USB: open disconnect race in usblcd

this driver has a possible use after free due to a race when disconnect
and open handle intfdata without a lock.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: disconnect open race in legousbtower

again, possible use after free due to touching intfdata without lock.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: open disconnect race in iowarrior

the driver sets intfdata to NULL without lock. Data structures can be
freed and accessed.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: missing error check in emi62

the emi62 also lacks an error check.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: missing error check in emi26

this drivers lacks an error check.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: usb_serial_resume bug fix

Avoid potential null pointer dereference.

Signed-off-by: Sarah Sharp <sarah.a.sharp@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: remove new OHCI build warnings

Remove various newly-introduced compiler warnings for OHCI.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: amd5536udc - remove set_mwi() compiler warning

Get rid of pointless pci_set_mwi() compiler warning.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: usbserial - fix potential deadlock between write() and IRQ

USB: usbserial - fix potential deadlock between write() and IRQ

usb_serial_generic_write() doesn't disable interrupts when taking port->lock,
and could therefore deadlock with usb_serial_generic_read_bulk_callback()
being called from interrupt, taking the same lock. Fix it.

Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Acked-by: Larry Finger <larry.finger@lwfinger.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

usb: serial/pl2303: support for IO Data Device RSAQ5

This patch adds support for the IO Data Device USB-RSAQ5, PL2303 based
USB-serial converter, to pl2303 driver

Signed-off-by: Masakazu Mokuno <mokuno@sm.sony.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: fix read vs. disconnect race in cytherm driver

the disconnect method of this driver set intfdata to NULL before
removing attribute files. The attributes' read methods will happily
follow the NULL pointer. Here's the correct ordering.

Signed-off-by : Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: fix locking in idmouse

Pete caused me to lock at buggy drivers in this respect. The idmouse has
a race between open and disconnect. This patch

- solves the open/disconnect race
- switches locking to mutexes

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: fix interface sysfs file-creation bug

This patch (as1005) fixes a rather subtle problem.  When
usb_set_configuration() registers the interfaces and their files in
sysfs, it doesn't expect those files to exist already.  But when an
interface is registered, its driver may call usb_set_interface() and
thereby cause the sysfs files to be created.  The result is an error
when usb_set_configuration() goes on to create those same files again.

The (not-so-great) solution is to have usb_set_configuration() remove
any existing files before creating them.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: fix ssb_ohci_probe() build bug

fix ssb_ohci_probe() build bug:

 drivers/built-in.o: In function `ssb_ohci_probe':
 ohci-hcd.c:(.text+0xbff39): undefined reference to `ssb_device_enable'
 ohci-hcd.c:(.text+0xbff6f): undefined reference to `ssb_admatch_base'
 ohci-hcd.c:(.text+0xbff8b): undefined reference to `ssb_admatch_size'
 ohci-hcd.c:(.text+0xbffe5): undefined reference to `ssb_device_disable'
 [...]

the reason was that this Kconfig combination was allowed:

 CONFIG_SSB=m
 CONFIG_USB_OHCI_HCD=y
 CONFIG_USB_OHCI_HCD_SSB=y

the fix is to require a modular USB_OHCI_HCD build when SSB is modular.

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: pl2303: remove can't happen checks, set speed properly and report baud rate

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: mos7840: Clean up old checks and stuff

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB rio500.c: fix check-after-use

The Coverity checker spotted that we have already oops'ed if "dev"
was NULL in these places.

Since "dev" being NULL isn't possible at these places this patch removes
the NULL checks.

Additionally, I've fixed the formatting of the if's.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB iowarrior.c: fix check-after-use

The Coverity checker spotted that we have already oops'ed if "dev"
was NULL.

Since "dev" being NULL doesn't seem to be possible here this patch
removes the NULL check.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: add URB_FREE_BUFFER to permissible flags

URB_FREE_BUFFER needs to be allowed in the sanity checks to use drivers that
use that flag.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: isd200: sort out USB/IDE dependancy mess

The ISD200 driver imports a single trivial routine from the IDE layer and
in doing so creates a mess of dependancies that drag in the entire old
IDE layer. Even more sad - it does this for a routine which is usually
(little endian) a null function!

- Copy the function into ISD200
- Rename it so it doesn't clash with the ide header prototype
- Remove all the depend constraints

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: FTDI Elan driver: Convert ftdi->u132_lock to mutex

FTDI Elan driver: Convert the semaphore ftdi->u132_lock to the mutex
API

Signed-off-by: Matthias Kaehlcke <matthias.kaehlcke@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: fix scheduling of Iso URBs in uhci-hcd

This patch (as1003) changes uhci-hcd to treat the URB_ISO_ASAP flag
the same as other host controller drivers, namely, to schedule an Iso
URB for the first available time slot that hasn't already expired.
URBs in which the flag isn't set will be scheduled for the first slot
following the last URB, even if it has expired.

This fixes a problem reported by Martin Bachem.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: io_edgeport: cleanups, and tty speed reporting

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: ftd_sio cleanups and updates for new termios work checkpatch fixes

WARNING: line over 80 characters
#23: FILE: drivers/usb/serial/ftdi_sio.c:297:
+ speed_t force_baud; /* if non-zero, force the baud rate to this value */

ERROR: use tabs not spaces
#31: FILE: drivers/usb/serial/ftdi_sio.c:881:
+^I$

ERROR: use tabs not spaces
#39: FILE: drivers/usb/serial/ftdi_sio.c:890:
+^I$

WARNING: line over 80 characters
#111: FILE: drivers/usb/serial/ftdi_sio.c:1956:
+ tty_encode_baud_rate(port->tty, priv->force_baud, priv->force_baud);

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: ftd_sio: cleanups and updates for new termios work

- Remove can't happen tests
- Rework speed validation in terms of baud rates not CBAUD bits
- Report speed set (or chosen)
- Minor termios correctness

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: cp2101: convert to new termios

- Convert to new baud rate functions
- Add baud rate reporting

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: whiteheat: clean up can't happen checks and encode baud rate

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

usb-serial: handle NULL termios methods as "no hardware changing support"

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: sierra: termios

No hardware termios setting in this case so keep the old settings

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: option: termios handling

For the devices that have no hardware settings set up the termios return
properly.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: kobil_sct: termios encoding fixups

- Clear unsupported CMSPAR
- Encode resulting speeds

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: keyspan termios tidy

- Clear unsupported CMSPAR bit
- Clean up long chains of a->b-> a bit
- Encode baud rate back into tty structure properly

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: ir_usb: termios handling

- Clean up paranoia checks
- Propogate back a correct fixed termios

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: empeg: clean up and handle speeds

The empeg is pretty fixed. Tidy up the long foo->bar->baz stuff and
encode the fixed speed properly.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: digi_acceleport: fix termios and also readability a bit

- Expand some x&y to x & y so I could read it when checking
- Clear CMSPAR bit in the termios (as the driver does not support it)
- Encode the speed using the new tty_encode_baud_rate facility

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: ch341: fix termios handling

The ch341 currently doesn't support most of the hardware setting.  So to keep
the termios data right we propogate the old termios hardware values back then
encode the speed.

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

usb serial: kill another case we pass NULL and shouldn't

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: ark3116: update termios handling

- Set the i/ospeed in the initial termios properly

- Use the tty_encode_baud_rate functions to report resulting rates properly

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

serial: stop passing NULL to functions that expect data

Earlier patches have removed the checking for old v new differences from the
USB drivers so we can now pass in a valid blank old termios so that we don't
to fill the drivers with magic hacks for console support

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

USB: add new Novatel device ids to option driver

This adds support for the U727 and MC950 devices.

Cc: Rony Sarkis <rsarkis@nvtl.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

fix sg_phys to use dma_addr_t

x86_32 CONFIG_HIGHMEM64G with 5GB RAM hung when booting, after issuing
some "request_module: runaway loop modprobe binfmt-0000" messages in
trying to exec /sbin/init.

The binprm buf doesn't see the right ".ELF" header because sg_phys()
is providing the wrong physical addresses for high pages: a 32-bit
unsigned long is too small in this case, we need to use dma_addr_t.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

[netdrvr] forcedeth: add MCP77 device IDs

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

rndis_host: reduce MTU instead of refusing to talk to devices with low max packet size

This patch makes the host RNDIS driver talk to RNDIS devices with an MTU
less than 1.5k, instead of refusing to talk to such a device.

Signed-Off-by: Thomas Sailer <t.sailer@alumni.ethz.ch>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
--

Hi Jeff,
are you the right person to send this to?
Nobody else seems to be wanting to forward this to Linus...

Thanks,
Tom

Signed-off-by: Jeff Garzik <jeff@garzik.org>

cpmac: update to new fixed phy driver interface

Use fixed_mdio_get_phydev for obtaining fixed phy instances and adopt to
changed fixed phy device naming.

Signed-off-by: Eugene Konev <ejka@imfi.kspu.ru>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

cpmac: convert to napi_struct interface

Convert cpmac to new napi_struct API introduced by
bea3348eef27e6044b6161fd04c3152215f96411 [NET]: Make NAPI polling independent
of struct net_device objects.
Only disable rx interrupts if napi actually has been scheduled.

Signed-off-by: Eugene Konev <ejka@imfi.kspu.ru>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

cpmac: use print_mac() instead of MAC_FMT

Switch to using DECLARE_MAC_BUF/print_mac() added by commit
0795af5729b18218767fab27c44b1384f72dc9ad [NET]: Introduce and use print_mac()
and DECLARE_MAC_BUF().

Signed-off-by: Eugene Konev <ejka@imfi.kspu.ru>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

natsemi: fix oops, link back netdevice from private-struct

* Andrew Nelless <andrew@nelless.net> wrote:

> Hi,
>
> I booted up 2.6.24-rc1 this morning [Real early over a brew ;-)] and
> was having a problems with multiple ~5 second hangs on SATA/drive init
> (Something to do with "EH" something-or-other and resets but I'll
> email in separately about it later unless its fixed by the time I get
> the chance).
>
> Anyway, I went to fire up netconsole to get a decent log dump and hit
> across the following nasty. Netconsole works fine in 2.6.23.1 with a
> similar config and the same kernel parameters.
>
> A shot of the screen is the only method I could come up with to
> capture the log, I hope that is OK, it is pretty readable.
>
>
> The nasty:
> http://andotnet.nfshost.com/linux/2.6.24-rc1-netconsole-nullderef.jpg

the NULL dereference is here:

 (gdb) list *0xffffffff804a9504
 0xffffffff804a9504 is in natsemi_poll (drivers/net/natsemi.c:717).
 712             return count;
 713     }
 714
 715     static inline void __iomem *ns_ioaddr(struct net_device *dev)
 716     {
 717             return (void __iomem *) dev->base_addr;
 718     }
 719

which is this code from natsemi.c:

 2227            struct net_device *dev = np->dev;
 2228            void __iomem * ioaddr = ns_ioaddr(dev);
 2229            int work_done = 0;

seems like the NAPI changes in -rc1 added an np->dev field but forgot to
initialize it ...

does the patch below fix the oops for you?

Ingo

-------------------->
Subject: natsemi: fix oops, link back netdevice from private-struct
From: Ingo Molnar <mingo@elte.hu>

this commit:

  commit bea3348eef27e6044b6161fd04c3152215f96411
  Author: Stephen Hemminger <shemminger@linux-foundation.org>
  Date:   Wed Oct 3 16:41:36 2007 -0700

      [NET]: Make NAPI polling independent of struct net_device objects.

added np->dev to drivers/net/natsemi.c's struct netdev_private, but
forgot to initialize that new field upon driver init. The result was
a predictable NULL dereference oops the first time the hardware
generated an interrupt.

Reported-by: Andrew Nelless <andrew@nelless.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

ehea: fix port_napi_disable/enable

napi_disable / napi_enable must be applied on all ehea queues.

Signed-off-by: Jan-Bernd Themann <themann@de.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

bonding/bond_main.c: fix cut'n'paste error

This patch fixes a cut'n'paste error in
commit 1b76b31693d4a6088dec104ff6a6ead54081a3c2.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

make bonding/bond_main.c:bond_deinit() static

bond_deinit() can now become static.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

drivers/net/ipg.c: cleanups

This patch contains the following cleanups:
- make ipg_nic_get_stats() static
- move DefaultPhyParam[] from ipg.h to ipg.c and make it static

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

remove Documentation/networking/net-modules.txt

According to git, the only one who touched this file during the last
5 years was me when removing drivers...

modinfo offers less ancient information.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Paul Gortmaker <paul.gortmaker@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

ub: add sg_init_table for sense and read capacity commands

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

x86: pci-gart fix

map_sg could copy the last sg element to another position (if merging
some elements). It breaks sg chaining. This copies only
dma_address/length instead of the whole sg element.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

[libata] sata_nv: SWNCQ should not apply to MCP61

The mcp61 has bug with ncq.

Signed-off-by: Kuan Luo <kluo@nvidia.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

libata-core: Be a bit more relaxed about early DMA zero devices

I guess Windows didn't care about the command so neither did they

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

ahci: ahci: implement workaround for ASUS P5W-DH Deluxe ahci_broken_hardreset(), take #2

P5W-DH Deluxe has ICH9 which doesn't have PMP support but SIMG 4726
hardwired to the second port of AHCI controller at PCI device 1f.2.
The 4726 doesn't work as PMP but as a storage processor which can do
hardware RAID on downstream ports.

When no device is attached to the downstream port of the 4726, pseudo
ATA device for configuration appears.  Unfortunately, ATA emulation on
the device is very lousy and causes long hang during boot.

This patch implements workaround for the board.  If the mainboard is
P5W-DH Deluxe (matched using DMI), only hardreset is used on the
second port of AHCI controller @ 1f.2 and the hardreset doesn't depend
on receiving the first FIS and just proceed to IDENTIFY.

This workaround fixes bugzilla #8923.

  http://bugzilla.kernel.org/show_bug.cgi?id=8923

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix pata_icside build for recent libata API changes

Signed-off-by: Jeff Garzik <jeff@garzik.org>

libata: cosmetic clean up in ata_eh_reset()

Local variable @action usage in ata_eh_reset() is a bit confusing.
It's used only to cache ehc->i.action to test reset masks after
clearing it; however, due to the generic name "action", it's easy to
misinterpret the local variable as containing the selected reset
method later.  Also, the reason for caching the original value is easy
to miss.

This patch renames @action to @tmp_action and make it buffer newly
selected value instead to improve readability.

Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

libata-core.c: make 2 functions static

strn_pattern_cmp() and ata_port_detach() can become static.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

lguest: documentation update

Went through the documentation doing typo and content fixes.  This
patch contains only comment and whitespace changes.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

[libata] Create internal helper ata_dev_set_feature()

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

lguest: Add to maintainers file.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lguest: build fix

Fix this error (i386 !SMP build)

arch/x86/lguest/boot.c: In function ‘lguest_init’:
arch/x86/lguest/boot.c:1059: error: ‘pm_power_off’ undeclared (first use in this function)

by including linux/pm.h.

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lguest: clean up lguest_launcher.h

Remove now-unused defines.
Fix old idempotent #ifndef _ASM_LGUEST_USER name.
Fix comment on use of lguest_req.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lguest: remove unused "wake" element from struct lguest

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lguest: use defines from x86 headers instead of magic numbers

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lguest: example launcher header cleanup.

Now the kernel headers are clean for userspace export, we don't need
to typedef kernel types before including them.  We also don't need
pci_ids.h (that was from an earlier virtio draft).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

sched: mark CONFIG_FAIR_GROUP_SCHED as !EXPERIMENTAL

mark CONFIG_FAIR_GROUP_SCHED as !EXPERIMENTAL. All bugs have been
fixed and it's perfect ;-)

Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: isolate SMP balancing code a bit more

At the moment, a lot of load balancing code that is irrelevant to non
SMP systems gets included during non SMP builds.

This patch addresses this issue and reduces the binary size on non
SMP systems:

   text    data     bss     dec     hex filename
  10983      28    1192   12203    2fab sched.o.before
  10739      28    1192   11959    2eb7 sched.o.after

Signed-off-by: Peter Williams <pwil3058@bigpond.net.au>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: reduce balance-tasks overhead

At the moment, balance_tasks() provides low level functionality for both
  move_tasks() and move_one_task() (indirectly) via the load_balance()
function (in the sched_class interface) which also provides dual
functionality.  This dual functionality complicates the interfaces and
internal mechanisms and makes the run time overhead of operations that
are called with two run queue locks held.

This patch addresses this issue and reduces the overhead of these
operations.

Signed-off-by: Peter Williams <pwil3058@bigpond.net.au>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: make cpu_shares_{show,store}() static

cpu_shares_{show,store}() can become static.

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: clean up some control group code

- replace "cont" with "cgrp" in a few places in the CFS cgroup code,
- use write_uint rather than write for cpu.shares write function

Signed-off-by: Paul Menage <menage@google.com>
Acked-by : Srivatsa Vaddagiri <vatsa@linux.vnet.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: constify sched.h

Add const to some struct task_struct * uses

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: document profile=sleep requiring CONFIG_SCHEDSTATS

profile=sleep only works if CONFIG_SCHEDSTATS is set. This patch notes
the limitation in Documentation/kernel-parameters.txt and prints a
warning at boot-time if profile=sleep is used without CONFIG_SCHEDSTAT.

Signed-off-by: Mel Gorman <mel@csn.ul.ie>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: use show_regs() to improve __schedule_bug() output

A full register dump along with stack backtrace would make the
"scheduling while atomic" message more helpful. Use show_regs() instead
of dump_stack() for this. We already know we're atomic in here (that is
why this function was called) so show_regs()'s atomicity expectations
are guaranteed.

Also, modify the output of the "BUG: scheduling while atomic:" header a
bit to keep task->comm and task->pid together and preempt_count() after
them.

Signed-off-by: Satyam Sharma <satyam@infradead.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: clean up sched_domain_debug()

clean up sched_domain_debug().

this also shrinks the code a bit:

   text    data     bss     dec     hex filename
  50474    4306     480   55260    d7dc sched.o.before
  50404    4306     480   55190    d796 sched.o.after

Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: fix fastcall mismatch in completion APIs

Jeff Dike noticed that wait_for_completion_interruptible()'s prototype
had a mismatched fastcall.

Fix this by removing the fastcall attributes from all the completion APIs.

Found-by: Jeff Dike <jdike@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

sched: fix sched_domain sysctl registration again

commit  029190c515f15f512ac85de8fc686d4dbd0ae731 (cpuset
sched_load_balance flag) was not tested SCHED_DEBUG enabled as
committed as it dereferences NULL when used and it reordered
the sysctl registration to cause it to never show any domains
or their tunables.

Fixes:

1) restore arch_init_sched_domains ordering
we can't walk the domains before we build them

presently we register cpus with empty directories (no domain
directories or files).

2) make unregister_sched_domain_sysctl do nothing when already unregistered
detach_destroy_domains is now called one set of cpus at a time
unregister_syctl dereferences NULL if called with a null.

While the the function would always dereference null if called
twice, in the previous code it was always called once and then
was followed a register.  So only the hidden bug of the
sysctl_root_table not being allocated followed by an attempt to
free it would have shown the error.

3) always call unregister and register in partition_sched_domains
The code is "smart" about unregistering only needed domains.
Since we aren't guaranteed any calls to unregister, always
unregister.   Without calling register on the way out we
will not have a table or any sysctl tree.

4) warn if register is called without unregistering
The previous table memory is lost, leaving pointers to the
later freed memory in sysctl and leaking the memory of the
tables.

Before this patch on a 2-core 4-thread box compiled for SMT and NUMA,
the domains appear empty (there are actually 3 levels per cpu).  And as
soon as two domains a null pointer is dereferenced (unreliable in this
case is stack garbage):

bu19a:~# ls -R /proc/sys/kernel/sched_domain/
/proc/sys/kernel/sched_domain/:
cpu0  cpu1  cpu2  cpu3

/proc/sys/kernel/sched_domain/cpu0:

/proc/sys/kernel/sched_domain/cpu1:

/proc/sys/kernel/sched_domain/cpu2:

/proc/sys/kernel/sched_domain/cpu3:

bu19a:~# mkdir /dev/cpuset
bu19a:~# mount -tcpuset cpuset /dev/cpuset/
bu19a:~# cd /dev/cpuset/
bu19a:/dev/cpuset# echo 0 > sched_load_balance
bu19a:/dev/cpuset# mkdir one
bu19a:/dev/cpuset# echo 1 > one/cpus
bu19a:/dev/cpuset# echo 0 > one/sched_load_balance
Unable to handle kernel paging request for data at address 0x00000018
Faulting instruction address: 0xc00000000006b608
NIP: c00000000006b608 LR: c00000000006b604 CTR: 0000000000000000
REGS: c000000018d973f0 TRAP: 0300   Not tainted  (2.6.23-bml)
MSR: 9000000000009032 <EE,ME,IR,DR>  CR: 28242442  XER: 00000000
DAR: 0000000000000018, DSISR: 0000000040000000
TASK = c00000001912e340[1987] 'bash' THREAD: c000000018d94000 CPU: 2
..
NIP [c00000000006b608] .unregister_sysctl_table+0x38/0x110
LR [c00000000006b604] .unregister_sysctl_table+0x34/0x110
Call Trace:
[c000000018d97670] [c000000007017270] 0xc000000007017270 (unreliable)
[c000000018d97720] [c000000000058710] .detach_destroy_domains+0x30/0xb0
[c000000018d977b0] [c00000000005cf1c] .partition_sched_domains+0x1bc/0x230
[c000000018d97870] [c00000000009fdc4] .rebuild_sched_domains+0xb4/0x4c0
[c000000018d97970] [c0000000000a02e8] .update_flag+0x118/0x170
[c000000018d97a80] [c0000000000a1768] .cpuset_common_file_write+0x568/0x820
[c000000018d97c00] [c00000000009d95c] .cgroup_file_write+0x7c/0x180
[c000000018d97cf0] [c0000000000e76b8] .vfs_write+0xe8/0x1b0
[c000000018d97d90] [c0000000000e810c] .sys_write+0x4c/0x90
[c000000018d97e30] [c00000000000852c] syscall_exit+0x0/0x40

Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

[CCID2/3]: Initialisation assignments of 0 are redundant

Assigning initial values of `0' is redundant when loading a new CCID structure,
since in net/dccp/ccid.c the entire CCID structure is zeroed out prior to
initialisation in ccid_new():

     struct ccid {
     struct ccid_operations *ccid_ops;
     char        ccid_priv[0];
     };

     // ...
     if (rx) {
     memset(ccid + 1, 0, ccid_ops->ccid_hc_rx_obj_size);
     if (ccid->ccid_ops->ccid_hc_rx_init != NULL &&
         ccid->ccid_ops->ccid_hc_rx_init(ccid, sk) != 0)
     goto out_free_ccid;
     } else {
     memset(ccid + 1, 0, ccid_ops->ccid_hc_tx_obj_size);
     /* analogous to the rx case */
     }

This patch therefore removes the redundant assignments. Thanks to Arnaldo for
the inspiration.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

[DCCP]: Unaligned pointer access

This fixes `unaligned (read) access' errors of the type

Kernel unaligned access at TPC[100f970c] dccp_parse_options+0x4f4/0x7e0 [dccp]
Kernel unaligned access at TPC[1011f2e4] ccid3_hc_tx_parse_options+0x1ac/0x380 [dccp_ccid3]
Kernel unaligned access at TPC[100f9898] dccp_parse_options+0x680/0x880 [dccp]

by using the get_unaligned macro for parsing options.

Commiter note: Preserved the sparse __be{16,32} annotations.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

[DCCP]: Convert Reset code into socket error number

This adds support for converting the 11 currently defined Reset codes into system
error numbers, which are stored in sk_err for further interpretation.

This makes the externally visible API behaviour similar to TCP, since a client
connecting to a non-existing port will experience ECONNREFUSED.

* Code 0, Unspecified, is interpreted as non-error (0);
* Code 1, Closed (normal termination), also maps into 0;
* Code 2, Aborted, maps into "Connection reset by peer" (ECONNRESET);
* Code 3, No Connection and
  Code 7, Connection Refused, map into "Connection refused" (ECONNREFUSED);
* Code 4, Packet Error, maps into "No message of desired type" (ENOMSG);
* Code 5, Option Error, maps into "Illegal byte sequence" (EILSEQ);
* Code 6, Mandatory Error, maps into "Operation not supported on transport endpoint" (EOPNOTSUPP);
* Code 8, Bad Service Code, maps into "Invalid request code" (EBADRQC);
* Code 9, Too Busy, maps into "Too many users" (EUSERS);
* Code 10, Bad Init Cookie, maps into "Invalid request descriptor" (EBADR);
* Code 11, Aggression Penalty, maps into "Quota exceeded" (EDQUOT)
  which makes sense in terms of using more than the `fair share' of bandwidth.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

[DCCP]: One more exemption from full sequence number checks

This fixes the following problem: client connects to peer which has no DCCP
enabled or loaded; ICMP error messages ("Protocol Unavailable") can be seen
on the wire, but the application hangs. Reason: ICMP packets don't get through
to dccp_v4_err.

When reporting errors, a sequence number check is made for the DCCP packet
that had caused an ICMP error to arrive.
Such checks can not be made if the socket is in state LISTEN, RESPOND (which
in the implementation is the same as LISTEN), or REQUEST, since update_gsr()
has not been called in these states, hence the sequence window is 0..0.

This patch fixes the problem by adding the REQUEST state as another exemption
to the window check. The error reporting now works as expected on connecting.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>

[DCCP]: Retrieve packet sequence number for error reporting

This fixes a problem when analysing erroneous packets in dccp_v{4,6}_err:
* dccp_hdr_seq currently takes an skb
* however, the transport headers in the skb are shifted, due to the
  preceding IPv4/v6 header.
Fixed for v4 and v6 by changing dccp_hdr_seq to take a struct dccp_hdr as
argument. Verified that the correct sequence number is now reported in the
error handler.

Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Acked-by: Ian McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

blackfin: fix sg fallout

Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Jens Axboe <axboe@carl.home.kernel.dk>

xtensa: dma-mapping.h is using linux/scatterlist.h functions, so include it

It's currently using asm/scatterlist.h, but that is not enough.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

Merge branch 'for-linus' of ssh:///linux/kernel/git/hskinnemoen/avr32-2.6 into sg

SG: audit of drivers that use blk_rq_map_sg()

They need to properly init the sg table, or blk_rq_map_sg() will
complain if CONFIG_DEBUG_SG is set.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

arch/um/drivers/ubd_kern.c: fix a building error

Fix this uml building error:
arch/um/drivers/ubd_kern.c: In function 'do_ubd_request':
arch/um/drivers/ubd_kern.c:1118: error: implicit declaration of function
'sg_page'
arch/um/drivers/ubd_kern.c:1118: warning: passing argument 6 of
'prepare_request' makes pointer from integer without a cast
make[1]: *** [arch/um/drivers/ubd_kern.o] Error 1
make: *** [arch/um/drivers] Error 2

Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com>
Add sg_init_table() call as well.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

x86: fix bogus KERN_ALERT on oops

fix this:

printing eip: f881b9f3 *pdpt = 0000000000003001 <1>*pde = 000000000480a067 *pte = 0000000000000000
^^^

[ mingo: added KERN_CONT as suggested by Pekka Enberg ]

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

x86: lguest build fix

Fix this error (i386 !SMP build):

arch/x86/lguest/boot.c: In function lguest_init:
arch/x86/lguest/boot.c:1059: error: pm_power_off undeclared (first use in this function)

by including linux/pm.h.

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

x86: fix CONFIG_KEXEC build breakage

X86_32 build fix to commit 62a31a03b3d2a9d20e7a073e2cd9b27bfb7d6a3f

Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

SG: Change sg_set_page() to take length and offset argument

Most drivers need to set length and offset as well, so may as well fold
those three lines into one.

Add sg_assign_page() for those two locations that only needed to set
the page, where the offset/length is set outside of the function context.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

ISDN/sc: fix longstanding warning

drivers/isdn/sc/shmem.c: In function 'memcpy_toshmem':
drivers/isdn/sc/shmem.c:54: warning: passing argument 1 of 'memcpy_toio' makes pointer from integer without a cast

Also, remove some unneeded braces, and add some useful whitespace.

Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

AVR32: Fix sg_page breakage

The latest sg changes introduce the following build errors on AVR32:

include/asm/dma-mapping.h: In function ‘dma_map_sg’:
include/asm/dma-mapping.h:220: error: implicit declaration of function ‘sg_page’
include/asm/dma-mapping.h:220: error: invalid operands to binary -
include/asm/dma-mapping.h:221: error: implicit declaration of function ‘sg_virt’
include/asm/dma-mapping.h:221: warning: assignment makes pointer from integer without a cast
include/asm/dma-mapping.h: In function ‘dma_sync_sg_for_device’:
include/asm/dma-mapping.h:330: warning: passing argument 2 of ‘dma_cache_sync’ makes pointer from integer without a cast

Fix it by including the correct header file, i.e. linux/scatterlist.h
instead of asm/scatterlist.h.

Signed-off-by: Haavard Skinnemoen <hskinnemoen@atmel.com>

mmc: sg fallout

Do a full scan of the directory to try and be a bit more proactive,
instead of waiting for things to break.

Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

m68k: sg fallout

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jens Axboe <axboe@carl.home.kernel.dk>

More SG build fixes

Signed-off-by: Jens Axboe <axboe@carl.home.kernel.dk>

sg: add missing sg_init_table calls to zfcp

kernel BUG at include/linux/scatterlist.h:50!
illegal operation: 0001 [#1]
[...]
Call Trace:
([<000000000026f184>] zfcp_ns_gid_pn_request+0x4c/0x2a0)
 [<0000000000276dd4>] zfcp_erp_strategy_do_action+0x1410/0x1938
 [<0000000000278412>] zfcp_erp_thread+0x4fa/0x1430
 [<000000000001990a>] kernel_thread_starter+0x6/0xc
 [<0000000000019904>] kernel_thread_starter+0x0/0xc

Cc: Swen Schillig <swen@vnet.ibm.com>
Cc: Christof Schmitt <christof.schmitt@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Jens Axboe <axboe@carl.home.kernel.dk>

SG build fix

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jens Axboe <axboe@carl.home.kernel.dk>