 678f4db..cb8c631 100644 --- a/drivers/md/raid0.c +++ b/drivers/md/raid0.c @@ -331,13 +331,14 @@ static int raid0_run (mddev_t *mddev) goto out_free_conf; size = conf->strip_zone[cur].size; - for (i=0; i< nb_zone; i++) { - conf->hash_table[i] = conf->strip_zone + cur; + conf->hash_table[0] = conf->strip_zone + cur; + for (i=1; i< nb_zone; i++) { while (size <= conf->hash_spacing) { cur++; size += conf->strip_zone[cur].size; } size -= conf->hash_spacing; + conf->hash_table[i] = conf->strip_zone + cur; } if (conf->preshift) { conf->hash_spacing >>= conf->preshift; -- cgit v0.10.2 From a2eb0c101d24aca9d3d16c30c4f79f3a70c89208 Mon Sep 17 00:00:00 2001 From: NeilBrown Date: Mon, 22 May 2006 22:35:27 -0700 Subject: [PATCH] md: Make sure bi_max_vecs is set properly in bio_split Else a subsequent bio_clone might make a mess. Signed-off-by: Neil Brown Cc: "Don Dupuis" Acked-by: Jens Axboe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/fs/bio.c b/fs/bio.c index eb8fbc5..098c12b 100644 --- a/fs/bio.c +++ b/fs/bio.c @@ -1116,6 +1116,9 @@ struct bio_pair *bio_split(struct bio *bi, mempool_t *pool, int first_sectors) bp->bio1.bi_io_vec = &bp->bv1; bp->bio2.bi_io_vec = &bp->bv2; + bp->bio1.bi_max_vecs = 1; + bp->bio2.bi_max_vecs = 1; + bp->bio1.bi_end_io = bio_pair_end_1; bp->bio2.bi_end_io = bio_pair_end_2; -- cgit v0.10.2 From ff4547f4aa9823908e9866495598fc65772c2a09 Mon Sep 17 00:00:00 2001 From: Tobias Powalowski Date: Mon, 22 May 2006 22:35:28 -0700 Subject: [PATCH] tty_insert_flip_string_flags() license fix We still don't have the tty layer licensing compatibility quite right. tty_insert_flip_char() used to be inlined in include/linux/tty_flip.h. It is now out-of-lined and hence needs EXPORT_SYMBOL() to be back-compatible. One known offender is the Intel Modem driver. Cc: Alan Cox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index f07637a..a88b94a 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -398,7 +398,7 @@ int tty_insert_flip_string_flags(struct tty_struct *tty, while (unlikely(size > copied)); return copied; } -EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags); +EXPORT_SYMBOL(tty_insert_flip_string_flags); void tty_schedule_flip(struct tty_struct *tty) { -- cgit v0.10.2 From 30d6b2f3749e41ce37170ebc445948222b2db4ee Mon Sep 17 00:00:00 2001 From: Pavel Machek Date: Mon, 22 May 2006 22:35:29 -0700 Subject: [PATCH] swsusp: fix typo in cr0 handling Writing cr0 to cr2 register can't be right. This fixes the typo. I wonder how it could survive so long. Signed-off-by: Pavel Machek Cc: Zachary Amsden Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/arch/i386/power/cpu.c b/arch/i386/power/cpu.c index 50a0bef..79b2370 100644 --- a/arch/i386/power/cpu.c +++ b/arch/i386/power/cpu.c @@ -92,7 +92,7 @@ void __restore_processor_state(struct saved_context *ctxt) write_cr4(ctxt->cr4); write_cr3(ctxt->cr3); write_cr2(ctxt->cr2); - write_cr2(ctxt->cr0); + write_cr0(ctxt->cr0); /* * now restore the descriptor tables to their proper values -- cgit v0.10.2 From bb6e093da23ace2724fdadd27738027468eb82b3 Mon Sep 17 00:00:00 2001 From: Florin Malita Date: Mon, 22 May 2006 22:35:30 -0700 Subject: [PATCH] orinoco: possible null pointer dereference in orinoco_rx_monitor() If the skb allocation fails, the current error path calls dev_kfree_skb_irq() with a NULL argument. Also, 'err' is not being used. Coverity CID: 275. Signed-off-by: Florin Malita Cc: "John W. Linville" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c index 06523e2..c2d0b09 100644 --- a/drivers/net/wireless/orinoco.c +++ b/drivers/net/wireless/orinoco.c @@ -812,7 +812,6 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, if (datalen > IEEE80211_DATA_LEN + 12) { printk(KERN_DEBUG "%s: oversized monitor frame, " "data length = %d\n", dev->name, datalen); - err = -EIO; stats->rx_length_errors++; goto update_stats; } @@ -821,8 +820,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid, if (!skb) { printk(KERN_WARNING "%s: Cannot allocate skb for monitor frame\n", dev->name); - err = -ENOMEM; - goto drop; + goto update_stats; } /* Copy the 802.11 header to the skb */ -- cgit v0.10.2 From 5a4fa1639622b85d7e4422242308fc6cef7e503e Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Tue, 23 May 2006 07:46:38 -0700 Subject: [PATCH] powerpc: fill hole in Cell SPU syscall table Syscall number 224 was absent from the table, which I believe means that the SPU can cause an oops by attempting to use it. Signed-off-by: David Woodhouse Cc: Benjamin Herrenschmidt Acked-by: Paul Mackerras Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/arch/powerpc/platforms/cell/spu_callbacks.c b/arch/powerpc/platforms/cell/spu_callbacks.c index 95b3643..6745314 100644 --- a/arch/powerpc/platforms/cell/spu_callbacks.c +++ b/arch/powerpc/platforms/cell/spu_callbacks.c @@ -258,6 +258,7 @@ void *spu_syscall_table[] = { [__NR_futex] sys_futex, [__NR_sched_setaffinity] sys_sched_setaffinity, [__NR_sched_getaffinity] sys_sched_getaffinity, + [224] sys_ni_syscall, [__NR_tuxcall] sys_ni_syscall, [226] sys_ni_syscall, [__NR_io_setup] sys_io_setup, -- cgit v0.10.2 From b471f55427ee94d6de2b33b88a7409f8cbc6b5dc Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Tue, 23 May 2006 07:46:39 -0700 Subject: [PATCH] powerpc: check Cell SPU syscall number range _before_ using it Signed-off-by: David Woodhouse Cc: Benjamin Herrenschmidt Acked-by: Paul Mackerras Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/arch/powerpc/platforms/cell/spu_callbacks.c b/arch/powerpc/platforms/cell/spu_callbacks.c index 6745314..5a0f9e3 100644 --- a/arch/powerpc/platforms/cell/spu_callbacks.c +++ b/arch/powerpc/platforms/cell/spu_callbacks.c @@ -339,13 +339,13 @@ long spu_sys_callback(struct spu_syscall_block *s) { long (*syscall)(u64 a1, u64 a2, u64 a3, u64 a4, u64 a5, u64 a6); - syscall = spu_syscall_table[s->nr_ret]; - if (s->nr_ret >= ARRAY_SIZE(spu_syscall_table)) { pr_debug("%s: invalid syscall #%ld", __FUNCTION__, s->nr_ret); return -ENOSYS; } + syscall = spu_syscall_table[s->nr_ret]; + #ifdef DEBUG print_symbol(KERN_DEBUG "SPU-syscall %s:", (unsigned long)syscall); printk("syscall%ld(%lx, %lx, %lx, %lx, %lx, %lx)\n", -- cgit v0.10.2 From 0f0410823792ae0ecb45f2578598b115835ffdbb Mon Sep 17 00:00:00 2001 From: David Woodhouse Date: Tue, 23 May 2006 07:46:40 -0700 Subject: [PATCH] powerpc: wire up sys_[gs]et_robust_list Signed-off-by: David Woodhouse Cc: Benjamin Herrenschmidt Acked-by: Paul Mackerras Cc: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S index cf56a1d..26ed1f5 100644 --- a/arch/powerpc/kernel/systbl.S +++ b/arch/powerpc/kernel/systbl.S @@ -338,6 +338,8 @@ SYSCALL(symlinkat) SYSCALL(readlinkat) SYSCALL(fchmodat) SYSCALL(faccessat) +COMPAT_SYS(get_robust_list) +COMPAT_SYS(set_robust_list) /* * please add new calls to arch/powerpc/platforms/cell/spu_callbacks.c diff --git a/arch/powerpc/platforms/cell/spu_callbacks.c b/arch/powerpc/platforms/cell/spu_callbacks.c index 5a0f9e3..b47fcc5 100644 --- a/arch/powerpc/platforms/cell/spu_callbacks.c +++ b/arch/powerpc/platforms/cell/spu_callbacks.c @@ -333,6 +333,8 @@ void *spu_syscall_table[] = { [__NR_readlinkat] sys_readlinkat, [__NR_fchmodat] sys_fchmodat, [__NR_faccessat] sys_faccessat, + [__NR_get_robust_list] sys_get_robust_list, + [__NR_set_robust_list] sys_set_robust_list, }; long spu_sys_callback(struct spu_syscall_block *s) diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h index 908acb4..edde246 100644 --- a/include/asm-powerpc/unistd.h +++ b/include/asm-powerpc/unistd.h @@ -321,8 +321,10 @@ #define __NR_readlinkat 296 #define __NR_fchmodat 297 #define __NR_faccessat 298 +#define __NR_get_robust_list 299 +#define __NR_set_robust_list 300 -#define __NR_syscalls 299 +#define __NR_syscalls 301 #ifdef __KERNEL__ #define __NR__exit __NR_exit diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 3996960..60d49e5 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -52,6 +52,7 @@ struct utimbuf; struct mq_attr; struct compat_stat; struct compat_timeval; +struct robust_list_head; #include #include @@ -581,5 +582,10 @@ asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags); asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes, unsigned int flags); +asmlinkage long sys_get_robust_list(int pid, + struct robust_list_head __user **head_ptr, + size_t __user *len_ptr); +asmlinkage long sys_set_robust_list(struct robust_list_head __user *head, + size_t len); #endif -- cgit v0.10.2 From fd0ff8aa1d95a896b3627bc62d42d6d002ac0bc3 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Tue, 23 May 2006 11:23:49 +0200 Subject: [PATCH] blk: fix gendisk->in_flight accounting during barrier sequence While executing barrrier sequence, the bar_rq which carries actual write was accounted as normal IO on completion, while it wasn't on queueing. This caused gendisk->in_flight to be decremented by 1 after each barrier thus messed up statistics. This patch makes bar_rq not accounted as normal IO. As the containing barrier request as a whole is accounted, part of it shouldn't be. Signed-off-by: Tejun Heo Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c index eac48be..7eb36c5 100644 --- a/block/ll_rw_blk.c +++ b/block/ll_rw_blk.c @@ -3452,7 +3452,12 @@ void end_that_request_last(struct request *req, int uptodate) if (unlikely(laptop_mode) && blk_fs_request(req)) laptop_io_completion(); - if (disk && blk_fs_request(req)) { + /* + * Account IO completion. bar_rq isn't accounted as a normal + * IO on queueing nor completion. Accounting the containing + * request is enough. + */ + if (disk && blk_fs_request(req) && req != &req->q->bar_rq) { unsigned long duration = jiffies - req->start_time; const int rw = rq_data_dir(req); -- cgit v0.10.2 From 9d8a51f80117a9d672b455d60901842ad50aa69f Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Tue, 23 May 2006 15:56:20 -0300 Subject: V4L/DVB (3927): Fix VIDEO_DEV=m, VIDEO_V4L1_COMPAT=y If CONFIG_VIDEO_DEV=m and CONFIG_VIDEO_V4L1_COMPAT=y, v4l1-compat should be built as a module (currently, it isn't built at all leading to problems with modules using it). Signed-off-by: Adrian Bunk Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile index 9debef9..e5bf268 100644 --- a/drivers/media/video/Makefile +++ b/drivers/media/video/Makefile @@ -11,7 +11,10 @@ tuner-objs := tuner-core.o tuner-types.o tuner-simple.o \ msp3400-objs := msp3400-driver.o msp3400-kthreads.o obj-$(CONFIG_VIDEO_DEV) += videodev.o v4l2-common.o compat_ioctl32.o -obj-$(CONFIG_VIDEO_V4L1_COMPAT) += v4l1-compat.o + +ifeq ($(CONFIG_VIDEO_V4L1_COMPAT),y) + obj-$(CONFIG_VIDEO_DEV) += v4l1-compat.o +endif obj-$(CONFIG_VIDEO_BT848) += bt8xx/ obj-$(CONFIG_VIDEO_BT848) += tvaudio.o tda7432.o tda9875.o ir-kbd-i2c.o -- cgit v0.10.2 From 3c2c54910f277f3abd3763dbc64b9dbf8b4479e9 Mon Sep 17 00:00:00 2001 From: Manu Abraham Date: Sat, 20 May 2006 13:17:00 -0300 Subject: V4L/DVB (4037): Make the bridge devices that depend on I2C dependant on I2C Ref: Bugzilla 6179, 6589 Signed-off-by: Manu Abraham Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig index 3f0ec6b..a97c8f5 100644 --- a/drivers/media/dvb/Kconfig +++ b/drivers/media/dvb/Kconfig @@ -22,26 +22,26 @@ config DVB source "drivers/media/dvb/dvb-core/Kconfig" comment "Supported SAA7146 based PCI Adapters" - depends on DVB_CORE && PCI + depends on DVB_CORE && PCI && I2C source "drivers/media/dvb/ttpci/Kconfig" comment "Supported USB Adapters" - depends on DVB_CORE && USB + depends on DVB_CORE && USB && I2C source "drivers/media/dvb/dvb-usb/Kconfig" source "drivers/media/dvb/ttusb-budget/Kconfig" source "drivers/media/dvb/ttusb-dec/Kconfig" source "drivers/media/dvb/cinergyT2/Kconfig" comment "Supported FlexCopII (B2C2) Adapters" - depends on DVB_CORE && (PCI || USB) + depends on DVB_CORE && (PCI || USB) && I2C source "drivers/media/dvb/b2c2/Kconfig" comment "Supported BT878 Adapters" - depends on DVB_CORE && PCI + depends on DVB_CORE && PCI && I2C source "drivers/media/dvb/bt8xx/Kconfig" comment "Supported Pluto2 Adapters" - depends on DVB_CORE && PCI + depends on DVB_CORE && PCI && I2C source "drivers/media/dvb/pluto2/Kconfig" comment "Supported DVB Frontends" diff --git a/drivers/media/dvb/b2c2/Kconfig b/drivers/media/dvb/b2c2/Kconfig index 2963605..d7f1fd5 100644 --- a/drivers/media/dvb/b2c2/Kconfig +++ b/drivers/media/dvb/b2c2/Kconfig @@ -1,6 +1,6 @@ config DVB_B2C2_FLEXCOP tristate "Technisat/B2C2 FlexCopII(b) and FlexCopIII adapters" - depends on DVB_CORE + depends on DVB_CORE && I2C select DVB_STV0299 select DVB_MT352 select DVB_MT312 @@ -16,7 +16,7 @@ config DVB_B2C2_FLEXCOP config DVB_B2C2_FLEXCOP_PCI tristate "Technisat/B2C2 Air/Sky/Cable2PC PCI" - depends on DVB_B2C2_FLEXCOP && PCI + depends on DVB_B2C2_FLEXCOP && PCI && I2C help Support for the Air/Sky/CableStar2 PCI card (DVB/ATSC) by Technisat/B2C2. @@ -24,7 +24,7 @@ config DVB_B2C2_FLEXCOP_PCI config DVB_B2C2_FLEXCOP_USB tristate "Technisat/B2C2 Air/Sky/Cable2PC USB" - depends on DVB_B2C2_FLEXCOP && USB + depends on DVB_B2C2_FLEXCOP && USB && I2C help Support for the Air/Sky/Cable2PC USB1.1 box (DVB/ATSC) by Technisat/B2C2, diff --git a/drivers/media/dvb/bt8xx/Kconfig b/drivers/media/dvb/bt8xx/Kconfig index f28d721..f394002 100644 --- a/drivers/media/dvb/bt8xx/Kconfig +++ b/drivers/media/dvb/bt8xx/Kconfig @@ -1,6 +1,6 @@ config DVB_BT8XX tristate "BT8xx based PCI cards" - depends on DVB_CORE && PCI && VIDEO_BT848 + depends on DVB_CORE && PCI && I2C && VIDEO_BT848 select DVB_MT352 select DVB_SP887X select DVB_NXT6000 diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig index d3df120..e388fb1 100644 --- a/drivers/media/dvb/dvb-usb/Kconfig +++ b/drivers/media/dvb/dvb-usb/Kconfig @@ -1,6 +1,6 @@ config DVB_USB tristate "Support for various USB DVB devices" - depends on DVB_CORE && USB + depends on DVB_CORE && USB && I2C select FW_LOADER help By enabling this you will be able to choose the various supported diff --git a/drivers/media/dvb/pluto2/Kconfig b/drivers/media/dvb/pluto2/Kconfig index 84f8f9f..48252e9 100644 --- a/drivers/media/dvb/pluto2/Kconfig +++ b/drivers/media/dvb/pluto2/Kconfig @@ -1,6 +1,6 @@ config DVB_PLUTO2 tristate "Pluto2 cards" - depends on DVB_CORE && PCI + depends on DVB_CORE && PCI && I2C select I2C select I2C_ALGOBIT select DVB_TDA1004X diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig index c26e232..b5ac7df 100644 --- a/drivers/media/dvb/ttpci/Kconfig +++ b/drivers/media/dvb/ttpci/Kconfig @@ -1,6 +1,6 @@ config DVB_AV7110 tristate "AV7110 cards" - depends on DVB_CORE && PCI && VIDEO_V4L1 + depends on DVB_CORE && PCI && I2C && VIDEO_V4L1 select FW_LOADER select VIDEO_SAA7146_VV select DVB_VES1820 @@ -58,7 +58,7 @@ config DVB_AV7110_OSD config DVB_BUDGET tristate "Budget cards" - depends on DVB_CORE && PCI && VIDEO_V4L1 + depends on DVB_CORE && PCI && I2C && VIDEO_V4L1 select VIDEO_SAA7146 select DVB_STV0299 select DVB_VES1X93 @@ -79,7 +79,7 @@ config DVB_BUDGET config DVB_BUDGET_CI tristate "Budget cards with onboard CI connector" - depends on DVB_CORE && PCI && VIDEO_V4L1 + depends on DVB_CORE && PCI && I2C && VIDEO_V4L1 select VIDEO_SAA7146 select DVB_STV0297 select DVB_STV0299 @@ -99,7 +99,7 @@ config DVB_BUDGET_CI config DVB_BUDGET_AV tristate "Budget cards with analog video inputs" - depends on DVB_CORE && PCI && VIDEO_V4L1 + depends on DVB_CORE && PCI && I2C && VIDEO_V4L1 select VIDEO_SAA7146_VV select DVB_STV0299 select DVB_TDA1004X -- cgit v0.10.2 From 8b6c879c81e8f00077607f83e024eedf388839b4 Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Tue, 23 May 2006 15:56:50 -0300 Subject: V4L/DVB (4040a): Fix the following section warnings: reference to .init.text: from .text between 'dvb_bt8xx_probe' (at offset 0x122c) and 'dvb_bt8xx_remove' reference to .init.text: from .text between 'dvb_bt8xx_probe' (at offset 0x1267) and 'dvb_bt8xx_remove' Signed-off-by: Jean Delvare Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c index baa8227..ccc7b2e 100644 --- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c +++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c @@ -115,7 +115,7 @@ static int is_pci_slot_eq(struct pci_dev* adev, struct pci_dev* bdev) return 0; } -static struct bt878 __init *dvb_bt8xx_878_match(unsigned int bttv_nr, struct pci_dev* bttv_pci_dev) +static struct bt878 __devinit *dvb_bt8xx_878_match(unsigned int bttv_nr, struct pci_dev* bttv_pci_dev) { unsigned int card_nr; @@ -709,7 +709,7 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type) } } -static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type) +static int __devinit dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type) { int result; @@ -794,7 +794,7 @@ static int __init dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type) return 0; } -static int dvb_bt8xx_probe(struct bttv_sub_device *sub) +static int __devinit dvb_bt8xx_probe(struct bttv_sub_device *sub) { struct dvb_bt8xx_card *card; struct pci_dev* bttv_pci_dev; -- cgit v0.10.2 From 14ba3e7b3103a12b6f6a1057a1ecbfb15e1b48c0 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Tue, 23 May 2006 16:02:03 -0300 Subject: V4L/DVB (4041): Fix compilation on PPC 64 Those functions don't exist on PPC64 architecture. Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig index 7124e53..6b41970 100644 --- a/drivers/media/video/Kconfig +++ b/drivers/media/video/Kconfig @@ -170,7 +170,7 @@ config VIDEO_VINO config VIDEO_STRADIS tristate "Stradis 4:2:2 MPEG-2 video driver (EXPERIMENTAL)" - depends on EXPERIMENTAL && PCI && VIDEO_V4L1 + depends on EXPERIMENTAL && PCI && VIDEO_V4L1 && !PPC64 help Say Y here to enable support for the Stradis 4:2:2 MPEG-2 video driver for PCI. There is a product page at @@ -178,7 +178,7 @@ config VIDEO_STRADIS config VIDEO_ZORAN tristate "Zoran ZR36057/36067 Video For Linux" - depends on PCI && I2C_ALGOBIT && VIDEO_V4L1 + depends on PCI && I2C_ALGOBIT && VIDEO_V4L1 && !PPC64 help Say Y for support for MJPEG capture cards based on the Zoran 36057/36067 PCI controller chipset. This includes the Iomega -- cgit v0.10.2 From ebac3800e5652063aa9491ef7fb4d57e089eb385 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:29 -0700 Subject: IB/ipath: fix spinlock recursion bug The local loopback path for RC can lock the rkey table lock without blocking interrupts. The receive interrupt path can then call ipath_rkey_ok() and deadlock. Remove the redundant lock. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_keys.c b/drivers/infiniband/hw/ipath/ipath_keys.c index aa33b0e..5ae8761 100644 --- a/drivers/infiniband/hw/ipath/ipath_keys.c +++ b/drivers/infiniband/hw/ipath/ipath_keys.c @@ -136,9 +136,7 @@ int ipath_lkey_ok(struct ipath_lkey_table *rkt, struct ipath_sge *isge, ret = 1; goto bail; } - spin_lock(&rkt->lock); mr = rkt->table[(sge->lkey >> (32 - ib_ipath_lkey_table_size))]; - spin_unlock(&rkt->lock); if (unlikely(mr == NULL || mr->lkey != sge->lkey)) { ret = 0; goto bail; @@ -184,8 +182,6 @@ bail: * @acc: access flags * * Return 1 if successful, otherwise 0. - * - * The QP r_rq.lock should be held. */ int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss, u32 len, u64 vaddr, u32 rkey, int acc) @@ -196,9 +192,7 @@ int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss, size_t off; int ret; - spin_lock(&rkt->lock); mr = rkt->table[(rkey >> (32 - ib_ipath_lkey_table_size))]; - spin_unlock(&rkt->lock); if (unlikely(mr == NULL || mr->lkey != rkey)) { ret = 0; goto bail; -- cgit v0.10.2 From b228b43c491c53d1838e06f47a7470db9f84d899 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:30 -0700 Subject: IB/ipath: don't modify QP if changes fail Make sure modify_qp won't modify the QP if any of the changes failed. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c index 1889071..b26146c 100644 --- a/drivers/infiniband/hw/ipath/ipath_qp.c +++ b/drivers/infiniband/hw/ipath/ipath_qp.c @@ -427,6 +427,7 @@ static void ipath_error_qp(struct ipath_qp *qp) int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask) { + struct ipath_ibdev *dev = to_idev(ibqp->device); struct ipath_qp *qp = to_iqp(ibqp); enum ib_qp_state cur_state, new_state; unsigned long flags; @@ -443,6 +444,19 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, attr_mask)) goto inval; + if (attr_mask & IB_QP_AV) + if (attr->ah_attr.dlid == 0 || + attr->ah_attr.dlid >= IPS_MULTICAST_LID_BASE) + goto inval; + + if (attr_mask & IB_QP_PKEY_INDEX) + if (attr->pkey_index >= ipath_layer_get_npkeys(dev->dd)) + goto inval; + + if (attr_mask & IB_QP_MIN_RNR_TIMER) + if (attr->min_rnr_timer > 31) + goto inval; + switch (new_state) { case IB_QPS_RESET: ipath_reset_qp(qp); @@ -457,13 +471,8 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, } - if (attr_mask & IB_QP_PKEY_INDEX) { - struct ipath_ibdev *dev = to_idev(ibqp->device); - - if (attr->pkey_index >= ipath_layer_get_npkeys(dev->dd)) - goto inval; + if (attr_mask & IB_QP_PKEY_INDEX) qp->s_pkey_index = attr->pkey_index; - } if (attr_mask & IB_QP_DEST_QPN) qp->remote_qpn = attr->dest_qp_num; @@ -479,12 +488,8 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, if (attr_mask & IB_QP_ACCESS_FLAGS) qp->qp_access_flags = attr->qp_access_flags; - if (attr_mask & IB_QP_AV) { - if (attr->ah_attr.dlid == 0 || - attr->ah_attr.dlid >= IPS_MULTICAST_LID_BASE) - goto inval; + if (attr_mask & IB_QP_AV) qp->remote_ah_attr = attr->ah_attr; - } if (attr_mask & IB_QP_PATH_MTU) qp->path_mtu = attr->path_mtu; @@ -499,11 +504,8 @@ int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, qp->s_rnr_retry_cnt = qp->s_rnr_retry; } - if (attr_mask & IB_QP_MIN_RNR_TIMER) { - if (attr->min_rnr_timer > 31) - goto inval; + if (attr_mask & IB_QP_MIN_RNR_TIMER) qp->s_min_rnr_timer = attr->min_rnr_timer; - } if (attr_mask & IB_QP_QKEY) qp->qkey = attr->qkey; -- cgit v0.10.2 From eaf6733bc176742fb08def2269441684e963c275 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:31 -0700 Subject: IB/ipath: fix reporting of driver version to userspace Fix the interface version that gets exported to userspace. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c index c347191..bd14eb1 100644 --- a/drivers/infiniband/hw/ipath/ipath_file_ops.c +++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c @@ -139,7 +139,7 @@ static int ipath_get_base_info(struct ipath_portdata *pd, kinfo->spi_piosize = dd->ipath_ibmaxlen; kinfo->spi_mtu = dd->ipath_ibmaxlen; /* maxlen, not ibmtu */ kinfo->spi_port = pd->port_port; - kinfo->spi_sw_version = IPATH_USER_SWVERSION; + kinfo->spi_sw_version = IPATH_KERN_SWVERSION; kinfo->spi_hw_version = dd->ipath_revision; if (copy_to_user(ubase, kinfo, sizeof(*kinfo))) -- cgit v0.10.2 From 94b8d9f98d7f535037eb9845b81396f667b4f727 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:32 -0700 Subject: IB/ipath: replace uses of LIST_POISON Per Andrew's request. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c index b26146c..0924a21 100644 --- a/drivers/infiniband/hw/ipath/ipath_qp.c +++ b/drivers/infiniband/hw/ipath/ipath_qp.c @@ -375,10 +375,10 @@ static void ipath_error_qp(struct ipath_qp *qp) spin_lock(&dev->pending_lock); /* XXX What if its already removed by the timeout code? */ - if (qp->timerwait.next != LIST_POISON1) - list_del(&qp->timerwait); - if (qp->piowait.next != LIST_POISON1) - list_del(&qp->piowait); + if (!list_empty(&qp->timerwait)) + list_del_init(&qp->timerwait); + if (!list_empty(&qp->piowait)) + list_del_init(&qp->piowait); spin_unlock(&dev->pending_lock); wc.status = IB_WC_WR_FLUSH_ERR; @@ -712,10 +712,8 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd, init_attr->qp_type == IB_QPT_RC ? ipath_do_rc_send : ipath_do_uc_send, (unsigned long)qp); - qp->piowait.next = LIST_POISON1; - qp->piowait.prev = LIST_POISON2; - qp->timerwait.next = LIST_POISON1; - qp->timerwait.prev = LIST_POISON2; + INIT_LIST_HEAD(&qp->piowait); + INIT_LIST_HEAD(&qp->timerwait); qp->state = IB_QPS_RESET; qp->s_wq = swq; qp->s_size = init_attr->cap.max_send_wr + 1; @@ -785,10 +783,10 @@ int ipath_destroy_qp(struct ib_qp *ibqp) /* Make sure the QP isn't on the timeout list. */ spin_lock_irqsave(&dev->pending_lock, flags); - if (qp->timerwait.next != LIST_POISON1) - list_del(&qp->timerwait); - if (qp->piowait.next != LIST_POISON1) - list_del(&qp->piowait); + if (!list_empty(&qp->timerwait)) + list_del_init(&qp->timerwait); + if (!list_empty(&qp->piowait)) + list_del_init(&qp->piowait); spin_unlock_irqrestore(&dev->pending_lock, flags); /* @@ -857,10 +855,10 @@ void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc) spin_lock(&dev->pending_lock); /* XXX What if its already removed by the timeout code? */ - if (qp->timerwait.next != LIST_POISON1) - list_del(&qp->timerwait); - if (qp->piowait.next != LIST_POISON1) - list_del(&qp->piowait); + if (!list_empty(&qp->timerwait)) + list_del_init(&qp->timerwait); + if (!list_empty(&qp->piowait)) + list_del_init(&qp->piowait); spin_unlock(&dev->pending_lock); ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 1); diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c index a4055ca..493b182 100644 --- a/drivers/infiniband/hw/ipath/ipath_rc.c +++ b/drivers/infiniband/hw/ipath/ipath_rc.c @@ -57,7 +57,7 @@ static void ipath_init_restart(struct ipath_qp *qp, struct ipath_swqe *wqe) qp->s_len = wqe->length - len; dev = to_idev(qp->ibqp.device); spin_lock(&dev->pending_lock); - if (qp->timerwait.next == LIST_POISON1) + if (list_empty(&qp->timerwait)) list_add_tail(&qp->timerwait, &dev->pending[dev->pending_index]); spin_unlock(&dev->pending_lock); @@ -356,7 +356,7 @@ static inline int ipath_make_rc_req(struct ipath_qp *qp, if ((int)(qp->s_psn - qp->s_next_psn) > 0) qp->s_next_psn = qp->s_psn; spin_lock(&dev->pending_lock); - if (qp->timerwait.next == LIST_POISON1) + if (list_empty(&qp->timerwait)) list_add_tail(&qp->timerwait, &dev->pending[dev->pending_index]); spin_unlock(&dev->pending_lock); @@ -726,8 +726,8 @@ void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc) */ dev = to_idev(qp->ibqp.device); spin_lock(&dev->pending_lock); - if (qp->timerwait.next != LIST_POISON1) - list_del(&qp->timerwait); + if (!list_empty(&qp->timerwait)) + list_del_init(&qp->timerwait); spin_unlock(&dev->pending_lock); if (wqe->wr.opcode == IB_WR_RDMA_READ) @@ -886,8 +886,8 @@ static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode) * just won't find anything to restart if we ACK everything. */ spin_lock(&dev->pending_lock); - if (qp->timerwait.next != LIST_POISON1) - list_del(&qp->timerwait); + if (!list_empty(&qp->timerwait)) + list_del_init(&qp->timerwait); spin_unlock(&dev->pending_lock); /* @@ -1194,8 +1194,7 @@ static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev, IB_WR_RDMA_READ)) goto ack_done; spin_lock(&dev->pending_lock); - if (qp->s_rnr_timeout == 0 && - qp->timerwait.next != LIST_POISON1) + if (qp->s_rnr_timeout == 0 && !list_empty(&qp->timerwait)) list_move_tail(&qp->timerwait, &dev->pending[dev->pending_index]); spin_unlock(&dev->pending_lock); diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c index eb81424..d38f4f3 100644 --- a/drivers/infiniband/hw/ipath/ipath_ruc.c +++ b/drivers/infiniband/hw/ipath/ipath_ruc.c @@ -435,7 +435,7 @@ void ipath_no_bufs_available(struct ipath_qp *qp, struct ipath_ibdev *dev) unsigned long flags; spin_lock_irqsave(&dev->pending_lock, flags); - if (qp->piowait.next == LIST_POISON1) + if (list_empty(&qp->piowait)) list_add_tail(&qp->piowait, &dev->piowait); spin_unlock_irqrestore(&dev->pending_lock, flags); /* diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c index cb9e387..3adb86f 100644 --- a/drivers/infiniband/hw/ipath/ipath_verbs.c +++ b/drivers/infiniband/hw/ipath/ipath_verbs.c @@ -464,7 +464,7 @@ static void ipath_ib_timer(void *arg) last = &dev->pending[dev->pending_index]; while (!list_empty(last)) { qp = list_entry(last->next, struct ipath_qp, timerwait); - list_del(&qp->timerwait); + list_del_init(&qp->timerwait); qp->timer_next = resend; resend = qp; atomic_inc(&qp->refcount); @@ -474,7 +474,7 @@ static void ipath_ib_timer(void *arg) qp = list_entry(last->next, struct ipath_qp, timerwait); if (--qp->s_rnr_timeout == 0) { do { - list_del(&qp->timerwait); + list_del_init(&qp->timerwait); tasklet_hi_schedule(&qp->s_task); if (list_empty(last)) break; @@ -554,7 +554,7 @@ static int ipath_ib_piobufavail(void *arg) while (!list_empty(&dev->piowait)) { qp = list_entry(dev->piowait.next, struct ipath_qp, piowait); - list_del(&qp->piowait); + list_del_init(&qp->piowait); tasklet_hi_schedule(&qp->s_task); } spin_unlock_irqrestore(&dev->pending_lock, flags); -- cgit v0.10.2 From b0ff7c2005f7ec8dec10fb15e62b8e1acc172bbf Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:33 -0700 Subject: IB/ipath: fix NULL dereference during cleanup Fix NULL deref due to pcidev being clobbered before dd->ipath_f_cleanup() was called. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c index 3697eda..dddcdae 100644 --- a/drivers/infiniband/hw/ipath/ipath_driver.c +++ b/drivers/infiniband/hw/ipath/ipath_driver.c @@ -1905,19 +1905,19 @@ static void __exit infinipath_cleanup(void) } else ipath_dbg("irq is 0, not doing free_irq " "for unit %u\n", dd->ipath_unit); - dd->pcidev = NULL; - } - /* - * we check for NULL here, because it's outside the kregbase - * check, and we need to call it after the free_irq. Thus - * it's possible that the function pointers were never - * initialized. - */ - if (dd->ipath_f_cleanup) - /* clean up chip-specific stuff */ - dd->ipath_f_cleanup(dd); + /* + * we check for NULL here, because it's outside + * the kregbase check, and we need to call it + * after the free_irq. Thus it's possible that + * the function pointers were never initialized. + */ + if (dd->ipath_f_cleanup) + /* clean up chip-specific stuff */ + dd->ipath_f_cleanup(dd); + dd->pcidev = NULL; + } spin_lock_irqsave(&ipath_devs_lock, flags); } -- cgit v0.10.2 From f2080fa3c6098dedfb9b599bdaedd07be2ea4646 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:34 -0700 Subject: IB/ipath: enable GPIO interrupt on HT-460 This is required for even semi-decent performance on OpenIB. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_eeprom.c b/drivers/infiniband/hw/ipath/ipath_eeprom.c index f11a900e..a2f1cea 100644 --- a/drivers/infiniband/hw/ipath/ipath_eeprom.c +++ b/drivers/infiniband/hw/ipath/ipath_eeprom.c @@ -505,11 +505,10 @@ static u8 flash_csum(struct ipath_flash *ifp, int adjust) * ipath_get_guid - get the GUID from the i2c device * @dd: the infinipath device * - * When we add the multi-chip support, we will probably have to add - * the ability to use the number of guids field, and get the guid from - * the first chip's flash, to use for all of them. + * We have the capability to use the ipath_nguid field, and get + * the guid from the first chip's flash, to use for all of them. */ -void ipath_get_guid(struct ipath_devdata *dd) +void ipath_get_eeprom_info(struct ipath_devdata *dd) { void *buf; struct ipath_flash *ifp; diff --git a/drivers/infiniband/hw/ipath/ipath_ht400.c b/drivers/infiniband/hw/ipath/ipath_ht400.c index 4652435..fac0a2b 100644 --- a/drivers/infiniband/hw/ipath/ipath_ht400.c +++ b/drivers/infiniband/hw/ipath/ipath_ht400.c @@ -607,7 +607,12 @@ static int ipath_ht_boardname(struct ipath_devdata *dd, char *name, case 4: /* Ponderosa is one of the bringup boards */ n = "Ponderosa"; break; - case 5: /* HT-460 original production board */ + case 5: + /* + * HT-460 original production board; two production levels, with + * different serial number ranges. See ipath_ht_early_init() for + * case where we enable IPATH_GPIO_INTR for later serial # range. + */ n = "InfiniPath_HT-460"; break; case 6: @@ -642,7 +647,7 @@ static int ipath_ht_boardname(struct ipath_devdata *dd, char *name, if (n) snprintf(name, namelen, "%s", n); - if (dd->ipath_majrev != 3 || dd->ipath_minrev != 2) { + if (dd->ipath_majrev != 3 || (dd->ipath_minrev < 2 || dd->ipath_minrev > 3)) { /* * This version of the driver only supports the HT-400 * Rev 3.2 @@ -1520,6 +1525,18 @@ static int ipath_ht_early_init(struct ipath_devdata *dd) */ ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl, INFINIPATH_S_ABORT); + + ipath_get_eeprom_info(dd); + if(dd->ipath_boardrev == 5 && dd->ipath_serial[0] == '1' && + dd->ipath_serial[1] == '2' && dd->ipath_serial[2] == '8') { + /* + * Later production HT-460 has same changes as HT-465, so + * can use GPIO interrupts. They have serial #'s starting + * with 128, rather than 112. + */ + dd->ipath_flags |= IPATH_GPIO_INTR; + dd->ipath_flags &= ~IPATH_POLL_RX_INTR; + } return 0; } diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c index 16f640e..dc83250 100644 --- a/drivers/infiniband/hw/ipath/ipath_init_chip.c +++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c @@ -879,7 +879,6 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit) done: if (!ret) { - ipath_get_guid(dd); *dd->ipath_statusp |= IPATH_STATUS_CHIP_PRESENT; if (!dd->ipath_f_intrsetup(dd)) { /* now we can enable all interrupts from the chip */ diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h index e6507f8..5d92d57 100644 --- a/drivers/infiniband/hw/ipath/ipath_kernel.h +++ b/drivers/infiniband/hw/ipath/ipath_kernel.h @@ -650,7 +650,7 @@ u32 __iomem *ipath_getpiobuf(struct ipath_devdata *, u32 *); void ipath_init_pe800_funcs(struct ipath_devdata *); /* init HT-400-specific func */ void ipath_init_ht400_funcs(struct ipath_devdata *); -void ipath_get_guid(struct ipath_devdata *); +void ipath_get_eeprom_info(struct ipath_devdata *); u64 ipath_snap_cntr(struct ipath_devdata *, ipath_creg); /* diff --git a/drivers/infiniband/hw/ipath/ipath_pe800.c b/drivers/infiniband/hw/ipath/ipath_pe800.c index 6318067..02e8c75 100644 --- a/drivers/infiniband/hw/ipath/ipath_pe800.c +++ b/drivers/infiniband/hw/ipath/ipath_pe800.c @@ -1180,6 +1180,8 @@ static int ipath_pe_early_init(struct ipath_devdata *dd) */ dd->ipath_rhdrhead_intr_off = 1ULL<<32; + ipath_get_eeprom_info(dd); + return 0; } -- cgit v0.10.2 From 9dcc0e58e2913f7e6ffba64c27fe5c2f2c7b845c Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:35 -0700 Subject: IB/ipath: enable PE800 receive interrupts on user ports Fixed so it works on the PE-800. It had not previously been updated to match PE-800 receive interrupt differences from HT-400. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c index bd14eb1..ada267e4 100644 --- a/drivers/infiniband/hw/ipath/ipath_file_ops.c +++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c @@ -1224,6 +1224,10 @@ static unsigned int ipath_poll(struct file *fp, if (tail == head) { set_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag); + if(dd->ipath_rhdrhead_intr_off) /* arm rcv interrupt */ + (void)ipath_write_ureg(dd, ur_rcvhdrhead, + dd->ipath_rhdrhead_intr_off + | head, pd->port_port); poll_wait(fp, &pd->port_wait, pt); if (test_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag)) { -- cgit v0.10.2 From 41c75a19bf4a0102f49763a686fb7e39780349f3 Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:36 -0700 Subject: IB/ipath: register as IB device owner This fixes an oops. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c index 3adb86f..28fdbda 100644 --- a/drivers/infiniband/hw/ipath/ipath_verbs.c +++ b/drivers/infiniband/hw/ipath/ipath_verbs.c @@ -951,6 +951,7 @@ static void *ipath_register_ib_device(int unit, struct ipath_devdata *dd) idev->dd = dd; strlcpy(dev->name, "ipath%d", IB_DEVICE_NAME_MAX); + dev->owner = THIS_MODULE; dev->node_guid = ipath_layer_get_guid(dd); dev->uverbs_abi_ver = IPATH_UVERBS_ABI_VERSION; dev->uverbs_cmd_mask = -- cgit v0.10.2 From 3977026462314dfbb237adf6a964d0f683b8e45d Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:37 -0700 Subject: IB/ipath: fix null deref during rdma ops The problem was that node A's sending thread, which handles sending RDMA read response data, would write the trigger word, the last packet would be sent, node B would send a new RDMA read request, node A's interrupt handler would initialize s_rdma_sge, then node A's sending thread would update s_rdma_sge. This didn't happen very often naturally but was more frequent with 1 byte RDMA reads. Rather than adding more locking or increasing the QP structure size and copying sge data, I modified the copy routine to update the pointers before writing the trigger word to avoid the update race. Signed-off-by: Ralph Campbell Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c index 9cb5258..9ec4ac7 100644 --- a/drivers/infiniband/hw/ipath/ipath_layer.c +++ b/drivers/infiniband/hw/ipath/ipath_layer.c @@ -872,12 +872,13 @@ static void copy_io(u32 __iomem *piobuf, struct ipath_sge_state *ss, update_sge(ss, len); length -= len; } + /* Update address before sending packet. */ + update_sge(ss, length); /* must flush early everything before trigger word */ ipath_flush_wc(); __raw_writel(last, piobuf); /* be sure trigger word is written */ ipath_flush_wc(); - update_sge(ss, length); } /** @@ -943,17 +944,18 @@ int ipath_verbs_send(struct ipath_devdata *dd, u32 hdrwords, if (likely(ss->num_sge == 1 && len <= ss->sge.length && !((unsigned long)ss->sge.vaddr & (sizeof(u32) - 1)))) { u32 w; + u32 *addr = (u32 *) ss->sge.vaddr; + /* Update address before sending packet. */ + update_sge(ss, len); /* Need to round up for the last dword in the packet. */ w = (len + 3) >> 2; - __iowrite32_copy(piobuf, ss->sge.vaddr, w - 1); + __iowrite32_copy(piobuf, addr, w - 1); /* must flush early everything before trigger word */ ipath_flush_wc(); - __raw_writel(((u32 *) ss->sge.vaddr)[w - 1], - piobuf + w - 1); + __raw_writel(addr[w - 1], piobuf + w - 1); /* be sure trigger word is written */ ipath_flush_wc(); - update_sge(ss, len); ret = 0; goto bail; } -- cgit v0.10.2 From 09b74de9fff056a0a4058a0f14508acba89ea6fc Mon Sep 17 00:00:00 2001 From: Bryan O'Sullivan Date: Tue, 23 May 2006 11:32:38 -0700 Subject: IB/ipath: deref correct pointer when using kernel SMA At this point, the core QP structure hasn't been initialized, so what's in there isn't valid. Get the same information elsewhere. Signed-off-by: Bryan O'Sullivan Signed-off-by: Roland Dreier diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c index 0924a21..9f8855d9 100644 --- a/drivers/infiniband/hw/ipath/ipath_qp.c +++ b/drivers/infiniband/hw/ipath/ipath_qp.c @@ -734,7 +734,7 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd, ipath_reset_qp(qp); /* Tell the core driver that the kernel SMA is present. */ - if (qp->ibqp.qp_type == IB_QPT_SMI) + if (init_attr->qp_type == IB_QPT_SMI) ipath_layer_set_verbs_flags(dev->dd, IPATH_VERBS_KERNEL_SMA); break; -- cgit v0.10.2 From 7185989db4d926dbef1a2f638c464f35599c83e0 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 23 May 2006 15:07:07 -0700 Subject: [NETFILTER]: H.323 helper: fix parser error propagation The condition "> H323_ERROR_STOP" can never be true since H323_ERROR_STOP is positive and is the highest possible return code, while real errors are negative, fix the checks. Also only abort on real errors in some spots that were just interpreting any return value != 0 as error. Fixes crashes caused by use of stale data after a parsing error occured: BUG: unable to handle kernel paging request at virtual address bfffffff printing eip: c01aa0f8 *pde = 1a801067 *pte = 00000000 Oops: 0000 [#1] PREEMPT Modules linked in: ip_nat_h323 ip_conntrack_h323 nfsd exportfs sch_sfq sch_red cls_fw sch_hfsc xt_length ipt_owner xt_MARK iptable_mangle nfs lockd sunrpc pppoe pppoxx CPU: 0 EIP: 0060:[] Not tainted VLI EFLAGS: 00210646 (2.6.17-rc4 #8) EIP is at memmove+0x19/0x22 eax: d77264e9 ebx: d77264e9 ecx: e88d9b17 edx: d77264e9 esi: bfffffff edi: bfffffff ebp: de6a7680 esp: c0349db8 ds: 007b es: 007b ss: 0068 Process asterisk (pid: 3765, threadinfo=c0349000 task=da068540) Stack: <0>00000006 c0349e5e d77264e3 e09a2b4e e09a38a0 d7726052 d7726124 00000491 00000006 00000006 00000006 00000491 de6a7680 d772601e d7726032 c0349f74 e09a2dc2 00000006 c0349e5e 00000006 00000000 d76dda28 00000491 c0349f74 Call Trace: [] mangle_contents+0x62/0xfe [ip_nat] [] ip_nat_mangle_tcp_packet+0xa1/0x191 [ip_nat] [] set_addr+0x74/0x14c [ip_nat_h323] [] process_setup+0x11b/0x29e [ip_conntrack_h323] [] process_setup+0x14c/0x29e [ip_conntrack_h323] [] process_q931+0x3c/0x142 [ip_conntrack_h323] [] q931_help+0xe0/0x144 [ip_conntrack_h323] ... Found by the PROTOS c07-h2250v4 testsuite. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c index 355a53a..5d04438 100644 --- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c +++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c @@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level) /* Decode */ if ((err = (Decoders[son->type]) (bs, son, base, - level + 1)) > - H323_ERROR_STOP) + level + 1)) < + H323_ERROR_NONE) return err; bs->cur = beg + len; bs->bit = 0; } else if ((err = (Decoders[son->type]) (bs, son, base, - level + 1))) + level + 1)) < + H323_ERROR_NONE) return err; } @@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level) beg = bs->cur; if ((err = (Decoders[son->type]) (bs, son, base, - level + 1)) > - H323_ERROR_STOP) + level + 1)) < + H323_ERROR_NONE) return err; bs->cur = beg + len; @@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level) i < effective_count ? base : NULL, - level + 1)) > - H323_ERROR_STOP) + level + 1)) < + H323_ERROR_NONE) return err; bs->cur = beg + len; bs->bit = 0; } else - if ((err = (Decoders[son->type]) (bs, son, - i < effective_count ? - base : NULL, - level + 1))) - return err; + if ((err = (Decoders[son->type]) (bs, son, + i < + effective_count ? + base : NULL, + level + 1)) < + H323_ERROR_NONE) + return err; if (base) base += son->offset; @@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level) } beg = bs->cur; - if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) > - H323_ERROR_STOP) + if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) < + H323_ERROR_NONE) return err; bs->cur = beg + len; bs->bit = 0; - } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1))) + } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) < + H323_ERROR_NONE) return err; return H323_ERROR_NONE; -- cgit v0.10.2 From 4d942d8b39bf7d43ce93d85964aeb63aeace0593 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 23 May 2006 15:07:46 -0700 Subject: [NETFILTER]: H.323 helper: fix sequence extension parsing When parsing unknown sequence extensions the "son"-pointer points behind the last known extension for this type, don't try to interpret it. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c index 5d04438..26dfeca 100644 --- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c +++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c @@ -555,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level) /* Decode the extension components */ for (opt = 0; opt < bmp2_len; opt++, i++, son++) { - if (son->attr & STOP) { + if (i < f->ub && son->attr & STOP) { PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ", son->name); return H323_ERROR_STOP; -- cgit v0.10.2 From 4a063739138e2c4e933188d641f1593e01ce8285 Mon Sep 17 00:00:00 2001 From: Chris Wright Date: Tue, 23 May 2006 15:08:13 -0700 Subject: [NETFILTER]: SNMP NAT: fix memleak in snmp_object_decode If kmalloc fails, error path leaks data allocated from asn1_oid_decode(). Signed-off-by: Chris Wright Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c index 688a2f2..c332442 100644 --- a/net/ipv4/netfilter/ip_nat_snmp_basic.c +++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c @@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx, len *= sizeof(unsigned long); *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC); if (*obj == NULL) { + kfree(lp); kfree(id); if (net_ratelimit()) printk("OOM in bsalg (%d)\n", __LINE__); -- cgit v0.10.2 From 387e2b0439026aa738a9edca15a57e5c0bcb4dfc Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Tue, 23 May 2006 15:20:25 -0700 Subject: [BRIDGE]: need to ref count the LLC sap Bridge will OOPS on removal if other application has the SAP open. The bridge SAP might be shared with other usages, so need to do reference counting on module removal rather than explicit close/delete. Since packet might arrive after or during removal, need to clear the receive function handle, so LLC only hands it to user (if any). Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller diff --git a/net/bridge/br.c b/net/bridge/br.c index 22d806c..12da21a 100644 --- a/net/bridge/br.c +++ b/net/bridge/br.c @@ -55,7 +55,7 @@ static int __init br_init(void) static void __exit br_deinit(void) { - llc_sap_close(br_stp_sap); + rcu_assign_pointer(br_stp_sap->rcv_func, NULL); #ifdef CONFIG_BRIDGE_NETFILTER br_netfilter_fini(); @@ -67,6 +67,7 @@ static void __exit br_deinit(void) synchronize_net(); + llc_sap_put(br_stp_sap); br_fdb_get_hook = NULL; br_fdb_put_hook = NULL; -- cgit v0.10.2 From a1433ac4ab46fb23ae77804c207a1f710a7b12f1 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Mon, 22 May 2006 12:03:42 -0700 Subject: [PATCH] sky2: fix jumbo packet support The truncate threshold calculation to prevent receiver from getting stuck was incorrect, and it didn't take into account the upper limit on bits in the register so the jumbo packet support was broken. Signed-off-by: Stephen Hemminger Signed-off-by: Jeff Garzik diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c index 60779eb..9591096 100644 --- a/drivers/net/sky2.c +++ b/drivers/net/sky2.c @@ -979,6 +979,7 @@ static int sky2_rx_start(struct sky2_port *sky2) struct sky2_hw *hw = sky2->hw; unsigned rxq = rxqaddr[sky2->port]; int i; + unsigned thresh; sky2->rx_put = sky2->rx_next = 0; sky2_qset(hw, rxq); @@ -1003,9 +1004,21 @@ static int sky2_rx_start(struct sky2_port *sky2) sky2_rx_add(sky2, re->mapaddr); } - /* Truncate oversize frames */ - sky2_write16(hw, SK_REG(sky2->port, RX_GMF_TR_THR), sky2->rx_bufsize - 8); - sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), RX_TRUNC_ON); + + /* + * The receiver hangs if it receives frames larger than the + * packet buffer. As a workaround, truncate oversize frames, but + * the register is limited to 9 bits, so if you do frames > 2052 + * you better get the MTU right! + */ + thresh = (sky2->rx_bufsize - 8) / sizeof(u32); + if (thresh > 0x1ff) + sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), RX_TRUNC_OFF); + else { + sky2_write16(hw, SK_REG(sky2->port, RX_GMF_TR_THR), thresh); + sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), RX_TRUNC_ON); + } + /* Tell chip about available buffers */ sky2_write16(hw, Y2_QADDR(rxq, PREF_UNIT_PUT_IDX), sky2->rx_put); -- cgit v0.10.2 From bb31a8faa270beafcc51a65880c5564c6b718bd6 Mon Sep 17 00:00:00 2001 From: Albert Lee Date: Mon, 22 May 2006 11:43:46 +0800 Subject: [PATCH] libata: add pio flush for via atapi (was: Re: TR: ASUS A8V Deluxe, x86_64) Backport the "pio flush" from the libata major update to 2.6.17 for via atapi. Signed-off-by: Albert Lee Signed-off-by: Jeff Garzik diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c index 823dfa7..fa476e7 100644 --- a/drivers/scsi/libata-core.c +++ b/drivers/scsi/libata-core.c @@ -3643,6 +3643,8 @@ static void ata_pio_block(struct ata_port *ap) ata_pio_sector(qc); } + + ata_altstatus(ap); /* flush */ } static void ata_pio_error(struct ata_port *ap) @@ -3759,11 +3761,14 @@ static void atapi_packet_task(void *_data) spin_lock_irqsave(&ap->host_set->lock, flags); ap->flags &= ~ATA_FLAG_NOINTR; ata_data_xfer(ap, qc->cdb, qc->dev->cdb_len, 1); + ata_altstatus(ap); /* flush */ + if (qc->tf.protocol == ATA_PROT_ATAPI_DMA) ap->ops->bmdma_start(qc); /* initiate bmdma */ spin_unlock_irqrestore(&ap->host_set->lock, flags); } else { ata_data_xfer(ap, qc->cdb, qc->dev->cdb_len, 1); + ata_altstatus(ap); /* flush */ /* PIO commands are handled by polling */ ap->hsm_task_state = HSM_ST; -- cgit v0.10.2 From b964638ffd59b61c13f02b81e5118a6e573d91cd Mon Sep 17 00:00:00 2001 From: Dave Kleikamp Date: Wed, 24 May 2006 07:43:38 -0500 Subject: JFS: Fix multiple errors in metapage_releasepage It looks like metapage_releasepage was making in invalid assumption that the releasepage method would not be called on a dirty page. Instead of issuing a warning and releasing the metapage, it should return 0, indicating that the private data for the page cannot be released. I also realized that metapage_releasepage had the return code all wrong. If it is successful in releasing the private data, it should return 1, otherwise it needs to return 0. Lastly, there is no need to call wait_on_page_writeback, since try_to_release_page will not call us with a page in writback state. Signed-off-by: Dave Kleikamp diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c index f28696f..2b220dd 100644 --- a/fs/jfs/jfs_metapage.c +++ b/fs/jfs/jfs_metapage.c @@ -542,7 +542,7 @@ add_failed: static int metapage_releasepage(struct page *page, gfp_t gfp_mask) { struct metapage *mp; - int busy = 0; + int ret = 1; unsigned int offset; for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) { @@ -552,30 +552,20 @@ static int metapage_releasepage(struct page *page, gfp_t gfp_mask) continue; jfs_info("metapage_releasepage: mp = 0x%p", mp); - if (mp->count || mp->nohomeok) { + if (mp->count || mp->nohomeok || + test_bit(META_dirty, &mp->flag)) { jfs_info("count = %ld, nohomeok = %d", mp->count, mp->nohomeok); - busy = 1; + ret = 0; continue; } - wait_on_page_writeback(page); - //WARN_ON(test_bit(META_dirty, &mp->flag)); - if (test_bit(META_dirty, &mp->flag)) { - dump_mem("dirty mp in metapage_releasepage", mp, - sizeof(struct metapage)); - dump_mem("page", page, sizeof(struct page)); - dump_stack(); - } if (mp->lsn) remove_from_logsync(mp); remove_metapage(page, mp); INCREMENT(mpStat.pagefree); free_metapage(mp); } - if (busy) - return -1; - - return 0; + return ret; } static void metapage_invalidatepage(struct page *page, unsigned long offset) -- cgit v0.10.2 From 51c403274093767d6dc30703d67e9f0b255c7439 Mon Sep 17 00:00:00 2001 From: Pierre Ossman Date: Wed, 24 May 2006 10:20:45 +0200 Subject: [MMC] Fix premature use of md->disk md->disk was being used in a debug message before it was allocated. Signed-off-by: Pierre Ossman Signed-off-by: Linus Torvalds diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c index e39cc05..587458b 100644 --- a/drivers/mmc/mmc_block.c +++ b/drivers/mmc/mmc_block.c @@ -353,7 +353,7 @@ static struct mmc_blk_data *mmc_blk_alloc(struct mmc_card *card) */ printk(KERN_ERR "%s: unable to select block size for " "writing (rb%u wb%u rp%u wp%u)\n", - md->disk->disk_name, + mmc_card_id(card), 1 << card->csd.read_blkbits, 1 << card->csd.write_blkbits, card->csd.read_partial, -- cgit v0.10.2 From 4f3a151a11da3351e2149a401d4ee18426938de7 Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Wed, 24 May 2006 15:13:14 -0300 Subject: [PATCH] V4L/DVB (4045): Fixes recursive dependency for I2C Mixing "depends on I2C" and "select I2C" within the media subsystem leads to the following problem: Warning! Found recursive dependency: I2C DVB_BUDGET DVB_BUDGET_PATCH DVB_AV7110 VIDEO_SAA7146_VV VIDEO_SAA7146 I2C Signed-off-by: Jean Delvare Acked-by: Manu Abraham Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Linus Torvalds diff --git a/drivers/media/common/Kconfig b/drivers/media/common/Kconfig index 9c45b98..1a04db4 100644 --- a/drivers/media/common/Kconfig +++ b/drivers/media/common/Kconfig @@ -1,6 +1,6 @@ config VIDEO_SAA7146 tristate - select I2C + depends on I2C config VIDEO_SAA7146_VV tristate diff --git a/drivers/media/dvb/pluto2/Kconfig b/drivers/media/dvb/pluto2/Kconfig index 48252e9..7d8e6e8 100644 --- a/drivers/media/dvb/pluto2/Kconfig +++ b/drivers/media/dvb/pluto2/Kconfig @@ -1,7 +1,6 @@ config DVB_PLUTO2 tristate "Pluto2 cards" depends on DVB_CORE && PCI && I2C - select I2C select I2C_ALGOBIT select DVB_TDA1004X help -- cgit v0.10.2 From a8bd60705aa17a998516837d9c1e503ad4cbd7fc Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Wed, 24 May 2006 18:50:17 -0700 Subject: Linux 2.6.17-rc5 diff --git a/Makefile b/Makefile index 3494c17..435d209 100644 --- a/Makefile +++ b/Makefile @@ -1,8 +1,8 @@ VERSION = 2 PATCHLEVEL = 6 SUBLEVEL = 17 -EXTRAVERSION =-rc4 -NAME=Sliding Snow Leopard +EXTRAVERSION =-rc5 +NAME=Lordi Rules # *DOCUMENTATION* # To see a list of typical targets execute "make help" -- cgit v0.10.2 From 705af309505681f197f81618440954d10f120dc0 Mon Sep 17 00:00:00 2001 From: Martin Schwidefsky Date: Tue, 23 May 2006 09:22:42 +0200 Subject: [PATCH] s390: fix typo in stop_hz_timer. Add missing parentheses for type cast to u64. Signed-off-by: Martin Schwidefsky Cc: Dave Jones Signed-off-by: Linus Torvalds diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c index ce19ad4..2a6c6ef 100644 --- a/arch/s390/kernel/time.c +++ b/arch/s390/kernel/time.c @@ -272,7 +272,7 @@ static inline void stop_hz_timer(void) next = next_timer_interrupt(); do { seq = read_seqbegin_irqsave(&xtime_lock, flags); - timer = (__u64 next) - (__u64 jiffies) + jiffies_64; + timer = ((__u64) next) - ((__u64) jiffies) + jiffies_64; } while (read_seqretry_irqrestore(&xtime_lock, seq, flags)); todval = -1ULL; /* Be careful about overflows. */ -- cgit v0.10.2