From fe875358a6cd01c4599e321dd6dc767b11c42eac Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 24 Nov 2008 13:37:05 +0200 Subject: [MTD] [NAND] OMAP: OneNAND: header file relocation Signed-off-by: Adrian Hunter Signed-off-by: David Woodhouse --- drivers/mtd/onenand/omap2.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c index e39b21d3e16..28034ef08a8 100644 --- a/drivers/mtd/onenand/omap2.c +++ b/drivers/mtd/onenand/omap2.c @@ -35,16 +35,16 @@ #include #include -#include -#include -#include -#include +#include +#include +#include +#include #include #include -#include +#include -#include +#include #define DRIVER_NAME "omap2-onenand" -- cgit v1.2.3-18-g5258 From eccdaeafaea3ed115068ba55d01f22e486e5437d Mon Sep 17 00:00:00 2001 From: Petr Tesarik Date: Mon, 24 Nov 2008 15:46:31 +0100 Subject: posix-cpu-timers: fix clock_gettime with CLOCK_PROCESS_CPUTIME_ID Since CLOCK_PROCESS_CPUTIME_ID is in fact translated to -6, the switch statement in cpu_clock_sample_group() must first mask off the irrelevant bits, similar to cpu_clock_sample(). Signed-off-by: Petr Tesarik Signed-off-by: Thomas Gleixner -- posix-cpu-timers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- kernel/posix-cpu-timers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c index 895337b16a2..4e5288a831d 100644 --- a/kernel/posix-cpu-timers.c +++ b/kernel/posix-cpu-timers.c @@ -311,7 +311,7 @@ static int cpu_clock_sample_group(const clockid_t which_clock, struct task_cputime cputime; thread_group_cputime(p, &cputime); - switch (which_clock) { + switch (CPUCLOCK_WHICH(which_clock)) { default: return -EINVAL; case CPUCLOCK_PROF: -- cgit v1.2.3-18-g5258 From cbbd695687caab1082a70d2ae81153fdba7e851c Mon Sep 17 00:00:00 2001 From: Adrian Hunter Date: Mon, 24 Nov 2008 14:44:36 +0200 Subject: [MTD] [NAND] OMAP: OneNAND: header file relocation (part 2) Include and , not files from Signed-off-by: Adrian Hunter Signed-off-by: David Woodhouse --- drivers/mtd/onenand/omap2.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c index 28034ef08a8..a7e4d985f5e 100644 --- a/drivers/mtd/onenand/omap2.c +++ b/drivers/mtd/onenand/omap2.c @@ -32,16 +32,15 @@ #include #include #include +#include +#include -#include #include #include #include #include #include -#include -#include #include #include -- cgit v1.2.3-18-g5258 From a3d3f73ccbd68b3557c4aaf9f6246ea21d922835 Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Wed, 26 Nov 2008 10:23:25 +0000 Subject: [MTD] m25p80: fix detection of SPI parts Commit d0e8c47c58575b9131e786edb488fd029eba443e ("m25p80.c extended jedec support") added support for extended ids but in the process managed to break detection of all flashes. The ext jedec id check was inserted into an if statement that lacked braces, and it did not add the required braces. As such, the detection routine always returns the first entry in the SPI flash list. Signed-off-by: Mike Frysinger Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/devices/m25p80.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c index 76a76751da3..a298fed6ab0 100644 --- a/drivers/mtd/devices/m25p80.c +++ b/drivers/mtd/devices/m25p80.c @@ -574,10 +574,11 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi) for (tmp = 0, info = m25p_data; tmp < ARRAY_SIZE(m25p_data); tmp++, info++) { - if (info->jedec_id == jedec) + if (info->jedec_id == jedec) { if (ext_jedec != 0 && info->ext_id != ext_jedec) continue; return info; + } } dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec); return NULL; -- cgit v1.2.3-18-g5258 From 9168ab861ae3eb8942da61d884a5c1980ba98a5f Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Wed, 26 Nov 2008 10:23:35 +0000 Subject: [MTD] m25p80: fix detection of m25p16 flashes Commit d0e8c47c58575b9131e786edb488fd029eba443e ("m25p80.c extended jedec support") added support for extended ids but seems to break on flashes which don't have an extended id defined. If the table does not have an extid defined, then we should ignore it. Signed-off-by: Mike Frysinger Signed-off-by: Michael Hennerich Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/devices/m25p80.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c index a298fed6ab0..6188fd4ddcc 100644 --- a/drivers/mtd/devices/m25p80.c +++ b/drivers/mtd/devices/m25p80.c @@ -575,7 +575,7 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi) tmp < ARRAY_SIZE(m25p_data); tmp++, info++) { if (info->jedec_id == jedec) { - if (ext_jedec != 0 && info->ext_id != ext_jedec) + if (info->ext_id != 0 && info->ext_id != ext_jedec) continue; return info; } -- cgit v1.2.3-18-g5258 From 7854643a91eade84112dca9768eeb8d32463d101 Mon Sep 17 00:00:00 2001 From: Chen Gong Date: Wed, 26 Nov 2008 10:23:57 +0000 Subject: [MTD] m25p80: chip erase != block erase != sector erase This fixes broken terminology added in the "m25p80.c erase enhance" patch, which added a chip erase command but called it "block erase". There are already two block erase commands; blocks are 4KiB or 32KiB. There's also a sector erase (usually 64 KiB). Chip erase typically covers Megabytes. OPCODE_BE ==> OPCODE_CHIP_ERASE erase_block ==> erase_chip [dbrownell@users.sourceforge.net: update sector erase comments too ] Signed-off-by: Chen Gong Signed-off-by: David Brownell Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/devices/m25p80.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c index 6188fd4ddcc..6659b2275c0 100644 --- a/drivers/mtd/devices/m25p80.c +++ b/drivers/mtd/devices/m25p80.c @@ -37,9 +37,9 @@ #define OPCODE_NORM_READ 0x03 /* Read data bytes (low frequency) */ #define OPCODE_FAST_READ 0x0b /* Read data bytes (high frequency) */ #define OPCODE_PP 0x02 /* Page program (up to 256 bytes) */ -#define OPCODE_BE_4K 0x20 /* Erase 4KiB block */ +#define OPCODE_BE_4K 0x20 /* Erase 4KiB block */ #define OPCODE_BE_32K 0x52 /* Erase 32KiB block */ -#define OPCODE_BE 0xc7 /* Erase whole flash block */ +#define OPCODE_CHIP_ERASE 0xc7 /* Erase whole flash chip */ #define OPCODE_SE 0xd8 /* Sector erase (usually 64KiB) */ #define OPCODE_RDID 0x9f /* Read JEDEC ID */ @@ -167,7 +167,7 @@ static int wait_till_ready(struct m25p *flash) * * Returns 0 if successful, non-zero otherwise. */ -static int erase_block(struct m25p *flash) +static int erase_chip(struct m25p *flash) { DEBUG(MTD_DEBUG_LEVEL3, "%s: %s %dKiB\n", flash->spi->dev.bus_id, __func__, @@ -181,7 +181,7 @@ static int erase_block(struct m25p *flash) write_enable(flash); /* Set up command buffer. */ - flash->command[0] = OPCODE_BE; + flash->command[0] = OPCODE_CHIP_ERASE; spi_write(flash->spi, flash->command, 1); @@ -250,15 +250,18 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr) mutex_lock(&flash->lock); - /* REVISIT in some cases we could speed up erasing large regions - * by using OPCODE_SE instead of OPCODE_BE_4K - */ - - /* now erase those sectors */ - if (len == flash->mtd.size && erase_block(flash)) { + /* whole-chip erase? */ + if (len == flash->mtd.size && erase_chip(flash)) { instr->state = MTD_ERASE_FAILED; mutex_unlock(&flash->lock); return -EIO; + + /* REVISIT in some cases we could speed up erasing large regions + * by using OPCODE_SE instead of OPCODE_BE_4K. We may have set up + * to use "small sector erase", but that's not always optimal. + */ + + /* "sector"-at-a-time erase */ } else { while (len) { if (erase_sector(flash, addr)) { -- cgit v1.2.3-18-g5258 From 3136e903fa2d493ebc1b8a8fbdde2d3a17f85acd Mon Sep 17 00:00:00 2001 From: Atsushi Nemoto Date: Wed, 26 Nov 2008 10:26:29 +0000 Subject: [MTD] physmap: fix memory leak on physmap_flash_remove by using devres physmap_flash_remove releases only last memory region. This causes memory leak if multiple resources were provided. This patch fixes this leakage by using devm_ functions. Signed-off-by: Atsushi Nemoto Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/maps/physmap.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c index 42d844f8f6b..dfbf3f270ce 100644 --- a/drivers/mtd/maps/physmap.c +++ b/drivers/mtd/maps/physmap.c @@ -19,7 +19,7 @@ #include #include #include -#include +#include #define MAX_RESOURCES 4 @@ -27,7 +27,6 @@ struct physmap_flash_info { struct mtd_info *mtd[MAX_RESOURCES]; struct mtd_info *cmtd; struct map_info map[MAX_RESOURCES]; - struct resource *res; #ifdef CONFIG_MTD_PARTITIONS int nr_parts; struct mtd_partition *parts; @@ -70,16 +69,7 @@ static int physmap_flash_remove(struct platform_device *dev) #endif map_destroy(info->mtd[i]); } - - if (info->map[i].virt != NULL) - iounmap(info->map[i].virt); - } - - if (info->res != NULL) { - release_resource(info->res); - kfree(info->res); } - return 0; } @@ -101,7 +91,8 @@ static int physmap_flash_probe(struct platform_device *dev) if (physmap_data == NULL) return -ENODEV; - info = kzalloc(sizeof(struct physmap_flash_info), GFP_KERNEL); + info = devm_kzalloc(&dev->dev, sizeof(struct physmap_flash_info), + GFP_KERNEL); if (info == NULL) { err = -ENOMEM; goto err_out; @@ -114,10 +105,10 @@ static int physmap_flash_probe(struct platform_device *dev) (unsigned long long)(dev->resource[i].end - dev->resource[i].start + 1), (unsigned long long)dev->resource[i].start); - info->res = request_mem_region(dev->resource[i].start, - dev->resource[i].end - dev->resource[i].start + 1, - dev->dev.bus_id); - if (info->res == NULL) { + if (!devm_request_mem_region(&dev->dev, + dev->resource[i].start, + dev->resource[i].end - dev->resource[i].start + 1, + dev->dev.bus_id)) { dev_err(&dev->dev, "Could not reserve memory region\n"); err = -ENOMEM; goto err_out; @@ -129,7 +120,8 @@ static int physmap_flash_probe(struct platform_device *dev) info->map[i].bankwidth = physmap_data->width; info->map[i].set_vpp = physmap_data->set_vpp; - info->map[i].virt = ioremap(info->map[i].phys, info->map[i].size); + info->map[i].virt = devm_ioremap(&dev->dev, info->map[i].phys, + info->map[i].size); if (info->map[i].virt == NULL) { dev_err(&dev->dev, "Failed to ioremap flash region\n"); err = EIO; -- cgit v1.2.3-18-g5258 From 29b65861fbece04cfdf3fee352d5247369131850 Mon Sep 17 00:00:00 2001 From: Wolfgang Grandegger Date: Thu, 27 Nov 2008 09:46:13 +0000 Subject: [MTD] [NAND] fsl_upm: fix build problem with 2.6.28-rc2 The patch fixes following build error: CC drivers/mtd/nand/fsl_upm.o drivers/mtd/nand/fsl_upm.c: In function 'fun_chip_init': drivers/mtd/nand/fsl_upm.c:168: warning: passing argument 2 of 'of_mtd_parse_partitions' from incompatible pointer type drivers/mtd/nand/fsl_upm.c:168: warning: passing argument 3 of 'of_mtd_parse_partitions' from incompatible pointer type drivers/mtd/nand/fsl_upm.c:168: error: too many arguments to function 'of_mtd_parse_partitions' make[1]: *** [drivers/mtd/nand/fsl_upm.o] Error 1 The breakage was introduced in 69fd3a8d098faf41a04930afa83757c0555ee360 ("[MTD] remove unused mtd parameter in of_mtd_parse_partitions()"). While at it, also add a check for the of_mtd_parse_partitions() return value. Signed-off-by: Wolfgang Grandegger Signed-off-by: Anton Vorontsov Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/nand/fsl_upm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c index 024e3fffd4b..a83192f80eb 100644 --- a/drivers/mtd/nand/fsl_upm.c +++ b/drivers/mtd/nand/fsl_upm.c @@ -163,9 +163,11 @@ static int __devinit fun_chip_init(struct fsl_upm_nand *fun, ret = parse_mtd_partitions(&fun->mtd, part_types, &fun->parts, 0); #ifdef CONFIG_MTD_OF_PARTS - if (ret == 0) - ret = of_mtd_parse_partitions(fun->dev, &fun->mtd, - flash_np, &fun->parts); + if (ret == 0) { + ret = of_mtd_parse_partitions(fun->dev, flash_np, &fun->parts); + if (ret < 0) + goto err; + } #endif if (ret > 0) ret = add_mtd_partitions(&fun->mtd, fun->parts, ret); -- cgit v1.2.3-18-g5258 From 7b1dedca42ac0d0d0be01e39d8461bb53a2389b3 Mon Sep 17 00:00:00 2001 From: Thomas Bogendoerfer Date: Sat, 29 Nov 2008 13:46:27 +0100 Subject: x86: fix dma_mapping_error for 32bit x86 Devices like b44 ethernet can't dma from addresses above 1GB. The driver handles this cases by falling back to GFP_DMA allocation. But for detecting the problem it needs to get an indication from dma_mapping_error. The bug is triggered by using a VMSPLIT option of 2G/2G. Signed-off-by: Thomas Bogendoerfer Acked-by: FUJITA Tomonori Signed-off-by: Ingo Molnar --- arch/x86/include/asm/dma-mapping.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/arch/x86/include/asm/dma-mapping.h b/arch/x86/include/asm/dma-mapping.h index 7f225a4b2a2..097794ff6b7 100644 --- a/arch/x86/include/asm/dma-mapping.h +++ b/arch/x86/include/asm/dma-mapping.h @@ -71,15 +71,13 @@ static inline struct dma_mapping_ops *get_dma_ops(struct device *dev) /* Make sure we keep the same behaviour */ static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr) { -#ifdef CONFIG_X86_32 - return 0; -#else +#ifdef CONFIG_X86_64 struct dma_mapping_ops *ops = get_dma_ops(dev); if (ops->mapping_error) return ops->mapping_error(dev, dma_addr); - return (dma_addr == bad_dma_address); #endif + return (dma_addr == bad_dma_address); } #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f) -- cgit v1.2.3-18-g5258 From 43714539eab42b2fa3653ea7bd667b36c2291b11 Mon Sep 17 00:00:00 2001 From: Mahesh Salgaonkar Date: Sat, 29 Nov 2008 16:50:12 +0530 Subject: sched: don't export sched_mc_power_savings in laptops Impact: do not expose a control that has no effect Fix to prevent sched_mc_power_saving from being exported through sysfs on single-socket systems. (Say multicore single socket (Laptop)) CPU core map of the boot cpu should be equal to possible number of cpus for single socket system. This fix has been developed at FOSS.in kernel workout. Signed-off-by: Mahesh Salgaonkar Acked-by: Peter Zijlstra Signed-off-by: Ingo Molnar --- arch/x86/include/asm/topology.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 4850e4b02b6..ff386ff50ed 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -239,7 +239,7 @@ struct pci_bus; void set_pci_bus_resources_arch_default(struct pci_bus *b); #ifdef CONFIG_SMP -#define mc_capable() (boot_cpu_data.x86_max_cores > 1) +#define mc_capable() (cpus_weight(per_cpu(cpu_core_map, 0)) != nr_cpu_ids) #define smt_capable() (smp_num_siblings > 1) #endif -- cgit v1.2.3-18-g5258 From 02d43b1d13a0a55a75bb5c5f98d2b13dbe71ecf9 Mon Sep 17 00:00:00 2001 From: Mathieu Desnoyers Date: Mon, 1 Dec 2008 05:46:38 -0500 Subject: documentation: local_ops fix on_each_cpu Impact: update code example in documentation * Dr. David Alan Gilbert (dave@treblig.org) wrote: [...] > I noticed while looking at something else that the example in > local_ops.txt still has the 4 operand on_each_cpu in the latest git; > I don't know the rest of the code around there very well so I thought > it best to mention it rather than post a patch. Reported-by: Dr. David Alan Gilbert Signed-off-by: Mathieu Desnoyers Signed-off-by: Ingo Molnar --- Documentation/local_ops.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/local_ops.txt b/Documentation/local_ops.txt index f4f8b1c6c8b..23045b8b50f 100644 --- a/Documentation/local_ops.txt +++ b/Documentation/local_ops.txt @@ -149,7 +149,7 @@ static void do_test_timer(unsigned long data) int cpu; /* Increment the counters */ - on_each_cpu(test_each, NULL, 0, 1); + on_each_cpu(test_each, NULL, 1); /* Read all the counters */ printk("Counters read from CPU %d\n", smp_processor_id()); for_each_online_cpu(cpu) { -- cgit v1.2.3-18-g5258 From 020f97063dd68a8e3b9aac928ac49a438b7416ce Mon Sep 17 00:00:00 2001 From: Russell King Date: Mon, 1 Dec 2008 17:40:54 +0000 Subject: [ARM] omap: fix a pile of issues This patch fixes a number of sillies, from missing 'const' to using 'return' in void functions, to functions with no arguments not even 'void' and a cast which isn't required. Acked-by: Tony Lindgren Signed-off-by: Russell King --- arch/arm/mach-omap1/io.c | 2 +- arch/arm/plat-omap/include/mach/omapfb.h | 4 ++-- arch/arm/plat-omap/sram.c | 8 ++++---- drivers/video/omap/omapfb_main.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/arch/arm/mach-omap1/io.c b/arch/arm/mach-omap1/io.c index b3bd8ca8511..4c3e582f3d3 100644 --- a/arch/arm/mach-omap1/io.c +++ b/arch/arm/mach-omap1/io.c @@ -128,7 +128,7 @@ void __init omap1_map_common_io(void) * Common low-level hardware init for omap1. This should only get called from * board specific init. */ -void __init omap1_init_common_hw() +void __init omap1_init_common_hw(void) { /* REVISIT: Refer to OMAP5910 Errata, Advisory SYS_1: "Timeout Abort * on a Posted Write in the TIPB Bridge". diff --git a/arch/arm/plat-omap/include/mach/omapfb.h b/arch/arm/plat-omap/include/mach/omapfb.h index ec67fb42860..7b74d1255e0 100644 --- a/arch/arm/plat-omap/include/mach/omapfb.h +++ b/arch/arm/plat-omap/include/mach/omapfb.h @@ -353,8 +353,8 @@ struct omapfb_device { u32 pseudo_palette[17]; struct lcd_panel *panel; /* LCD panel */ - struct lcd_ctrl *ctrl; /* LCD controller */ - struct lcd_ctrl *int_ctrl; /* internal LCD ctrl */ + const struct lcd_ctrl *ctrl; /* LCD controller */ + const struct lcd_ctrl *int_ctrl; /* internal LCD ctrl */ struct lcd_ctrl_extif *ext_if; /* LCD ctrl external interface */ struct device *dev; diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c index 9f9a921829c..dcd9d16da2e 100644 --- a/arch/arm/plat-omap/sram.c +++ b/arch/arm/plat-omap/sram.c @@ -255,7 +255,7 @@ void omap_sram_reprogram_clock(u32 dpllctl, u32 ckctl) if (!_omap_sram_reprogram_clock) omap_sram_error(); - return _omap_sram_reprogram_clock(dpllctl, ckctl); + _omap_sram_reprogram_clock(dpllctl, ckctl); } int __init omap1_sram_init(void) @@ -282,8 +282,8 @@ void omap2_sram_ddr_init(u32 *slow_dll_ctrl, u32 fast_dll_ctrl, if (!_omap2_sram_ddr_init) omap_sram_error(); - return _omap2_sram_ddr_init(slow_dll_ctrl, fast_dll_ctrl, - base_cs, force_unlock); + _omap2_sram_ddr_init(slow_dll_ctrl, fast_dll_ctrl, + base_cs, force_unlock); } static void (*_omap2_sram_reprogram_sdrc)(u32 perf_level, u32 dll_val, @@ -294,7 +294,7 @@ void omap2_sram_reprogram_sdrc(u32 perf_level, u32 dll_val, u32 mem_type) if (!_omap2_sram_reprogram_sdrc) omap_sram_error(); - return _omap2_sram_reprogram_sdrc(perf_level, dll_val, mem_type); + _omap2_sram_reprogram_sdrc(perf_level, dll_val, mem_type); } static u32 (*_omap2_set_prcm)(u32 dpll_ctrl_val, u32 sdrc_rfr_val, int bypass); diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c index 5a5e407dc45..1a49519dafa 100644 --- a/drivers/video/omap/omapfb_main.c +++ b/drivers/video/omap/omapfb_main.c @@ -392,7 +392,7 @@ static void set_fb_fix(struct fb_info *fbi) int bpp; rg = &plane->fbdev->mem_desc.region[plane->idx]; - fbi->screen_base = (char __iomem *)rg->vaddr; + fbi->screen_base = rg->vaddr; fix->smem_start = rg->paddr; fix->smem_len = rg->size; -- cgit v1.2.3-18-g5258 From d94762989103b5e29938d8a7b0112e72c4633265 Mon Sep 17 00:00:00 2001 From: Julia Lawall Date: Mon, 1 Dec 2008 23:00:55 +0100 Subject: [MTD] [NAND] drivers/mtd/nand/pasemi_nand.c: Add missing pci_dev_put pci_get_device increments a reference count that should be decremented using pci_dev_put. The semantic patch that finds the problem is as follows: (http://www.emn.fr/x-info/coccinelle/) // @r exists@ local idexpression x; statement S,S1; position p1,p2,p3; expression E,E1; type T,T1; expression *ptr != NULL; @@ ( if ((x@p1 = pci_get_device(...)) == NULL) S | x@p1 = pci_get_device(...); ) ... when != pci_dev_put(...,(T)x,...) when != if (...) { <+... pci_dev_put(...,(T)x,...) ...+> } when != true x == NULL || ... when != x = E when != E = (T)x when any ( if (x == NULL || ...) S1 | if@p2 (...) { ... when != pci_dev_put(...,(T1)x,...) when != if (...) { <+... pci_dev_put(...,(T1)x,...) ...+> } when != x = E1 when != E1 = (T1)x ( return \(0\|<+...x...+>\|ptr\); | return@p3 ...; ) } ) @ script:python @ p1 << r.p1; p3 << r.p3; @@ print "* file: %s pci_get_device: %s return: %s" % (p1[0].file,p1[0].line,p3[0].line) // Signed-off-by: Julia Lawall Acked-by: Olof Johansson Signed-off-by: David Woodhouse --- drivers/mtd/nand/pasemi_nand.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/nand/pasemi_nand.c b/drivers/mtd/nand/pasemi_nand.c index 75c89903902..9bd6c9ac844 100644 --- a/drivers/mtd/nand/pasemi_nand.c +++ b/drivers/mtd/nand/pasemi_nand.c @@ -141,6 +141,7 @@ static int __devinit pasemi_nand_probe(struct of_device *ofdev, } lpcctl = pci_resource_start(pdev, 0); + pci_dev_put(pdev); if (!request_region(lpcctl, 4, driver_name)) { err = -EBUSY; -- cgit v1.2.3-18-g5258 From 82676d76252680fc035247fd4cfdb07ffce5db52 Mon Sep 17 00:00:00 2001 From: Saeed Bishara Date: Thu, 27 Nov 2008 06:21:03 -1100 Subject: [ARM] Orion: fix bug in pcie configuration cycle function field mask The function field is 3 bits. Signed-off-by: Saeed Bishara Signed-off-by: Nicolas Pitre --- arch/arm/plat-orion/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/plat-orion/pcie.c b/arch/arm/plat-orion/pcie.c index 883902fead8..d41d41d78ad 100644 --- a/arch/arm/plat-orion/pcie.c +++ b/arch/arm/plat-orion/pcie.c @@ -35,7 +35,7 @@ #define PCIE_CONF_REG(r) ((((r) & 0xf00) << 16) | ((r) & 0xfc)) #define PCIE_CONF_BUS(b) (((b) & 0xff) << 16) #define PCIE_CONF_DEV(d) (((d) & 0x1f) << 11) -#define PCIE_CONF_FUNC(f) (((f) & 0x3) << 8) +#define PCIE_CONF_FUNC(f) (((f) & 0x7) << 8) #define PCIE_CONF_DATA_OFF 0x18fc #define PCIE_MASK_OFF 0x1910 #define PCIE_CTRL_OFF 0x1a00 -- cgit v1.2.3-18-g5258 From d5654efd3ff1cd0baa935a0c9a5d89862f07d009 Mon Sep 17 00:00:00 2001 From: Wei Yongjun Date: Wed, 3 Dec 2008 00:27:18 -0800 Subject: xfrm: Fix kernel panic when flush and dump SPD entries After flush the SPD entries, dump the SPD entries will cause kernel painc. Used the following commands to reproduct: - echo 'spdflush;' | setkey -c - echo 'spdadd 3ffe:501:ffff:ff01::/64 3ffe:501:ffff:ff04::/64 any -P out ipsec \ ah/tunnel/3ffe:501:ffff:ff00:200:ff:fe00:b0b0-3ffe:501:ffff:ff02:200:ff:fe00:a1a1/require;\ spddump;' | setkey -c - echo 'spdflush; spddump;' | setkey -c - echo 'spdadd 3ffe:501:ffff:ff01::/64 3ffe:501:ffff:ff04::/64 any -P out ipsec \ ah/tunnel/3ffe:501:ffff:ff00:200:ff:fe00:b0b0-3ffe:501:ffff:ff02:200:ff:fe00:a1a1/require;\ spddump;' | setkey -c This is because when flush the SPD entries, the SPD entry is not remove from the list. This patch fix the problem by remove the SPD entry from the list. Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller --- net/xfrm/xfrm_policy.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index 058f04f54b9..fb216c9adf8 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -817,6 +817,7 @@ int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info) continue; hlist_del(&pol->bydst); hlist_del(&pol->byidx); + list_del(&pol->walk.all); write_unlock_bh(&xfrm_policy_lock); xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, -- cgit v1.2.3-18-g5258 From efba01803c8570bab11d0d6188a630231d0ddccf Mon Sep 17 00:00:00 2001 From: Michael Chan Date: Wed, 3 Dec 2008 00:36:15 -0800 Subject: bnx2: Add workaround to handle missed MSI. The bnx2 chips do not support per MSI vector masking. On 5706/5708, new MSI address/data are stored only when the MSI enable bit is toggled. As a result, SMP affinity no longer works in the latest kernel. A more serious problem is that the driver will no longer receive interrupts when the MSI receiving CPU goes offline. The workaround in this patch only addresses the problem of CPU going offline. When that happens, the driver's timer function will detect that it is making no forward progress on pending interrupt events and will recover from it. Eric Dumazet reported the problem. We also found that if an interrupt is internally asserted while MSI and INTA are disabled, the chip will end up in the same state after MSI is re-enabled. The same workaround is needed for this problem. Signed-off-by: Michael Chan Tested-by: Eric Dumazet Signed-off-by: David S. Miller --- drivers/net/bnx2.c | 35 ++++++++++++++++++++++++++++++++--- drivers/net/bnx2.h | 6 ++++++ 2 files changed, 38 insertions(+), 3 deletions(-) diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c index d07e3f14895..a1a3d0e5d2b 100644 --- a/drivers/net/bnx2.c +++ b/drivers/net/bnx2.c @@ -3144,6 +3144,28 @@ bnx2_has_work(struct bnx2_napi *bnapi) return 0; } +static void +bnx2_chk_missed_msi(struct bnx2 *bp) +{ + struct bnx2_napi *bnapi = &bp->bnx2_napi[0]; + u32 msi_ctrl; + + if (bnx2_has_work(bnapi)) { + msi_ctrl = REG_RD(bp, BNX2_PCICFG_MSI_CONTROL); + if (!(msi_ctrl & BNX2_PCICFG_MSI_CONTROL_ENABLE)) + return; + + if (bnapi->last_status_idx == bp->idle_chk_status_idx) { + REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl & + ~BNX2_PCICFG_MSI_CONTROL_ENABLE); + REG_WR(bp, BNX2_PCICFG_MSI_CONTROL, msi_ctrl); + bnx2_msi(bp->irq_tbl[0].vector, bnapi); + } + } + + bp->idle_chk_status_idx = bnapi->last_status_idx; +} + static void bnx2_poll_link(struct bnx2 *bp, struct bnx2_napi *bnapi) { struct status_block *sblk = bnapi->status_blk.msi; @@ -3218,14 +3240,15 @@ static int bnx2_poll(struct napi_struct *napi, int budget) work_done = bnx2_poll_work(bp, bnapi, work_done, budget); - if (unlikely(work_done >= budget)) - break; - /* bnapi->last_status_idx is used below to tell the hw how * much work has been processed, so we must read it before * checking for more work. */ bnapi->last_status_idx = sblk->status_idx; + + if (unlikely(work_done >= budget)) + break; + rmb(); if (likely(!bnx2_has_work(bnapi))) { netif_rx_complete(bp->dev, napi); @@ -4570,6 +4593,8 @@ bnx2_init_chip(struct bnx2 *bp) for (i = 0; i < BNX2_MAX_MSIX_VEC; i++) bp->bnx2_napi[i].last_status_idx = 0; + bp->idle_chk_status_idx = 0xffff; + bp->rx_mode = BNX2_EMAC_RX_MODE_SORT_MODE; /* Set up how to generate a link change interrupt. */ @@ -5718,6 +5743,10 @@ bnx2_timer(unsigned long data) if (atomic_read(&bp->intr_sem) != 0) goto bnx2_restart_timer; + if ((bp->flags & (BNX2_FLAG_USING_MSI | BNX2_FLAG_ONE_SHOT_MSI)) == + BNX2_FLAG_USING_MSI) + bnx2_chk_missed_msi(bp); + bnx2_send_heart_beat(bp); bp->stats_blk->stat_FwRxDrop = diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h index 617d9534016..0b032c3c7b6 100644 --- a/drivers/net/bnx2.h +++ b/drivers/net/bnx2.h @@ -378,6 +378,9 @@ struct l2_fhdr { * pci_config_l definition * offset: 0000 */ +#define BNX2_PCICFG_MSI_CONTROL 0x00000058 +#define BNX2_PCICFG_MSI_CONTROL_ENABLE (1L<<16) + #define BNX2_PCICFG_MISC_CONFIG 0x00000068 #define BNX2_PCICFG_MISC_CONFIG_TARGET_BYTE_SWAP (1L<<2) #define BNX2_PCICFG_MISC_CONFIG_TARGET_MB_WORD_SWAP (1L<<3) @@ -6863,6 +6866,9 @@ struct bnx2 { u8 num_tx_rings; u8 num_rx_rings; + + u32 idle_chk_status_idx; + }; #define REG_RD(bp, offset) \ -- cgit v1.2.3-18-g5258 From d25830e5507f6bc815f5dd7e2eb65f172e878a2b Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Wed, 3 Dec 2008 00:37:04 -0800 Subject: netlabel: Fix a potential NULL pointer dereference Fix a potential NULL pointer dereference seen when trying to remove a static label configuration with an invalid address/mask combination. Signed-off-by: Paul Moore Signed-off-by: David S. Miller --- net/netlabel/netlabel_unlabeled.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index e8a5c32b0f1..90c8506a0aa 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -574,9 +574,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, &iface->addr4_list); spin_unlock(&netlbl_unlhsh_lock); - if (list_entry == NULL) + if (list_entry != NULL) + entry = netlbl_unlhsh_addr4_entry(list_entry); + else ret_val = -ENOENT; - entry = netlbl_unlhsh_addr4_entry(list_entry); audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, audit_info); @@ -634,9 +635,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, spin_lock(&netlbl_unlhsh_lock); list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); spin_unlock(&netlbl_unlhsh_lock); - if (list_entry == NULL) + if (list_entry != NULL) + entry = netlbl_unlhsh_addr6_entry(list_entry); + else ret_val = -ENOENT; - entry = netlbl_unlhsh_addr6_entry(list_entry); audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, audit_info); -- cgit v1.2.3-18-g5258 From ee4ee527278a66321301d4f1f5ae22e49ab18fad Mon Sep 17 00:00:00 2001 From: Chris Torek Date: Wed, 3 Dec 2008 00:47:28 -0800 Subject: sparc64: Fix bug in PTRACE_SETFPREGS64 handling. From: Chris Torek >The SPARC64 kernel code for PTRACE_SETFPREGS64 appears to be an exact copy >of that for PTRACE_GETFPREGS64. This means that gdbserver and native >64-bit GDB cannot set floating-point registers. It looks like a simple typo. Signed-off-by: David S. Miller --- arch/sparc64/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c index f43adbc773c..a941c610e7c 100644 --- a/arch/sparc64/kernel/ptrace.c +++ b/arch/sparc64/kernel/ptrace.c @@ -1014,7 +1014,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data) break; case PTRACE_SETFPREGS64: - ret = copy_regset_to_user(child, view, REGSET_FP, + ret = copy_regset_from_user(child, view, REGSET_FP, 0 * sizeof(u64), 33 * sizeof(u64), fps); -- cgit v1.2.3-18-g5258 From 70d7d357578245f1993fd2d3ccd26088bcd38941 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Tue, 2 Dec 2008 20:16:03 +0100 Subject: x86: fix broken flushing in GART nofullflush path Impact: remove stale IOTLB entries In the non-default nofullflush case the GART is only flushed when next_bit wraps around. But it can happen that an unmap operation unmaps memory which is behind the current next_bit location. If these addresses are reused it may result in stale GART IO/TLB entries. Fix this by setting the GART next_bit always behind an unmapped location. Signed-off-by: Joerg Roedel Signed-off-by: Ingo Molnar --- arch/x86/kernel/pci-gart_64.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c index a42b02b4df6..ba7ad83e20a 100644 --- a/arch/x86/kernel/pci-gart_64.c +++ b/arch/x86/kernel/pci-gart_64.c @@ -123,6 +123,8 @@ static void free_iommu(unsigned long offset, int size) spin_lock_irqsave(&iommu_bitmap_lock, flags); iommu_area_free(iommu_gart_bitmap, offset, size); + if (offset >= next_bit) + next_bit = offset + size; spin_unlock_irqrestore(&iommu_bitmap_lock, flags); } -- cgit v1.2.3-18-g5258 From 201955463a5c1a70d3f70d1598b27e4c2c402642 Mon Sep 17 00:00:00 2001 From: Roel Kluin Date: Tue, 2 Dec 2008 22:55:38 +0100 Subject: check_hung_task(): unsigned sysctl_hung_task_warnings cannot be less than 0 Impact: fix warnings-limit cutoff check for debug feature unsigned sysctl_hung_task_warnings cannot be less than 0 Signed-off-by: Roel Kluin Signed-off-by: Ingo Molnar --- kernel/softlockup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/softlockup.c b/kernel/softlockup.c index 3953e4aed73..dc0b3be6b7d 100644 --- a/kernel/softlockup.c +++ b/kernel/softlockup.c @@ -188,7 +188,7 @@ static void check_hung_task(struct task_struct *t, unsigned long now) if ((long)(now - t->last_switch_timestamp) < sysctl_hung_task_timeout_secs) return; - if (sysctl_hung_task_warnings < 0) + if (!sysctl_hung_task_warnings) return; sysctl_hung_task_warnings--; -- cgit v1.2.3-18-g5258 From e93f1be503efd0e44e46fc1fd4c13dbee72a6561 Mon Sep 17 00:00:00 2001 From: "Denis V. Lunev" Date: Wed, 3 Dec 2008 10:47:20 +0000 Subject: [MTD] [NAND] fix OOPS accessing flash operations over STM flash on PXA STM 2Gb flash is a large-page NAND flash. Set operations accordingly. This field is dereferenced without a check in several places resulting in OOPS. Signed-off-by: Denis V. Lunev Acked-by: Eric Miao Signed-off-by: Andrew Morton Signed-off-by: David Woodhouse --- drivers/mtd/nand/pxa3xx_nand.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c index c0fa9c9edf0..15f0a26730a 100644 --- a/drivers/mtd/nand/pxa3xx_nand.c +++ b/drivers/mtd/nand/pxa3xx_nand.c @@ -269,6 +269,7 @@ static struct pxa3xx_nand_timing stm2GbX16_timing = { static struct pxa3xx_nand_flash stm2GbX16 = { .timing = &stm2GbX16_timing, + .cmdset = &largepage_cmdset, .page_per_block = 64, .page_size = 2048, .flash_width = 16, -- cgit v1.2.3-18-g5258 From eac9fbc6a90ab3440f4d98a8c52b15a724fc6f4f Mon Sep 17 00:00:00 2001 From: Richard Kennedy Date: Mon, 24 Nov 2008 13:53:24 +0000 Subject: AMD IOMMU: struct amd_iommu remove padding on 64 bit Remove 16 bytes of padding from struct amd_iommu on 64bit builds reducing its size to 120 bytes, allowing it to span one fewer cachelines. Signed-off-by: Richard Kennedy Signed-off-by: Joerg Roedel --- arch/x86/include/asm/amd_iommu_types.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/amd_iommu_types.h b/arch/x86/include/asm/amd_iommu_types.h index 1a30c0440c6..ac302a2fa33 100644 --- a/arch/x86/include/asm/amd_iommu_types.h +++ b/arch/x86/include/asm/amd_iommu_types.h @@ -251,13 +251,6 @@ struct amd_iommu { /* Pointer to PCI device of this IOMMU */ struct pci_dev *dev; - /* - * Capability pointer. There could be more than one IOMMU per PCI - * device function if there are more than one AMD IOMMU capability - * pointers. - */ - u16 cap_ptr; - /* physical address of MMIO space */ u64 mmio_phys; /* virtual address of MMIO space */ @@ -266,6 +259,13 @@ struct amd_iommu { /* capabilities of that IOMMU read from ACPI */ u32 cap; + /* + * Capability pointer. There could be more than one IOMMU per PCI + * device function if there are more than one AMD IOMMU capability + * pointers. + */ + u16 cap_ptr; + /* pci domain of this IOMMU */ u16 pci_seg; @@ -284,19 +284,19 @@ struct amd_iommu { /* size of command buffer */ u32 cmd_buf_size; - /* event buffer virtual address */ - u8 *evt_buf; /* size of event buffer */ u32 evt_buf_size; + /* event buffer virtual address */ + u8 *evt_buf; /* MSI number for event interrupt */ u16 evt_msi_num; - /* if one, we need to send a completion wait command */ - int need_sync; - /* true if interrupts for this IOMMU are already enabled */ bool int_enabled; + /* if one, we need to send a completion wait command */ + int need_sync; + /* default dma_ops domain for that IOMMU */ struct dma_ops_domain *default_dom; }; -- cgit v1.2.3-18-g5258 From f91ba190648be4ff127d6aaf3993ac19d66dc2c2 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Tue, 25 Nov 2008 12:56:12 +0100 Subject: AMD IOMMU: set device table entry for aliased devices In some rare cases a request can arrive an IOMMU with its originial requestor id even it is aliased. Handle this by setting the device table entry to the same protection domain for the original and the aliased requestor id. Signed-off-by: Joerg Roedel --- arch/x86/kernel/amd_iommu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c index e4899e0e878..a232e5a85d4 100644 --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -858,6 +858,9 @@ static int get_device_resources(struct device *dev, print_devid(_bdf, 1); } + if (domain_for_device(_bdf) == NULL) + set_device_domain(*iommu, *domain, _bdf); + return 1; } -- cgit v1.2.3-18-g5258 From 09ee17eb8ea89514c13980c4010bdbbaea8630c2 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Wed, 3 Dec 2008 12:19:27 +0100 Subject: AMD IOMMU: fix possible race while accessing iommu->need_sync The access to the iommu->need_sync member needs to be protected by the iommu->lock. Otherwise this is a possible race condition. Fix it with this patch. Signed-off-by: Joerg Roedel --- arch/x86/kernel/amd_iommu.c | 33 +++++++++++++-------------------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c index a232e5a85d4..5662e226b0c 100644 --- a/arch/x86/kernel/amd_iommu.c +++ b/arch/x86/kernel/amd_iommu.c @@ -187,6 +187,8 @@ static int iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd) spin_lock_irqsave(&iommu->lock, flags); ret = __iommu_queue_command(iommu, cmd); + if (!ret) + iommu->need_sync = 1; spin_unlock_irqrestore(&iommu->lock, flags); return ret; @@ -210,10 +212,13 @@ static int iommu_completion_wait(struct amd_iommu *iommu) cmd.data[0] = CMD_COMPL_WAIT_INT_MASK; CMD_SET_TYPE(&cmd, CMD_COMPL_WAIT); - iommu->need_sync = 0; - spin_lock_irqsave(&iommu->lock, flags); + if (!iommu->need_sync) + goto out; + + iommu->need_sync = 0; + ret = __iommu_queue_command(iommu, &cmd); if (ret) @@ -254,8 +259,6 @@ static int iommu_queue_inv_dev_entry(struct amd_iommu *iommu, u16 devid) ret = iommu_queue_command(iommu, &cmd); - iommu->need_sync = 1; - return ret; } @@ -281,8 +284,6 @@ static int iommu_queue_inv_iommu_pages(struct amd_iommu *iommu, ret = iommu_queue_command(iommu, &cmd); - iommu->need_sync = 1; - return ret; } @@ -762,8 +763,6 @@ static void set_device_domain(struct amd_iommu *iommu, write_unlock_irqrestore(&amd_iommu_devtable_lock, flags); iommu_queue_inv_dev_entry(iommu, devid); - - iommu->need_sync = 1; } /***************************************************************************** @@ -1034,8 +1033,7 @@ static dma_addr_t map_single(struct device *dev, phys_addr_t paddr, if (addr == bad_dma_address) goto out; - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); out: spin_unlock_irqrestore(&domain->lock, flags); @@ -1063,8 +1061,7 @@ static void unmap_single(struct device *dev, dma_addr_t dma_addr, __unmap_single(iommu, domain->priv, dma_addr, size, dir); - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); spin_unlock_irqrestore(&domain->lock, flags); } @@ -1130,8 +1127,7 @@ static int map_sg(struct device *dev, struct scatterlist *sglist, goto unmap; } - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); out: spin_unlock_irqrestore(&domain->lock, flags); @@ -1176,8 +1172,7 @@ static void unmap_sg(struct device *dev, struct scatterlist *sglist, s->dma_address = s->dma_length = 0; } - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); spin_unlock_irqrestore(&domain->lock, flags); } @@ -1228,8 +1223,7 @@ static void *alloc_coherent(struct device *dev, size_t size, goto out; } - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); out: spin_unlock_irqrestore(&domain->lock, flags); @@ -1260,8 +1254,7 @@ static void free_coherent(struct device *dev, size_t size, __unmap_single(iommu, domain->priv, dma_addr, size, DMA_BIDIRECTIONAL); - if (unlikely(iommu->need_sync)) - iommu_completion_wait(iommu); + iommu_completion_wait(iommu); spin_unlock_irqrestore(&domain->lock, flags); -- cgit v1.2.3-18-g5258 From 9ea84ad77d635bdb76c9a08f44f21a9af98359ee Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Tue, 2 Dec 2008 07:21:21 +0100 Subject: oprofile: fix CPU unplug panic in ppro_stop() If oprofile statically compiled in kernel, a cpu unplug triggers a panic in ppro_stop(), because a NULL pointer is dereferenced. Signed-off-by: Eric Dumazet Signed-off-by: Robert Richter --- arch/x86/oprofile/op_model_ppro.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c index 716d26f0e5d..e9f80c744cf 100644 --- a/arch/x86/oprofile/op_model_ppro.c +++ b/arch/x86/oprofile/op_model_ppro.c @@ -156,6 +156,8 @@ static void ppro_start(struct op_msrs const * const msrs) unsigned int low, high; int i; + if (!reset_value) + return; for (i = 0; i < num_counters; ++i) { if (reset_value[i]) { CTRL_READ(low, high, msrs, i); @@ -171,6 +173,8 @@ static void ppro_stop(struct op_msrs const * const msrs) unsigned int low, high; int i; + if (!reset_value) + return; for (i = 0; i < num_counters; ++i) { if (!reset_value[i]) continue; -- cgit v1.2.3-18-g5258 From 3d337c653c94be50f11a45fb14a2afa8a8a1a618 Mon Sep 17 00:00:00 2001 From: William Cohen Date: Sun, 30 Nov 2008 15:39:10 -0500 Subject: x86/oprofile: fix Intel cpu family 6 detection Alan Jenkins wrote: > This is on an EeePC 701, /proc/cpuinfo as attached. > > Is this expected? Will the next release work? > > Thanks, Alan > > # opcontrol --setup --no-vmlinux > cpu_type 'unset' is not valid > you should upgrade oprofile or force the use of timer mode > > # opcontrol -v > opcontrol: oprofile 0.9.4 compiled on Nov 29 2008 22:44:10 > > # cat /dev/oprofile/cpu_type > i386/p6 > # uname -r > 2.6.28-rc6eeepc Hi Alan, Looking at the kernel driver code for oprofile it can return the "i386/p6" for the cpu_type. However, looking at the user-space oprofile code there isn't the matching entry in libop/op_cpu_type.c or the events/unit_mask files in events/i386 directory. The Intel AP-485 says this is a "Intel Pentium M processor model D". Seems like the oprofile kernel driver should be identifying the processor as "i386/p6_mobile" The driver identification code doesn't look quite right in nmi_init.c http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git;a=blob;f=arch/x86/oprofile/nmi_int.c;h=022cd41ea9b4106e5884277096e80e9088a7c7a9;hb=HEAD has: 409 case 10 ... 13: 410 *cpu_type = "i386/p6"; 411 break; Referring to the Intel AP-485: case 10 and 11 should produce "i386/piii" case 13 should produce "i386/p6_mobile" I didn't see anything for case 12. Something like the attached patch. I don't have a celeron machine to verify that changes in this area of the kernel fix thing. -Will Signed-off-by: William Cohen Tested-by: Alan Jenkins Acked-by: Andi Kleen Signed-off-by: Robert Richter --- arch/x86/oprofile/nmi_int.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c index 022cd41ea9b..202864ad49a 100644 --- a/arch/x86/oprofile/nmi_int.c +++ b/arch/x86/oprofile/nmi_int.c @@ -401,14 +401,13 @@ static int __init ppro_init(char **cpu_type) *cpu_type = "i386/pii"; break; case 6 ... 8: + case 10 ... 11: *cpu_type = "i386/piii"; break; case 9: + case 13: *cpu_type = "i386/p6_mobile"; break; - case 10 ... 13: - *cpu_type = "i386/p6"; - break; case 14: *cpu_type = "i386/core"; break; -- cgit v1.2.3-18-g5258 From bd7df219202f44e71e2e975a0fb5f76f946c1aef Mon Sep 17 00:00:00 2001 From: "remi.denis-courmont@nokia" Date: Mon, 1 Dec 2008 02:37:20 +0000 Subject: Phonet: do not dump addresses from other namespaces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Rémi Denis-Courmont Signed-off-by: David S. Miller --- net/phonet/pn_netlink.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c index b1770d66bc8..242fe8f8c32 100644 --- a/net/phonet/pn_netlink.c +++ b/net/phonet/pn_netlink.c @@ -123,6 +123,7 @@ nla_put_failure: static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb) { + struct net *net = sock_net(skb->sk); struct phonet_device *pnd; int dev_idx = 0, dev_start_idx = cb->args[0]; int addr_idx = 0, addr_start_idx = cb->args[1]; @@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb) list_for_each_entry(pnd, &pndevs.list, list) { u8 addr; + if (!net_eq(dev_net(pnd->netdev), net)) + continue; if (dev_idx > dev_start_idx) addr_start_idx = 0; if (dev_idx++ < dev_start_idx) -- cgit v1.2.3-18-g5258 From d253eee20195b25e298bf162a6e72f14bf4803e5 Mon Sep 17 00:00:00 2001 From: Oliver Hartkopp Date: Wed, 3 Dec 2008 15:52:35 -0800 Subject: can: Fix CAN_(EFF|RTR)_FLAG handling in can_filter Due to a wrong safety check in af_can.c it was not possible to filter for SFF frames with a specific CAN identifier without getting the same selected CAN identifier from a received EFF frame also. This fix has a minimum (but user visible) impact on the CAN filter API and therefore the CAN version is set to a new date. Indeed the 'old' API is still working as-is. But when now setting CAN_(EFF|RTR)_FLAG in can_filter.can_mask you might get less traffic than before - but still the stuff that you expected to get for your defined filter ... Thanks to Kurt Van Dijck for pointing at this issue and for the review. Signed-off-by: Oliver Hartkopp Acked-by: Kurt Van Dijck Signed-off-by: David S. Miller --- include/linux/can/core.h | 2 +- net/can/af_can.c | 63 ++++++++++++++++++++++++++++++++++++------------ net/can/bcm.c | 7 +++--- 3 files changed, 53 insertions(+), 19 deletions(-) diff --git a/include/linux/can/core.h b/include/linux/can/core.h index e9ca210ffa5..f50785ad478 100644 --- a/include/linux/can/core.h +++ b/include/linux/can/core.h @@ -19,7 +19,7 @@ #include #include -#define CAN_VERSION "20071116" +#define CAN_VERSION "20081130" /* increment this number each time you change some user-space interface */ #define CAN_ABI_VERSION "8" diff --git a/net/can/af_can.c b/net/can/af_can.c index 7d4d2b3c137..d8173e50cb8 100644 --- a/net/can/af_can.c +++ b/net/can/af_can.c @@ -319,23 +319,52 @@ static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev) return n ? d : NULL; } +/** + * find_rcv_list - determine optimal filterlist inside device filter struct + * @can_id: pointer to CAN identifier of a given can_filter + * @mask: pointer to CAN mask of a given can_filter + * @d: pointer to the device filter struct + * + * Description: + * Returns the optimal filterlist to reduce the filter handling in the + * receive path. This function is called by service functions that need + * to register or unregister a can_filter in the filter lists. + * + * A filter matches in general, when + * + * & mask == can_id & mask + * + * so every bit set in the mask (even CAN_EFF_FLAG, CAN_RTR_FLAG) describe + * relevant bits for the filter. + * + * The filter can be inverted (CAN_INV_FILTER bit set in can_id) or it can + * filter for error frames (CAN_ERR_FLAG bit set in mask). For error frames + * there is a special filterlist and a special rx path filter handling. + * + * Return: + * Pointer to optimal filterlist for the given can_id/mask pair. + * Constistency checked mask. + * Reduced can_id to have a preprocessed filter compare value. + */ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, struct dev_rcv_lists *d) { canid_t inv = *can_id & CAN_INV_FILTER; /* save flag before masking */ - /* filter error frames */ + /* filter for error frames in extra filterlist */ if (*mask & CAN_ERR_FLAG) { - /* clear CAN_ERR_FLAG in list entry */ + /* clear CAN_ERR_FLAG in filter entry */ *mask &= CAN_ERR_MASK; return &d->rx[RX_ERR]; } - /* ensure valid values in can_mask */ - if (*mask & CAN_EFF_FLAG) - *mask &= (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG); - else - *mask &= (CAN_SFF_MASK | CAN_RTR_FLAG); + /* with cleared CAN_ERR_FLAG we have a simple mask/value filterpair */ + +#define CAN_EFF_RTR_FLAGS (CAN_EFF_FLAG | CAN_RTR_FLAG) + + /* ensure valid values in can_mask for 'SFF only' frame filtering */ + if ((*mask & CAN_EFF_FLAG) && !(*can_id & CAN_EFF_FLAG)) + *mask &= (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS); /* reduce condition testing at receive time */ *can_id &= *mask; @@ -348,15 +377,19 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, if (!(*mask)) return &d->rx[RX_ALL]; - /* use extra filterset for the subscription of exactly *ONE* can_id */ - if (*can_id & CAN_EFF_FLAG) { - if (*mask == (CAN_EFF_MASK | CAN_EFF_FLAG)) { - /* RFC: a use-case for hash-tables in the future? */ - return &d->rx[RX_EFF]; + /* extra filterlists for the subscription of a single non-RTR can_id */ + if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS) + && !(*can_id & CAN_RTR_FLAG)) { + + if (*can_id & CAN_EFF_FLAG) { + if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) { + /* RFC: a future use-case for hash-tables? */ + return &d->rx[RX_EFF]; + } + } else { + if (*mask == (CAN_SFF_MASK | CAN_EFF_RTR_FLAGS)) + return &d->rx_sff[*can_id]; } - } else { - if (*mask == CAN_SFF_MASK) - return &d->rx_sff[*can_id]; } /* default: filter via can_id/can_mask */ diff --git a/net/can/bcm.c b/net/can/bcm.c index d0dd382001e..da0d426c0ce 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -64,10 +64,11 @@ #define BCM_CAN_DLC_MASK 0x0F /* clean private flags in can_dlc by masking */ /* get best masking value for can_rx_register() for a given single can_id */ -#define REGMASK(id) ((id & CAN_RTR_FLAG) | ((id & CAN_EFF_FLAG) ? \ - (CAN_EFF_MASK | CAN_EFF_FLAG) : CAN_SFF_MASK)) +#define REGMASK(id) ((id & CAN_EFF_FLAG) ? \ + (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ + (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) -#define CAN_BCM_VERSION "20080415" +#define CAN_BCM_VERSION CAN_VERSION static __initdata const char banner[] = KERN_INFO "can: broadcast manager protocol (rev " CAN_BCM_VERSION ")\n"; -- cgit v1.2.3-18-g5258 From e8e8e80ee047b131a0cd6a3e96e0f8dfa14f6d99 Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Wed, 3 Dec 2008 16:04:52 -0800 Subject: sparc: asm/bitops.h should define __fls bitops_64.h includes the generic one; pretty sure 32 should too. (Found by using __fls in generic code and breaking sparc defconfig build: thanks Stephen and linux-next!) Signed-off-by: Rusty Russell Signed-off-by: David S. Miller --- arch/sparc/include/asm/bitops_32.h | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/sparc/include/asm/bitops_32.h b/arch/sparc/include/asm/bitops_32.h index 68b98a7e645..9cf4ae0cd7b 100644 --- a/arch/sparc/include/asm/bitops_32.h +++ b/arch/sparc/include/asm/bitops_32.h @@ -98,6 +98,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr) #include #include #include +#include #include #include #include -- cgit v1.2.3-18-g5258 From 8711cca2251f1fc3beb870a75ff847bb55225490 Mon Sep 17 00:00:00 2001 From: James Morris Date: Thu, 4 Dec 2008 03:19:45 +1100 Subject: MAINTAINERS: Add security subsystem maintainer Add myself as overall maintainer of the security subsystem (generally, components under the top-level security directory). This addresses the lack of an official maintainer for the increasing number of security projects being incorporated into the kernel. Signed-off-by: James Morris Acked-by: Chris Wright Signed-off-by: Linus Torvalds --- MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/MAINTAINERS b/MAINTAINERS index 8f2b67ea054..24741de12a3 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -3759,6 +3759,15 @@ M: drzeus-sdhci@drzeus.cx L: sdhci-devel@list.drzeus.cx S: Maintained +SECURITY SUBSYSTEM +F: security/ +P: James Morris +M: jmorris@namei.org +L: linux-kernel@vger.kernel.org +L: linux-security-module@vger.kernel.org (suggested Cc:) +T: git kernel.org:pub/scm/linux/kernel/git/jmorris/security-testing-2.6.git +S: Supported + SECURITY CONTACT P: Security Officers M: security@kernel.org -- cgit v1.2.3-18-g5258 From 004b50f4ed2accb56069d56714a32484f8b83ec0 Mon Sep 17 00:00:00 2001 From: David Howells Date: Wed, 3 Dec 2008 16:33:14 +0000 Subject: MN10300: Introduce barriers to replace removed volatiles in gdbstub 16550 driver Introduce into the MN10300 gdbstub 16550 driver a couple of barrier() calls to replace the removed volatility of the input/output index variables for the Rx ring buffer. A previous patch added them into the on-chip serial port driver. Signed-off-by: David Howells Signed-off-by: Linus Torvalds --- arch/mn10300/kernel/gdb-io-serial.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/mn10300/kernel/gdb-io-serial.c b/arch/mn10300/kernel/gdb-io-serial.c index 9a6d4e8ebe7..11584c51acd 100644 --- a/arch/mn10300/kernel/gdb-io-serial.c +++ b/arch/mn10300/kernel/gdb-io-serial.c @@ -99,6 +99,7 @@ int gdbstub_io_rx_char(unsigned char *_ch, int nonblock) try_again: /* pull chars out of the buffer */ ix = gdbstub_rx_outp; + barrier(); if (ix == gdbstub_rx_inp) { if (nonblock) return -EAGAIN; @@ -110,6 +111,7 @@ int gdbstub_io_rx_char(unsigned char *_ch, int nonblock) ch = gdbstub_rx_buffer[ix++]; st = gdbstub_rx_buffer[ix++]; + barrier(); gdbstub_rx_outp = ix & 0x00000fff; if (st & UART_LSR_BI) { -- cgit v1.2.3-18-g5258 From a7f014f2de04893f95cfe40fe35f15c8dae4b36e Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Tue, 25 Nov 2008 14:02:05 -0800 Subject: drm/i915: Respect GM965/GM45 bit-17-instead-of-bit-11 option for swizzling. This fixes readpixels and buffer corruption when swapped out and in by disabling tiling on them. Now that we know that the bit 17 mode isn't just a mistake of older chipsets, we'll need to work on a clever fix so that we can get the performance of tiling on these chipsets, but that will require intrusive changes targeted at the next kernel release, not this one. Signed-off-by: Eric Anholt Signed-off-by: Dave Airlie --- drivers/gpu/drm/i915/i915_gem_tiling.c | 7 ++++--- drivers/gpu/drm/i915/i915_reg.h | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c index e8b85ac4ca0..a8cb69469c6 100644 --- a/drivers/gpu/drm/i915/i915_gem_tiling.c +++ b/drivers/gpu/drm/i915/i915_gem_tiling.c @@ -119,9 +119,10 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev) dcc & DCC_CHANNEL_XOR_DISABLE) { swizzle_x = I915_BIT_6_SWIZZLE_9_10; swizzle_y = I915_BIT_6_SWIZZLE_9; - } else if (IS_I965GM(dev) || IS_GM45(dev)) { - /* GM965 only does bit 11-based channel - * randomization + } else if ((IS_I965GM(dev) || IS_GM45(dev)) && + (dcc & DCC_CHANNEL_XOR_BIT_17) == 0) { + /* GM965/GM45 does either bit 11 or bit 17 + * swizzling. */ swizzle_x = I915_BIT_6_SWIZZLE_9_10_11; swizzle_y = I915_BIT_6_SWIZZLE_9_11; diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h index 0e476eba36e..9d24aaeb8a4 100644 --- a/drivers/gpu/drm/i915/i915_reg.h +++ b/drivers/gpu/drm/i915/i915_reg.h @@ -522,6 +522,7 @@ #define DCC_ADDRESSING_MODE_DUAL_CHANNEL_INTERLEAVED (2 << 0) #define DCC_ADDRESSING_MODE_MASK (3 << 0) #define DCC_CHANNEL_XOR_DISABLE (1 << 10) +#define DCC_CHANNEL_XOR_BIT_17 (1 << 9) /** 965 MCH register controlling DRAM channel configuration */ #define C0DRB3 0x10206 -- cgit v1.2.3-18-g5258 From ce44b0ea3dc04236d852d78a06f850d1f7b03f3d Mon Sep 17 00:00:00 2001 From: Eric Anholt Date: Thu, 6 Nov 2008 16:00:31 -0800 Subject: drm/i915: Move flushing list cleanup from flush request retire to request emit. obj_priv->write_domain is "write domain if the GPU went idle now", not "write domain at this moment." By postponing the clear, we confused the concept, required more storage, and potentially emitted more flushes than are required. Signed-off-by: Eric Anholt Signed-off-by: Dave Airlie --- drivers/gpu/drm/i915/i915_drv.h | 11 ++++-- drivers/gpu/drm/i915/i915_gem.c | 73 ++++++++++++++++++++---------------- drivers/gpu/drm/i915/i915_gem_proc.c | 5 +-- 3 files changed, 50 insertions(+), 39 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h index 0a4f39b9a0e..76d9a706d8f 100644 --- a/drivers/gpu/drm/i915/i915_drv.h +++ b/drivers/gpu/drm/i915/i915_drv.h @@ -244,6 +244,10 @@ typedef struct drm_i915_private { * List of objects currently involved in rendering from the * ringbuffer. * + * Includes buffers having the contents of their GPU caches + * flushed, not necessarily primitives. last_rendering_seqno + * represents when the rendering involved will be completed. + * * A reference is held on the buffer while on this list. */ struct list_head active_list; @@ -253,6 +257,8 @@ typedef struct drm_i915_private { * still have a write_domain which needs to be flushed before * unbinding. * + * last_rendering_seqno is 0 while an object is in this list. + * * A reference is held on the buffer while on this list. */ struct list_head flushing_list; @@ -261,6 +267,8 @@ typedef struct drm_i915_private { * LRU list of objects which are not in the ringbuffer and * are ready to unbind, but are still in the GTT. * + * last_rendering_seqno is 0 while an object is in this list. + * * A reference is not held on the buffer while on this list, * as merely being GTT-bound shouldn't prevent its being * freed, and we'll pull it off the list in the free path. @@ -394,9 +402,6 @@ struct drm_i915_gem_request { /** Time at which this request was emitted, in jiffies. */ unsigned long emitted_jiffies; - /** Cache domains that were flushed at the start of the request. */ - uint32_t flush_domains; - struct list_head list; }; diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index d58ddef468f..9fd28ebe0aa 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -532,7 +532,7 @@ i915_gem_object_free_page_list(struct drm_gem_object *obj) } static void -i915_gem_object_move_to_active(struct drm_gem_object *obj) +i915_gem_object_move_to_active(struct drm_gem_object *obj, uint32_t seqno) { struct drm_device *dev = obj->dev; drm_i915_private_t *dev_priv = dev->dev_private; @@ -546,8 +546,20 @@ i915_gem_object_move_to_active(struct drm_gem_object *obj) /* Move from whatever list we were on to the tail of execution. */ list_move_tail(&obj_priv->list, &dev_priv->mm.active_list); + obj_priv->last_rendering_seqno = seqno; } +static void +i915_gem_object_move_to_flushing(struct drm_gem_object *obj) +{ + struct drm_device *dev = obj->dev; + drm_i915_private_t *dev_priv = dev->dev_private; + struct drm_i915_gem_object *obj_priv = obj->driver_private; + + BUG_ON(!obj_priv->active); + list_move_tail(&obj_priv->list, &dev_priv->mm.flushing_list); + obj_priv->last_rendering_seqno = 0; +} static void i915_gem_object_move_to_inactive(struct drm_gem_object *obj) @@ -562,6 +574,7 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj) else list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list); + obj_priv->last_rendering_seqno = 0; if (obj_priv->active) { obj_priv->active = 0; drm_gem_object_unreference(obj); @@ -610,10 +623,28 @@ i915_add_request(struct drm_device *dev, uint32_t flush_domains) request->seqno = seqno; request->emitted_jiffies = jiffies; - request->flush_domains = flush_domains; was_empty = list_empty(&dev_priv->mm.request_list); list_add_tail(&request->list, &dev_priv->mm.request_list); + /* Associate any objects on the flushing list matching the write + * domain we're flushing with our flush. + */ + if (flush_domains != 0) { + struct drm_i915_gem_object *obj_priv, *next; + + list_for_each_entry_safe(obj_priv, next, + &dev_priv->mm.flushing_list, list) {