Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6
authorLinus Torvalds <torvalds@woody.linux-foundation.org>
Tue, 2 Oct 2007 17:35:28 +0000 (10:35 -0700)
committerLinus Torvalds <torvalds@woody.linux-foundation.org>
Tue, 2 Oct 2007 17:35:28 +0000 (10:35 -0700)
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix missing load-twin usage in Niagara-1 memcpy.
  [SPARC64]: Fix put_user() calls in binfmt_aout32.c
  [SPARC]: Fix EBUS use of uninitialized variable.

49 files changed:
Documentation/devices.txt
Makefile
arch/arm/kernel/bios32.c
arch/i386/boot/memory.c
arch/mips/kernel/scall64-o32.S
arch/mips/kernel/vmlinux.lds.S
arch/mips/sgi-ip32/ip32-platform.c
arch/powerpc/boot/dts/mpc8349emitx.dts
arch/powerpc/platforms/83xx/usb.c
arch/powerpc/platforms/pseries/xics.c
arch/powerpc/sysdev/commproc.c
arch/ppc/8xx_io/commproc.c
arch/x86_64/vdso/voffset.h
drivers/char/drm/i915_drv.h
drivers/char/drm/i915_irq.c
drivers/char/random.c
drivers/char/vt_ioctl.c
drivers/input/joystick/Kconfig
drivers/media/video/ivtv/ivtv-fileops.c
drivers/net/e1000/e1000_ethtool.c
drivers/net/e1000/e1000_hw.c
drivers/net/e1000/e1000_hw.h
drivers/net/e1000/e1000_main.c
drivers/net/mv643xx_eth.c
drivers/net/mv643xx_eth.h
drivers/net/sky2.c
drivers/net/wireless/Makefile
drivers/pci/quirks.c
drivers/serial/cpm_uart/cpm_uart_cpm1.h
fs/nfs/client.c
fs/nfs/dir.c
fs/nfs/getroot.c
fs/splice.c
fs/xfs/xfs_buf_item.h
fs/xfs/xfs_log_recover.c
fs/xfs/xfs_trans_buf.c
include/asm-i386/system.h
include/asm-mips/fcntl.h
include/asm-mips/page.h
include/net/tcp.h
kernel/futex.c
kernel/futex_compat.c
kernel/sys.c
mm/hugetlb.c
net/ieee80211/ieee80211_rx.c
net/ipv4/tcp_ipv4.c
net/ipv6/tcp_ipv6.c
net/sched/sch_sfq.c
net/socket.c

index 8de132a02ba952867020a846229b0818ee73d214..6c46730c631a6952fc34beb4302011463d754011 100644 (file)
@@ -94,6 +94,8 @@ Your cooperation is appreciated.
                  9 = /dev/urandom      Faster, less secure random number gen.
                 10 = /dev/aio          Asynchronous I/O notification interface
                 11 = /dev/kmsg         Writes to this come out as printk's
+                12 = /dev/oldmem       Used by crashdump kernels to access
+                                       the memory of the kernel that crashed.
 
   1 block      RAM disk
                  0 = /dev/ram0         First RAM disk
index 4dac25301d5f068eab6a8ee6f674fb23e6e41aa9..6fc97bfea36c37440b0f2751e426d44779a4f690 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 23
-EXTRAVERSION =-rc8
+EXTRAVERSION =-rc9
 NAME = Arr Matey! A Hairy Bilge Rat!
 
 # *DOCUMENTATION*
index 240c448ec31cf15a40222d2ab8e9414fc65bf7b6..a2dd930d11efd5d9ee8f1f691a101e09c591f07e 100644 (file)
@@ -338,7 +338,7 @@ pbus_assign_bus_resources(struct pci_bus *bus, struct pci_sys_data *root)
  * pcibios_fixup_bus - Called after each bus is probed,
  * but before its children are examined.
  */
-void __devinit pcibios_fixup_bus(struct pci_bus *bus)
+void pcibios_fixup_bus(struct pci_bus *bus)
 {
        struct pci_sys_data *root = bus->sysdata;
        struct pci_dev *dev;
@@ -419,7 +419,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 /*
  * Convert from Linux-centric to bus-centric addresses for bridge devices.
  */
-void __devinit
+void
 pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
                         struct resource *res)
 {
index bccaa1cf664508ecc44ca10fa1030ad09fb6ae6b..378353956b5dfc86469b66419b9680e1770a7410 100644 (file)
@@ -28,11 +28,14 @@ static int detect_memory_e820(void)
 
        do {
                size = sizeof(struct e820entry);
-               id = SMAP;
+
+               /* Important: %edx is clobbered by some BIOSes,
+                  so it must be either used for the error output
+                  or explicitly marked clobbered. */
                asm("int $0x15; setc %0"
-                   : "=am" (err), "+b" (next), "+d" (id), "+c" (size),
+                   : "=d" (err), "+b" (next), "=a" (id), "+c" (size),
                      "=m" (*desc)
-                   : "D" (desc), "a" (0xe820));
+                   : "D" (desc), "d" (SMAP), "a" (0xe820));
 
                /* Some BIOSes stop returning SMAP in the middle of
                   the search loop.  We don't know exactly how the BIOS
index b3ed731a24c6ad41c293101826f56958a8d4d7ca..dd68afce7da5782dc0f59766b04eb3afcb7eb647 100644 (file)
@@ -525,5 +525,5 @@ sys_call_table:
        PTR     compat_sys_signalfd
        PTR     compat_sys_timerfd
        PTR     sys_eventfd
-       PTR     sys_fallocate                   /* 4320 */
+       PTR     sys32_fallocate                 /* 4320 */
        .size   sys_call_table,.-sys_call_table
index 60bbaecde1873d8d653664351692ca93576be2e5..087ab997487d9f766f3e4d1e088a63a9a09a62fb 100644 (file)
@@ -45,6 +45,8 @@ SECTIONS
   __dbe_table : { *(__dbe_table) }
   __stop___dbe_table = .;
 
+  NOTES
+
   RODATA
 
   /* writeable */
index ba3697ee7ff65ecc70bf15f30653fa54a5cc63b9..7309e48d163d1535facc87aef51ee4608ed3f3fc 100644 (file)
@@ -41,8 +41,8 @@ static struct platform_device uart8250_device = {
 
 static int __init uart8250_init(void)
 {
-       uart8250_data[0].iobase = (unsigned long) &mace->isa.serial1;
-       uart8250_data[1].iobase = (unsigned long) &mace->isa.serial1;
+       uart8250_data[0].membase = (void __iomem *) &mace->isa.serial1;
+       uart8250_data[1].membase = (void __iomem *) &mace->isa.serial1;
 
        return platform_device_register(&uart8250_device);
 }
index 502f47c01797215f80fb2f8cef3938c152a149c5..44c065a6b5e71a2ea1fe318a5062a2d8d79f3ff8 100644 (file)
@@ -99,6 +99,7 @@
                        #size-cells = <0>;
                        interrupt-parent = < &ipic >;
                        interrupts = <26 8>;
+                       dr_mode = "peripheral";
                        phy_type = "ulpi";
                };
 
index e7fdf013cd393b59ddd74cad96a91096f424a183..eafe7605cdaca6f3d10b8966c8682ceeec0167c3 100644 (file)
@@ -76,14 +76,14 @@ int mpc834x_usb_cfg(void)
                        if (port0_is_dr)
                                printk(KERN_WARNING
                                        "834x USB port0 can't be used by both DR and MPH!\n");
-                       sicrl |= MPC834X_SICRL_USB0;
+                       sicrl &= ~MPC834X_SICRL_USB0;
                }
                prop = of_get_property(np, "port1", NULL);
                if (prop) {
                        if (port1_is_dr)
                                printk(KERN_WARNING
                                        "834x USB port1 can't be used by both DR and MPH!\n");
-                       sicrl |= MPC834X_SICRL_USB1;
+                       sicrl &= ~MPC834X_SICRL_USB1;
                }
                of_node_put(np);
        }
index 5bd90a7eb763327e06300d7dd51aef3eb6ff4123..f0b5ff17d8609a83b2f68ed928111e13f0daf046 100644 (file)
@@ -419,7 +419,7 @@ static void xics_set_affinity(unsigned int virq, cpumask_t cpumask)
         * For the moment only implement delivery to all cpus or one cpu.
         * Get current irq_server for the given irq
         */
-       irq_server = get_irq_server(irq, 1);
+       irq_server = get_irq_server(virq, 1);
        if (irq_server == -1) {
                char cpulist[128];
                cpumask_scnprintf(cpulist, sizeof(cpulist), cpumask);
index 4f67b89ba1d0a0bcf532229b8027962ccce93a95..dd5417aec1b456db3fe29024eee35e7fece31167 100644 (file)
@@ -395,4 +395,4 @@ uint cpm_dpram_phys(u8* addr)
 {
        return (dpram_pbase + (uint)(addr - dpram_vbase));
 }
-EXPORT_SYMBOL(cpm_dpram_addr);
+EXPORT_SYMBOL(cpm_dpram_phys);
index 7088428e1fe22e32e9abd27bbb015b5639123d6c..9da880be4dc0f408df58f39c1424b0eee31117f4 100644 (file)
@@ -459,7 +459,7 @@ EXPORT_SYMBOL(cpm_dpdump);
 
 void *cpm_dpram_addr(unsigned long offset)
 {
-       return ((immap_t *)IMAP_ADDR)->im_cpm.cp_dpmem + offset;
+       return (void *)(dpram_vbase + offset);
 }
 EXPORT_SYMBOL(cpm_dpram_addr);
 
index 5304204911f231f9e513ebcc7e71d425bd3507df..4af67c79085f27f090867c3a1b1fab6bd821b4a9 100644 (file)
@@ -1 +1 @@
-#define VDSO_TEXT_OFFSET 0x500
+#define VDSO_TEXT_OFFSET 0x600
index 737088bd07807a9d875b9c035e509f446b039139..28b98733beb8ffc7b6522e64fcbf1f2282fa36ce 100644 (file)
@@ -210,6 +210,12 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define I915REG_INT_MASK_R     0x020a8
 #define I915REG_INT_ENABLE_R   0x020a0
 
+#define I915REG_PIPEASTAT      0x70024
+#define I915REG_PIPEBSTAT      0x71024
+
+#define I915_VBLANK_INTERRUPT_ENABLE   (1UL<<17)
+#define I915_VBLANK_CLEAR              (1UL<<1)
+
 #define SRX_INDEX              0x3c4
 #define SRX_DATA               0x3c5
 #define SR01                   1
index 4b4b2ce8986345a5f2d1eedb179756ba0e99d382..bb8e9e9c820156e849cbd6ece7485de88767baff 100644 (file)
@@ -214,6 +214,10 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
        struct drm_device *dev = (struct drm_device *) arg;
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        u16 temp;
+       u32 pipea_stats, pipeb_stats;
+
+       pipea_stats = I915_READ(I915REG_PIPEASTAT);
+       pipeb_stats = I915_READ(I915REG_PIPEBSTAT);
 
        temp = I915_READ16(I915REG_INT_IDENTITY_R);
 
@@ -225,6 +229,8 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
                return IRQ_NONE;
 
        I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
+       (void) I915_READ16(I915REG_INT_IDENTITY_R);
+       DRM_READMEMORYBARRIER();
 
        dev_priv->sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
 
@@ -252,6 +258,12 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 
                if (dev_priv->swaps_pending > 0)
                        drm_locked_tasklet(dev, i915_vblank_tasklet);
+               I915_WRITE(I915REG_PIPEASTAT,
+                       pipea_stats|I915_VBLANK_INTERRUPT_ENABLE|
+                       I915_VBLANK_CLEAR);
+               I915_WRITE(I915REG_PIPEBSTAT,
+                       pipeb_stats|I915_VBLANK_INTERRUPT_ENABLE|
+                       I915_VBLANK_CLEAR);
        }
 
        return IRQ_HANDLED;
index 397c714cf2ba78b517a363f0bef2eb674309cb13..af274e5a25ee5ec57533eff3a4e869feac831924 100644 (file)
@@ -1550,11 +1550,13 @@ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
         *      As close as possible to RFC 793, which
         *      suggests using a 250 kHz clock.
         *      Further reading shows this assumes 2 Mb/s networks.
-        *      For 10 Gb/s Ethernet, a 1 GHz clock is appropriate.
-        *      That's funny, Linux has one built in!  Use it!
-        *      (Networks are faster now - should this be increased?)
+        *      For 10 Mb/s Ethernet, a 1 MHz clock is appropriate.
+        *      For 10 Gb/s Ethernet, a 1 GHz clock should be ok, but
+        *      we also need to limit the resolution so that the u32 seq
+        *      overlaps less than one time per MSL (2 minutes).
+        *      Choosing a clock of 64 ns period is OK. (period of 274 s)
         */
-       seq += ktime_get_real().tv64;
+       seq += ktime_get_real().tv64 >> 6;
 #if 0
        printk("init_seq(%lx, %lx, %d, %d) = %d\n",
               saddr, daddr, sport, dport, seq);
index c6f6f42097391b20f434a669ae6b0f263fda63ee..c799b7f7bbb35d4cba1dd4643a61677d05cd5836 100644 (file)
@@ -770,6 +770,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                /*
                 * Switching-from response
                 */
+               acquire_console_sem();
                if (vc->vt_newvt >= 0) {
                        if (arg == 0)
                                /*
@@ -784,7 +785,6 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 * complete the switch.
                                 */
                                int newvt;
-                               acquire_console_sem();
                                newvt = vc->vt_newvt;
                                vc->vt_newvt = -1;
                                i = vc_allocate(newvt);
@@ -798,7 +798,6 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                                 * other console switches..
                                 */
                                complete_change_console(vc_cons[newvt].d);
-                               release_console_sem();
                        }
                }
 
@@ -810,9 +809,12 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                        /*
                         * If it's just an ACK, ignore it
                         */
-                       if (arg != VT_ACKACQ)
+                       if (arg != VT_ACKACQ) {
+                               release_console_sem();
                                return -EINVAL;
+                       }
                }
+               release_console_sem();
 
                return 0;
 
@@ -1208,15 +1210,18 @@ void change_console(struct vc_data *new_vc)
                /*
                 * Send the signal as privileged - kill_pid() will
                 * tell us if the process has gone or something else
-                * is awry
+                * is awry.
+                *
+                * We need to set vt_newvt *before* sending the signal or we
+                * have a race.
                 */
+               vc->vt_newvt = new_vc->vc_num;
                if (kill_pid(vc->vt_pid, vc->vt_mode.relsig, 1) == 0) {
                        /*
                         * It worked. Mark the vt to switch to and
                         * return. The process needs to send us a
                         * VT_RELDISP ioctl to complete the switch.
                         */
-                       vc->vt_newvt = new_vc->vc_num;
                        return;
                }
 
index e2abe18e575df2d89e2de4189124f2fbb4abb35f..7c662ee594a3e9fdf85761765ae6776ddecf05d9 100644 (file)
@@ -277,7 +277,7 @@ config JOYSTICK_XPAD_FF
 
 config JOYSTICK_XPAD_LEDS
        bool "LED Support for Xbox360 controller 'BigX' LED"
-       depends on LEDS_CLASS && JOYSTICK_XPAD
+       depends on JOYSTICK_XPAD && (LEDS_CLASS=y || LEDS_CLASS=JOYSTICK_XPAD)
        ---help---
          This option enables support for the LED which surrounds the Big X on
          XBox 360 controller.
index 0285c4a830eb61938d044adc965bf0bef4c49784..66ea3cbc369c209f2ae4cc52d03253479f16052b 100644 (file)
@@ -754,9 +754,11 @@ static void ivtv_stop_decoding(struct ivtv_open_id *id, int flags, u64 pts)
                ivtv_yuv_close(itv);
        }
        if (s->type == IVTV_DEC_STREAM_TYPE_YUV && itv->output_mode == OUT_YUV)
-           itv->output_mode = OUT_NONE;
+               itv->output_mode = OUT_NONE;
+       else if (s->type == IVTV_DEC_STREAM_TYPE_YUV && itv->output_mode == OUT_UDMA_YUV)
+               itv->output_mode = OUT_NONE;
        else if (s->type == IVTV_DEC_STREAM_TYPE_MPG && itv->output_mode == OUT_MPG)
-           itv->output_mode = OUT_NONE;
+               itv->output_mode = OUT_NONE;
 
        itv->speed = 0;
        clear_bit(IVTV_F_I_DEC_PAUSED, &itv->i_flags);
index 4c3785c9d4b811067b5af3dafd0de33224591bae..9ecc3adcf6c189117e038426e0fc0550f08f60bd 100644 (file)
@@ -1726,6 +1726,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
        case E1000_DEV_ID_82571EB_QUAD_COPPER:
        case E1000_DEV_ID_82571EB_QUAD_FIBER:
        case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
+       case E1000_DEV_ID_82571PT_QUAD_COPPER:
        case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                /* quad port adapters only support WoL on port A */
                if (!adapter->quad_port_a) {
index ba120f7fb0bef2c619475fcd5742170f02b44124..8604adbe351cc07dc2b004896af8c4cd338d9331 100644 (file)
@@ -387,6 +387,7 @@ e1000_set_mac_type(struct e1000_hw *hw)
        case E1000_DEV_ID_82571EB_SERDES_DUAL:
        case E1000_DEV_ID_82571EB_SERDES_QUAD:
        case E1000_DEV_ID_82571EB_QUAD_COPPER:
+       case E1000_DEV_ID_82571PT_QUAD_COPPER:
        case E1000_DEV_ID_82571EB_QUAD_FIBER:
        case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
                hw->mac_type = e1000_82571;
index fe8714655c90445808000870543f5539d70e1dfa..07f0ea73676e90e4ad00555447108c03b2f4ef60 100644 (file)
@@ -475,6 +475,7 @@ int32_t e1000_check_phy_reset_block(struct e1000_hw *hw);
 #define E1000_DEV_ID_82571EB_FIBER       0x105F
 #define E1000_DEV_ID_82571EB_SERDES      0x1060
 #define E1000_DEV_ID_82571EB_QUAD_COPPER 0x10A4
+#define E1000_DEV_ID_82571PT_QUAD_COPPER 0x10D5
 #define E1000_DEV_ID_82571EB_QUAD_FIBER  0x10A5
 #define E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE  0x10BC
 #define E1000_DEV_ID_82571EB_SERDES_DUAL 0x10D9
index 4a225950fb43f6cbe30feff14945857305825dbe..e7c8951f47fa94d3e0fae7551f5e6d84ef16676a 100644 (file)
@@ -108,6 +108,7 @@ static struct pci_device_id e1000_pci_tbl[] = {
        INTEL_E1000_ETHERNET_DEVICE(0x10BC),
        INTEL_E1000_ETHERNET_DEVICE(0x10C4),
        INTEL_E1000_ETHERNET_DEVICE(0x10C5),
+       INTEL_E1000_ETHERNET_DEVICE(0x10D5),
        INTEL_E1000_ETHERNET_DEVICE(0x10D9),
        INTEL_E1000_ETHERNET_DEVICE(0x10DA),
        /* required last entry */
@@ -1101,6 +1102,7 @@ e1000_probe(struct pci_dev *pdev,
        case E1000_DEV_ID_82571EB_QUAD_COPPER:
        case E1000_DEV_ID_82571EB_QUAD_FIBER:
        case E1000_DEV_ID_82571EB_QUAD_COPPER_LOWPROFILE:
+       case E1000_DEV_ID_82571PT_QUAD_COPPER:
                /* if quad port adapter, disable WoL on all but port A */
                if (global_quad_port_a != 0)
                        adapter->eeprom_wol = 0;
index 456d1e1c98bd1b79a60b24818286f0c31f996be3..34288fe038c38c5900cb6cee01ca985e7968d483 100644 (file)
@@ -534,7 +534,7 @@ static irqreturn_t mv643xx_eth_int_handler(int irq, void *dev_id)
        }
 
        /* PHY status changed */
-       if (eth_int_cause_ext & ETH_INT_CAUSE_PHY) {
+       if (eth_int_cause_ext & (ETH_INT_CAUSE_PHY | ETH_INT_CAUSE_STATE)) {
                struct ethtool_cmd cmd;
 
                if (mii_link_ok(&mp->mii)) {
index 82f8c0cbfb640fafd0e90b8a429e0283ed6622f3..565b96696acab9e131fb275dca99430e3b88b824 100644 (file)
@@ -64,7 +64,9 @@
 #define ETH_INT_CAUSE_TX_ERROR (ETH_TX_QUEUES_ENABLED << 8)
 #define ETH_INT_CAUSE_TX       (ETH_INT_CAUSE_TX_DONE | ETH_INT_CAUSE_TX_ERROR)
 #define ETH_INT_CAUSE_PHY      0x00010000
-#define ETH_INT_UNMASK_ALL_EXT (ETH_INT_CAUSE_TX | ETH_INT_CAUSE_PHY)
+#define ETH_INT_CAUSE_STATE    0x00100000
+#define ETH_INT_UNMASK_ALL_EXT (ETH_INT_CAUSE_TX | ETH_INT_CAUSE_PHY | \
+                                       ETH_INT_CAUSE_STATE)
 
 #define ETH_INT_MASK_ALL       0x00000000
 #define ETH_INT_MASK_ALL_EXT   0x00000000
index 0792031a5cf959a1543f32f4e0f2ab4ccb7b0ec2..162489b9f5990b9ea2093ff5afc3c8b936c8abc1 100644 (file)
@@ -910,6 +910,20 @@ static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2)
        return le;
 }
 
+static void tx_init(struct sky2_port *sky2)
+{
+       struct sky2_tx_le *le;
+
+       sky2->tx_prod = sky2->tx_cons = 0;
+       sky2->tx_tcpsum = 0;
+       sky2->tx_last_mss = 0;
+
+       le = get_tx_le(sky2);
+       le->addr = 0;
+       le->opcode = OP_ADDR64 | HW_OWNER;
+       sky2->tx_addr64 = 0;
+}
+
 static inline struct tx_ring_info *tx_le_re(struct sky2_port *sky2,
                                            struct sky2_tx_le *le)
 {
@@ -1320,7 +1334,8 @@ static int sky2_up(struct net_device *dev)
                                GFP_KERNEL);
        if (!sky2->tx_ring)
                goto err_out;
-       sky2->tx_prod = sky2->tx_cons = 0;
+
+       tx_init(sky2);
 
        sky2->rx_le = pci_alloc_consistent(hw->pdev, RX_LE_BYTES,
                                           &sky2->rx_le_map);
@@ -2148,6 +2163,18 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
        sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
        prefetch(sky2->rx_ring + sky2->rx_next);
 
+       if (length < ETH_ZLEN || length > sky2->rx_data_size)
+               goto len_error;
+
+       /* This chip has hardware problems that generates bogus status.
+        * So do only marginal checking and expect higher level protocols
+        * to handle crap frames.
+        */
+       if (sky2->hw->chip_id == CHIP_ID_YUKON_FE_P &&
+           sky2->hw->chip_rev == CHIP_REV_YU_FE2_A0 &&
+           length != count)
+               goto okay;
+
        if (status & GMR_FS_ANY_ERR)
                goto error;
 
@@ -2156,8 +2183,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
 
        /* if length reported by DMA does not match PHY, packet was truncated */
        if (length != count)
-               goto len_mismatch;
+               goto len_error;
 
+okay:
        if (length < copybreak)
                skb = receive_copy(sky2, re, length);
        else
@@ -2167,13 +2195,13 @@ resubmit:
 
        return skb;
 
-len_mismatch:
+len_error:
        /* Truncation of overlength packets
           causes PHY length to not match MAC length */
        ++sky2->net_stats.rx_length_errors;
        if (netif_msg_rx_err(sky2) && net_ratelimit())
-               pr_info(PFX "%s: rx length mismatch: length %d status %#x\n",
-                       dev->name, length, status);
+               pr_info(PFX "%s: rx length error: status %#x length %d\n",
+                       dev->name, status, length);
        goto resubmit;
 
 error:
@@ -3934,13 +3962,6 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
        sky2->hw = hw;
        sky2->msg_enable = netif_msg_init(debug, default_msg);
 
-       /* This chip has hardware problems that generates
-        * bogus PHY receive status so by default shut up the message.
-        */
-       if (hw->chip_id == CHIP_ID_YUKON_FE_P &&
-           hw->chip_rev == CHIP_REV_YU_FE2_A0)
-               sky2->msg_enable &= ~NETIF_MSG_RX_ERR;
-
        /* Auto speed and flow control */
        sky2->autoneg = AUTONEG_ENABLE;
        sky2->flow_mode = FC_BOTH;
@@ -3964,8 +3985,12 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
                dev->features |= NETIF_F_HIGHDMA;
 
 #ifdef SKY2_VLAN_TAG_USED
-       dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
-       dev->vlan_rx_register = sky2_vlan_rx_register;
+       /* The workaround for FE+ status conflicts with VLAN tag detection. */
+       if (!(sky2->hw->chip_id == CHIP_ID_YUKON_FE_P &&
+             sky2->hw->chip_rev == CHIP_REV_YU_FE2_A0)) {
+               dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
+               dev->vlan_rx_register = sky2_vlan_rx_register;
+       }
 #endif
 
        /* read the mac address */
index ef35bc6c4a228491723bd6c4efc9d5816dd8009b..4eb6d9752881e7459a4bb0be66d959903c394e2d 100644 (file)
@@ -43,7 +43,7 @@ obj-$(CONFIG_PCMCIA_RAYCS)    += ray_cs.o
 obj-$(CONFIG_PCMCIA_WL3501)    += wl3501_cs.o
 
 obj-$(CONFIG_USB_ZD1201)       += zd1201.o
-obj-$(CONFIG_LIBERTAS_USB)     += libertas/
+obj-$(CONFIG_LIBERTAS)         += libertas/
 
 rtl8187-objs           := rtl8187_dev.o rtl8187_rtl8225.o
 obj-$(CONFIG_RTL8187)  += rtl8187.o
index 7dcaa09b3c200591cfb49412c331b19ccb3e8999..50f2dd9e1bb2cac61a58d132c52046ac88fc5d66 100644 (file)
@@ -1444,7 +1444,6 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID, quirk_netmos);
 static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
 {
        u16 command;
-       u32 bar;
        u8 __iomem *csr;
        u8 cmd_hi;
 
@@ -1476,12 +1475,12 @@ static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
         * re-enable them when it's ready.
         */
        pci_read_config_word(dev, PCI_COMMAND, &command);
-       pci_read_config_dword(dev, PCI_BASE_ADDRESS_0, &bar);
 
-       if (!(command & PCI_COMMAND_MEMORY) || !bar)
+       if (!(command & PCI_COMMAND_MEMORY) || !pci_resource_start(dev, 0))
                return;
 
-       csr = ioremap(bar, 8);
+       /* Convert from PCI bus to resource space.  */
+       csr = ioremap(pci_resource_start(dev, 0), 8);
        if (!csr) {
                printk(KERN_WARNING "PCI: Can't map %s e100 registers\n",
                        pci_name(dev));
index a99e45e2b6d8d114db340681805297b99f431292..2a6477834c3e0e8e63c17b7c62fc8735855d1db1 100644 (file)
@@ -37,6 +37,6 @@ static inline void cpm_set_smc_fcr(volatile smc_uart_t * up)
        up->smc_tfcr = SMC_EB;
 }
 
-#define DPRAM_BASE     ((unsigned char *)&cpmp->cp_dpmem[0])
+#define DPRAM_BASE     ((unsigned char *)cpm_dpram_addr(0))
 
 #endif
index a49f9feff776253f99ffd167246a5fc2b77d79d5..a204484072f34ca37320f310eeee2b8bdbb35cca 100644 (file)
@@ -588,16 +588,6 @@ static int nfs_init_server(struct nfs_server *server, const struct nfs_mount_dat
        server->namelen  = data->namlen;
        /* Create a client RPC handle for the NFSv3 ACL management interface */
        nfs_init_server_aclclient(server);
-       if (clp->cl_nfsversion == 3) {
-               if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
-                       server->namelen = NFS3_MAXNAMLEN;
-               if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
-                       server->caps |= NFS_CAP_READDIRPLUS;
-       } else {
-               if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
-                       server->namelen = NFS2_MAXNAMLEN;
-       }
-
        dprintk("<-- nfs_init_server() = 0 [new %p]\n", clp);
        return 0;
 
@@ -794,6 +784,16 @@ struct nfs_server *nfs_create_server(const struct nfs_mount_data *data,
        error = nfs_probe_fsinfo(server, mntfh, &fattr);
        if (error < 0)
                goto error;
+       if (server->nfs_client->rpc_ops->version == 3) {
+               if (server->namelen == 0 || server->namelen > NFS3_MAXNAMLEN)
+                       server->namelen = NFS3_MAXNAMLEN;
+               if (!(data->flags & NFS_MOUNT_NORDIRPLUS))
+                       server->caps |= NFS_CAP_READDIRPLUS;
+       } else {
+               if (server->namelen == 0 || server->namelen > NFS2_MAXNAMLEN)
+                       server->namelen = NFS2_MAXNAMLEN;
+       }
+
        if (!(fattr.valid & NFS_ATTR_FATTR)) {
                error = server->nfs_client->rpc_ops->getattr(server, mntfh, &fattr);
                if (error < 0) {
@@ -984,6 +984,9 @@ struct nfs_server *nfs4_create_server(const struct nfs4_mount_data *data,
        if (error < 0)
                goto error;
 
+       if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+               server->namelen = NFS4_MAXNAMLEN;
+
        BUG_ON(!server->nfs_client);
        BUG_ON(!server->nfs_client->rpc_ops);
        BUG_ON(!server->nfs_client->rpc_ops->file_inode_ops);
@@ -1056,6 +1059,9 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
        if (error < 0)
                goto error;
 
+       if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+               server->namelen = NFS4_MAXNAMLEN;
+
        dprintk("Referral FSID: %llx:%llx\n",
                (unsigned long long) server->fsid.major,
                (unsigned long long) server->fsid.minor);
@@ -1115,6 +1121,9 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
        if (error < 0)
                goto out_free_server;
 
+       if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+               server->namelen = NFS4_MAXNAMLEN;
+
        dprintk("Cloned FSID: %llx:%llx\n",
                (unsigned long long) server->fsid.major,
                (unsigned long long) server->fsid.minor);
index ea97408e423e916bf77ef5b303541a23551d2cb3..e4a04d16b8b06fd4faf22b7ba238f404403a8c7f 100644 (file)
@@ -1162,6 +1162,8 @@ static struct dentry *nfs_readdir_lookup(nfs_readdir_descriptor_t *desc)
        }
        if (!desc->plus || !(entry->fattr->valid & NFS_ATTR_FATTR))
                return NULL;
+       if (name.len > NFS_SERVER(dir)->namelen)
+               return NULL;
        /* Note: caller is already holding the dir->i_mutex! */
        dentry = d_alloc(parent, &name);
        if (dentry == NULL)
index d1cbf0a0fbb2d457c92c964958e96dc2d9f56839..522e5ad4d8ad9b3946e201926c7f799ddf0f2e36 100644 (file)
@@ -175,6 +175,9 @@ next_component:
                path++;
        name.len = path - (const char *) name.name;
 
+       if (name.len > NFS4_MAXNAMLEN)
+               return -ENAMETOOLONG;
+
 eat_dot_dir:
        while (*path == '/')
                path++;
index c010a72ca2d2a3543fb2a7365b2e8c5b4c73b652..e95a36228863affa3d6c19a37ac4766f8e147412 100644 (file)
@@ -1223,6 +1223,33 @@ static long do_splice(struct file *in, loff_t __user *off_in,
        return -EINVAL;
 }
 
+/*
+ * Do a copy-from-user while holding the mmap_semaphore for reading, in a
+ * manner safe from deadlocking with simultaneous mmap() (grabbing mmap_sem
+ * for writing) and page faulting on the user memory pointed to by src.
+ * This assumes that we will very rarely hit the partial != 0 path, or this
+ * will not be a win.
+ */
+static int copy_from_user_mmap_sem(void *dst, const void __user *src, size_t n)
+{
+       int partial;
+
+       pagefault_disable();
+       partial = __copy_from_user_inatomic(dst, src, n);
+       pagefault_enable();
+
+       /*
+        * Didn't copy everything, drop the mmap_sem and do a faulting copy
+        */
+       if (unlikely(partial)) {
+               up_read(&current->mm->mmap_sem);
+               partial = copy_from_user(dst, src, n);
+               down_read(&current->mm->mmap_sem);
+       }
+
+       return partial;
+}
+
 /*
  * Map an iov into an array of pages and offset/length tupples. With the
  * partial_page structure, we can map several non-contiguous ranges into
@@ -1236,31 +1263,26 @@ static int get_iovec_page_array(const struct iovec __user *iov,
 {
        int buffers = 0, error = 0;
 
-       /*
-        * It's ok to take the mmap_sem for reading, even
-        * across a "get_user()".
-        */
        down_read(&current->mm->mmap_sem);
 
        while (nr_vecs) {
                unsigned long off, npages;
+               struct iovec entry;
                void __user *base;
                size_t len;
                int i;
 
-               /*
-                * Get user address base and length for this iovec.
-                */
-               error = get_user(base, &iov->iov_base);
-               if (unlikely(error))
-                       break;
-               error = get_user(len, &iov->iov_len);
-               if (unlikely(error))
+               error = -EFAULT;
+               if (copy_from_user_mmap_sem(&entry, iov, sizeof(entry)))
                        break;
 
+               base = entry.iov_base;
+               len = entry.iov_len;
+
                /*
                 * Sanity check this iovec. 0 read succeeds.
                 */
+               error = 0;
                if (unlikely(!len))
                        break;
                error = -EFAULT;
index fa25b7dcc6c3515b3e4c7c5f217b91cbca77e4ae..d7e13614306635bfae1f31bfbd1728e0ff3c1e36 100644 (file)
@@ -52,11 +52,6 @@ typedef struct xfs_buf_log_format_t {
 #define        XFS_BLI_UDQUOT_BUF      0x4
 #define XFS_BLI_PDQUOT_BUF     0x8
 #define        XFS_BLI_GDQUOT_BUF      0x10
-/*
- * This flag indicates that the buffer contains newly allocated
- * inodes.
- */
-#define        XFS_BLI_INODE_NEW_BUF   0x20
 
 #define        XFS_BLI_CHUNK           128
 #define        XFS_BLI_SHIFT           7
index 7174991f4bef2b43ce2611b8c143e40630a83145..8ae6e8e5f3db70e1a5c0ee276361f0907fe3f793 100644 (file)
@@ -1874,7 +1874,6 @@ xlog_recover_do_inode_buffer(
 /*ARGSUSED*/
 STATIC void
 xlog_recover_do_reg_buffer(
-       xfs_mount_t             *mp,
        xlog_recover_item_t     *item,
        xfs_buf_t               *bp,
        xfs_buf_log_format_t    *buf_f)
@@ -1885,50 +1884,6 @@ xlog_recover_do_reg_buffer(
        unsigned int            *data_map = NULL;
        unsigned int            map_size = 0;
        int                     error;
-       int                     stale_buf = 1;
-
-       /*
-        * Scan through the on-disk inode buffer and attempt to
-        * determine if it has been written to since it was logged.
-        *
-        * - If any of the magic numbers are incorrect then the buffer is stale
-        * - If any of the modes are non-zero then the buffer is not stale
-        * - If all of the modes are zero and at least one of the generation
-        *   counts is non-zero then the buffer is stale
-        *
-        * If the end result is a stale buffer then the log buffer is replayed
-        * otherwise it is skipped.
-        *
-        * This heuristic is not perfect.  It can be improved by scanning the
-        * entire inode chunk for evidence that any of the inode clusters have
-        * been updated.  To fix this problem completely we will need a major
-        * architectural change to the logging system.
-        */
-       if (buf_f->blf_flags & XFS_BLI_INODE_NEW_BUF) {
-               xfs_dinode_t    *dip;
-               int             inodes_per_buf;
-               int             mode_count = 0;
-               int             gen_count = 0;
-
-               stale_buf = 0;
-               inodes_per_buf = XFS_BUF_COUNT(bp) >> mp->m_sb.sb_inodelog;
-               for (i = 0; i < inodes_per_buf; i++) {
-                       dip = (xfs_dinode_t *)xfs_buf_offset(bp,
-                               i * mp->m_sb.sb_inodesize);
-                       if (be16_to_cpu(dip->di_core.di_magic) !=
-                                       XFS_DINODE_MAGIC) {
-                               stale_buf = 1;
-                               break;
-                       }
-                       if (dip->di_core.di_mode)
-                               mode_count++;
-                       if (dip->di_core.di_gen)
-                               gen_count++;
-               }
-
-               if (!mode_count && gen_count)
-                       stale_buf = 1;
-       }
 
        switch (buf_f->blf_type) {
        case XFS_LI_BUF:
@@ -1962,7 +1917,7 @@ xlog_recover_do_reg_buffer(
                                               -1, 0, XFS_QMOPT_DOWARN,
                                               "dquot_buf_recover");
                }
-               if (!error && stale_buf)
+               if (!error)
                        memcpy(xfs_buf_offset(bp,
                                (uint)bit << XFS_BLI_SHIFT),    /* dest */
                                item->ri_buf[i].i_addr,         /* source */
@@ -2134,7 +2089,7 @@ xlog_recover_do_dquot_buffer(
        if (log->l_quotaoffs_flag & type)
                return;
 
-       xlog_recover_do_reg_buffer(mp, item, bp, buf_f);
+       xlog_recover_do_reg_buffer(item, bp, buf_f);
 }
 
 /*
@@ -2235,7 +2190,7 @@ xlog_recover_do_buffer_trans(
                  (XFS_BLI_UDQUOT_BUF|XFS_BLI_PDQUOT_BUF|XFS_BLI_GDQUOT_BUF)) {
                xlog_recover_do_dquot_buffer(mp, log, item, bp, buf_f);
        } else {
-               xlog_recover_do_reg_buffer(mp, item, bp, buf_f);
+               xlog_recover_do_reg_buffer(item, bp, buf_f);
        }
        if (error)
                return XFS_ERROR(error);
index 95fff6872a2fcd32c17cdff342bebe062ded95e7..60b6b898022bcb1be98f96f2a21615e1bff5e131 100644 (file)
@@ -966,7 +966,6 @@ xfs_trans_inode_alloc_buf(
        ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
        bip->bli_flags |= XFS_BLI_INODE_ALLOC_BUF;
-       bip->bli_format.blf_flags |= XFS_BLI_INODE_NEW_BUF;
 }
 
 
index 609756c616769194763fb3b17dbf046ca3c25059..d69ba937e09251769e2f00d54c0c91562a4127e8 100644 (file)
@@ -214,11 +214,6 @@ static inline unsigned long get_limit(unsigned long segment)
  */
  
 
-/* 
- * Actually only lfence would be needed for mb() because all stores done 
- * by the kernel should be already ordered. But keep a full barrier for now. 
- */
-
 #define mb() alternative("lock; addl $0,0(%%esp)", "mfence", X86_FEATURE_XMM2)
 #define rmb() alternative("lock; addl $0,0(%%esp)", "lfence", X86_FEATURE_XMM2)
 
index 00a50ec1c19fd6426bd57732aad5e2bdd64e7807..2a52333a062d1879d6b06cc2ab1bb44fc67d95b4 100644 (file)
@@ -13,6 +13,7 @@
 #define O_SYNC         0x0010
 #define O_NONBLOCK     0x0080
 #define O_CREAT         0x0100 /* not fcntl */
+#define O_TRUNC                0x0200  /* not fcntl */
 #define O_EXCL         0x0400  /* not fcntl */
 #define O_NOCTTY       0x0800  /* not fcntl */
 #define FASYNC         0x1000  /* fcntl, for BSD compatibility */
index b92dd8c760da5d8a600f6abb33bd62b9bc6c1146..e3301e54d559c9586bf47c31b0486af12d9e2ab6 100644 (file)
@@ -142,7 +142,7 @@ typedef struct { unsigned long pgprot; } pgprot_t;
 /*
  * __pa()/__va() should be used only during mem init.
  */
-#if defined(CONFIG_64BIT) && !defined(CONFIG_BUILD_ELF64)
+#ifdef CONFIG_64BIT
 #define __pa(x)                                                                \
 ({                                                                     \
     unsigned long __x = (unsigned long)(x);                            \
index 185c7ecce4cc159e845c3e9afa62a7facc7b8bea..54053de0bdd7c12f2f3a0269f2ddf5b77c33ec47 100644 (file)
@@ -1059,14 +1059,12 @@ struct tcp_md5sig_key {
 };
 
 struct tcp4_md5sig_key {
-       u8                      *key;
-       u16                     keylen;
+       struct tcp_md5sig_key   base;
        __be32                  addr;
 };
 
 struct tcp6_md5sig_key {
-       u8                      *key;
-       u16                     keylen;
+       struct tcp_md5sig_key   base;
 #if 0
        u32                     scope_id;       /* XXX */
 #endif
index e8935b195e8809fa1a23484d5007feb27887fd63..fcc94e7b40864afcb72170f19d832f8117e517fc 100644 (file)
@@ -1943,9 +1943,10 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,
 void exit_robust_list(struct task_struct *curr)
 {
        struct robust_list_head __user *head = curr->robust_list;
-       struct robust_list __user *entry, *pending;
-       unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
+       struct robust_list __user *entry, *next_entry, *pending;
+       unsigned int limit = ROBUST_LIST_LIMIT, pi, next_pi, pip;
        unsigned long futex_offset;
+       int rc;
 
        /*
         * Fetch the list head (which was registered earlier, via
@@ -1965,11 +1966,13 @@ void exit_robust_list(struct task_struct *curr)
        if (fetch_robust_entry(&pending, &head->list_op_pending, &pip))
                return;
 
-       if (pending)
-               handle_futex_death((void __user *)pending + futex_offset,
-                                  curr, pip);
-
+       next_entry = NULL;      /* avoid warning with gcc */
        while (entry != &head->list) {
+               /*
+                * Fetch the next entry in the list before calling
+                * handle_futex_death:
+                */
+               rc = fetch_robust_entry(&next_entry, &entry->next, &next_pi);
                /*
                 * A pending lock might already be on the list, so
                 * don't process it twice:
@@ -1978,11 +1981,10 @@ void exit_robust_list(struct task_struct *curr)
                        if (handle_futex_death((void __user *)entry + futex_offset,
                                                curr, pi))
                                return;
-               /*
-                * Fetch the next entry in the list:
-                */
-               if (fetch_robust_entry(&entry, &entry->next, &pi))
+               if (rc)
                        return;
+               entry = next_entry;
+               pi = next_pi;
                /*
                 * Avoid excessively long or circular lists:
                 */
@@ -1991,6 +1993,10 @@ void exit_robust_list(struct task_struct *curr)
 
                cond_resched();
        }
+
+       if (pending)
+               handle_futex_death((void __user *)pending + futex_offset,
+                                  curr, pip);
 }
 
 long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout,
index 7e52eb051f227f557a171e974312d35b9192944a..2c2e2954b713b2681a5bf120c0097cb2c2affc8c 100644 (file)
@@ -38,10 +38,11 @@ fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
 void compat_exit_robust_list(struct task_struct *curr)
 {
        struct compat_robust_list_head __user *head = curr->compat_robust_list;
-       struct robust_list __user *entry, *pending;
-       unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
-       compat_uptr_t uentry, upending;
+       struct robust_list __user *entry, *next_entry, *pending;
+       unsigned int limit = ROBUST_LIST_LIMIT, pi, next_pi, pip;
+       compat_uptr_t uentry, next_uentry, upending;
        compat_long_t futex_offset;
+       int rc;
 
        /*
         * Fetch the list head (which was registered earlier, via
@@ -61,10 +62,15 @@ void compat_exit_robust_list(struct task_struct *curr)
        if (fetch_robust_entry(&upending, &pending,
                               &head->list_op_pending, &pip))
                return;
-       if (pending)
-               handle_futex_death((void __user *)pending + futex_offset, curr, pip);
 
+       next_entry = NULL;      /* avoid warning with gcc */
        while (entry != (struct robust_list __user *) &head->list) {
+               /*
+                * Fetch the next entry in the list before calling
+                * handle_futex_death:
+                */
+               rc = fetch_robust_entry(&next_uentry, &next_entry,
+                       (compat_uptr_t __user *)&entry->next, &next_pi);
                /*
                 * A pending lock might already be on the list, so
                 * dont process it twice:
@@ -74,12 +80,11 @@ void compat_exit_robust_list(struct task_struct *curr)
                                                curr, pi))
                                return;
 
-               /*
-                * Fetch the next entry in the list:
-                */
-               if (fetch_robust_entry(&uentry, &entry,
-                                      (compat_uptr_t __user *)&entry->next, &pi))
+               if (rc)
                        return;
+               uentry = next_uentry;
+               entry = next_entry;
+               pi = next_pi;
                /*
                 * Avoid excessively long or circular lists:
                 */
@@ -88,6 +93,9 @@ void compat_exit_robust_list(struct task_struct *curr)
 
                cond_resched();
        }
+       if (pending)
+               handle_futex_death((void __user *)pending + futex_offset,
+                                  curr, pip);
 }
 
 asmlinkage long
index 1b33b05d346bb8958ac235a2aa423b657cdf28ad..8ae2e636eb1ba690f9fd9cf0f363d5f677db80ac 100644 (file)
@@ -32,6 +32,7 @@
 #include <linux/getcpu.h>
 #include <linux/task_io_accounting_ops.h>
 #include <linux/seccomp.h>
+#include <linux/cpu.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -878,6 +879,7 @@ void kernel_power_off(void)
        kernel_shutdown_prepare(SYSTEM_POWER_OFF);
        if (pm_power_off_prepare)
                pm_power_off_prepare();
+       disable_nonboot_cpus();
        sysdev_shutdown();
        printk(KERN_EMERG "Power down.\n");
        machine_power_off();
index 84c795ee2d650f807223c3f17a072c3f2eb52c72..eab8c428cc932028e202b4a8b8d547642fd10fa6 100644 (file)
@@ -42,7 +42,7 @@ static void clear_huge_page(struct page *page, unsigned long addr)
        might_sleep();
        for (i = 0; i < (HPAGE_SIZE/PAGE_SIZE); i++) {
                cond_resched();
-               clear_user_highpage(page + i, addr);
+               clear_user_highpage(page + i, addr + i * PAGE_SIZE);
        }
 }
 
index f2de2e48b021cc960417cd330f8e9a72a648cc5c..6284c99b456eeb7fc992ffd9063d28d609fdce0f 100644 (file)
@@ -366,6 +366,12 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
        frag = WLAN_GET_SEQ_FRAG(sc);
        hdrlen = ieee80211_get_hdrlen(fc);
 
+       if (skb->len < hdrlen) {
+               printk(KERN_INFO "%s: invalid SKB length %d\n",
+                       dev->name, skb->len);
+               goto rx_dropped;
+       }
+
        /* Put this code here so that we avoid duplicating it in all
         * Rx paths. - Jean II */
 #ifdef CONFIG_WIRELESS_EXT
index 9c94627c8c7e1888c3369f42fde366efbbe6d929..e089a978e128057e8b7bc245beaa3aad81be12a0 100644 (file)
@@ -833,8 +833,7 @@ static struct tcp_md5sig_key *
                return NULL;
        for (i = 0; i < tp->md5sig_info->entries4; i++) {
                if (tp->md5sig_info->keys4[i].addr == addr)
-                       return (struct tcp_md5sig_key *)
-                                               &tp->md5sig_info->keys4[i];
+                       return &tp->md5sig_info->keys4[i].base;
        }
        return NULL;
 }
@@ -865,9 +864,9 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
        key = (struct tcp4_md5sig_key *)tcp_v4_md5_do_lookup(sk, addr);
        if (key) {
                /* Pre-existing entry - just update that one. */
-               kfree(key->key);
-               key->key = newkey;
-               key->keylen = newkeylen;
+               kfree(key->base.key);
+               key->base.key = newkey;
+               key->base.keylen = newkeylen;
        } else {
                struct tcp_md5sig_info *md5sig;
 
@@ -906,9 +905,9 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                        md5sig->alloced4++;
                }
                md5sig->entries4++;
-               md5sig->keys4[md5sig->entries4 - 1].addr   = addr;
-               md5sig->keys4[md5sig->entries4 - 1].key    = newkey;
-               md5sig->keys4[md5sig->entries4 - 1].keylen = newkeylen;
+               md5sig->keys4[md5sig->entries4 - 1].addr        = addr;
+               md5sig->keys4[md5sig->entries4 - 1].base.key    = newkey;
+               md5sig->keys4[md5sig->entries4 - 1].base.keylen = newkeylen;
        }
        return 0;
 }
@@ -930,7 +929,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
        for (i = 0; i < tp->md5sig_info->entries4; i++) {
                if (tp->md5sig_info->keys4[i].addr == addr) {
                        /* Free the key */
-                       kfree(tp->md5sig_info->keys4[i].key);
+                       kfree(tp->md5sig_info->keys4[i].base.key);
                        tp->md5sig_info->entries4--;
 
                        if (tp->md5sig_info->entries4 == 0) {
@@ -964,7 +963,7 @@ static void tcp_v4_clear_md5_list(struct sock *sk)
        if (tp->md5sig_info->entries4) {
                int i;
                for (i = 0; i < tp->md5sig_info->entries4; i++)
-                       kfree(tp->md5sig_info->keys4[i].key);
+                       kfree(tp->md5sig_info->keys4[i].base.key);
                tp->md5sig_info->entries4 = 0;
                tcp_free_md5sig_pool();
        }
index 0f7defb482e9bf18411eef3d1911d922b6dbda1d..3e06799b37a65248047f050072b6208dacdca336 100644 (file)
@@ -539,7 +539,7 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 
        for (i = 0; i < tp->md5sig_info->entries6; i++) {
                if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
-                       return (struct tcp_md5sig_key *)&tp->md5sig_info->keys6[i];
+                       return &tp->md5sig_info->keys6[i].base;
        }
        return NULL;
 }
@@ -567,9 +567,9 @@ static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
        key = (struct tcp6_md5sig_key*) tcp_v6_md5_do_lookup(sk, peer);
        if (key) {
                /* modify existing entry - just update that one */
-               kfree(key->key);
-               key->key = newkey;
-               key->keylen = newkeylen;
+               kfree(key->base.key);
+               key->base.key = newkey;
+               key->base.keylen = newkeylen;
        } else {
                /* reallocate new list if current one is full. */
                if (!tp->md5sig_info) {
@@ -603,8 +603,8 @@ static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
 
                ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
                               peer);
-               tp->md5sig_info->keys6[tp->md5sig_info->entries6].key = newkey;
-               tp->md5sig_info->keys6[tp->md5sig_info->entries6].keylen = newkeylen;
+               tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
+               tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
 
                tp->md5sig_info->entries6++;
        }
@@ -626,7 +626,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
        for (i = 0; i < tp->md5sig_info->entries6; i++) {
                if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
                        /* Free the key */
-                       kfree(tp->md5sig_info->keys6[i].key);
+                       kfree(tp->md5sig_info->keys6[i].base.key);
                        tp->md5sig_info->entries6--;
 
                        if (tp->md5sig_info->entries6 == 0) {
@@ -657,7 +657,7 @@ static void tcp_v6_clear_md5_list (struct sock *sk)
 
        if (tp->md5sig_info->entries6) {
                for (i = 0; i < tp->md5sig_info->entries6; i++)
-                       kfree(tp->md5sig_info->keys6[i].key);
+                       kfree(tp->md5sig_info->keys6[i].base.key);
                tp->md5sig_info->entries6 = 0;
                tcp_free_md5sig_pool();
        }
@@ -668,7 +668,7 @@ static void tcp_v6_clear_md5_list (struct sock *sk)
 
        if (tp->md5sig_info->entries4) {
                for (i = 0; i < tp->md5sig_info->entries4; i++)
-                       kfree(tp->md5sig_info->keys4[i].key);
+                       kfree(tp->md5sig_info->keys4[i].base.key);
                tp->md5sig_info->entries4 = 0;
                tcp_free_md5sig_pool();
        }
index 3a23e30bc79e3689dc1f16fc9c16d0d76f820865..b542c875e154411cfaaf3d78abe443d9e5e4931d 100644 (file)
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/jhash.h>
 #include <net/ip.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
@@ -95,7 +96,7 @@ struct sfq_sched_data
 
 /* Variables */
        struct timer_list perturb_timer;
-       int             perturbation;
+       u32             perturbation;
        sfq_index       tail;           /* Index of current slot in round */
        sfq_index       max_depth;      /* Maximal depth */
 
@@ -109,12 +110,7 @@ struct sfq_sched_data
 
 static __inline__ unsigned sfq_fold_hash(struct sfq_sched_data *q, u32 h, u32 h1)
 {
-       int pert = q->perturbation;
-
-       /* Have we any rotation primitives? If not, WHY? */
-       h ^= (h1<<pert) ^ (h1>>(0x1F - pert));
-       h ^= h>>10;
-       return h & 0x3FF;
+       return jhash_2words(h, h1, q->perturbation) & (SFQ_HASH_DIVISOR - 1);
 }
 
 static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
@@ -256,6 +252,13 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                q->ht[hash] = x = q->dep[SFQ_DEPTH].next;
                q->hash[x] = hash;
        }
+       /* If selected queue has length q->limit, this means that
+        * all another queues are empty and that we do simple tail drop,
+        * i.e. drop _this_ packet.
+        */
+       if (q->qs[x].qlen >= q->limit)
+               return qdisc_drop(skb, sch);
+
        sch->qstats.backlog += skb->len;
        __skb_queue_tail(&q->qs[x], skb);
        sfq_inc(q, x);
@@ -294,6 +297,19 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc* sch)
        }
        sch->qstats.backlog += skb->len;
        __skb_queue_head(&q->qs[x], skb);
+       /* If selected queue has length q->limit+1, this means that
+        * all another queues are empty and we do simple tail drop.
+        * This packet is still requeued at head of queue, tail packet
+        * is dropped.
+        */
+       if (q->qs[x].qlen > q->limit) {
+               skb = q->qs[x].prev;
+               __skb_unlink(skb, &q->qs[x]);
+               sch->qstats.drops++;
+               sch->qstats.backlog -= skb->len;
+               kfree_skb(skb);
+               return NET_XMIT_CN;
+       }
        sfq_inc(q, x);
        if (q->qs[x].qlen == 1) {               /* The flow is new */
                if (q->tail == SFQ_DEPTH) {     /* It is the first flow */
@@ -370,12 +386,10 @@ static void sfq_perturbation(unsigned long arg)
        struct Qdisc *sch = (struct Qdisc*)arg;
        struct sfq_sched_data *q = qdisc_priv(sch);
 
-       q->perturbation = net_random()&0x1F;
+       get_random_bytes(&q->perturbation, 4);
 
-       if (q->perturb_period) {
-               q->perturb_timer.expires = jiffies + q->perturb_period;
-               add_timer(&q->perturb_timer);
-       }
+       if (q->perturb_period)
+               mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
 }
 
 static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
@@ -391,7 +405,7 @@ static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
        q->quantum = ctl->quantum ? : psched_mtu(sch->dev);
        q->perturb_period = ctl->perturb_period*HZ;
        if (ctl->limit)
-               q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 2);
+               q->limit = min_t(u32, ctl->limit, SFQ_DEPTH - 1);
 
        qlen = sch->q.qlen;
        while (sch->q.qlen > q->limit)
@@ -400,8 +414,8 @@ static int sfq_change(struct Qdisc *sch, struct rtattr *opt)
 
        del_timer(&q->perturb_timer);
        if (q->perturb_period) {
-               q->perturb_timer.expires = jiffies + q->perturb_period;
-               add_timer(&q->perturb_timer);
+               mod_timer(&q->perturb_timer, jiffies + q->perturb_period);
+               get_random_bytes(&q->perturbation, 4);
        }
        sch_tree_unlock(sch);
        return 0;
@@ -423,12 +437,13 @@ static int sfq_init(struct Qdisc *sch, struct rtattr *opt)
                q->dep[i+SFQ_DEPTH].next = i+SFQ_DEPTH;
                q->dep[i+SFQ_DEPTH].prev = i+SFQ_DEPTH;
        }
-       q->limit = SFQ_DEPTH - 2;
+       q->limit = SFQ_DEPTH - 1;
        q->max_depth = 0;
        q->tail = SFQ_DEPTH;
        if (opt == NULL) {
                q->quantum = psched_mtu(sch->dev);
                q->perturb_period = 0;
+               get_random_bytes(&q->perturbation, 4);
        } else {
                int err = sfq_change(sch, opt);
                if (err)
index 7d44453dfae13a43a4e4a1a72e077ff644d96661..b09eb9036a17a3563e9ad5ca08a1734b86aa0df5 100644 (file)
@@ -777,9 +777,6 @@ static ssize_t sock_aio_write(struct kiocb *iocb, const struct iovec *iov,
        if (pos != 0)
                return -ESPIPE;
 
-       if (iocb->ki_left == 0) /* Match SYS5 behaviour */
-               return 0;
-
        x = alloc_sock_iocb(iocb, &siocb);
        if (!x)
                return -ENOMEM;