Merge branch 'ipg-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/romieu/netdev-2.6 into upstream-fixes

Change bond_mii_monitor to not hold any locks when calling rtnl_unlock,
as rtnl_unlock can sleep (when acquring another mutex in netdev_run_todo).

Bug reported by Makito SHIOKAWA <mshiokawa@miraclelinux.com>, who
included a different patch.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Fix the handling of rtnl and the bonding_rwsem to always be acquired
in a consistent order (rtnl, then bonding_rwsem).

The existing code sometimes acquired them in this order, and sometimes
in the opposite order, which opens a window for deadlock between ifenslave
and sysfs.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	A recent change to add an additional hash policy modified
bond_parse_parm, but it now does not correctly match parameters passed in
via sysfs.

	Rewrote bond_parse_parm to handle (a) parameter matches that
are substrings of one another and (b) user input with whitespace (e.g.,
sysfs input often has a trailing newline).
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Add a call to bond_release_all in the bonding netdev event
handler for the master.  This releases the slaves for the case of, e.g.,
"echo -bond0 > /sys/class/net/bonding_masters", which otherwise will spin
forever waiting for references to be released.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	alb_fasten_mac_swap (actually rlb_teach_disabled_mac_on_primary)
requries RTNL and no other locks.  This could cause dev_set_promiscuity
and/or dev_set_mac_address to be called with improper locking.

	Changed callers to hold only RTNL during calls to alb_fasten_mac_swap
or functions calling it.  Updated header comments in affected functions to
reflect proper reality of locking requirements.
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Move an ASSERT_RTNL down to where we should hold only RTNL;
the existing check produces spurious warnings because we hold additional
locks at _bh, tripping a debug warning in spin_lock_mutex().
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

	Fix the functions that store the primary and active slave
options via sysfs to hold the correct locks in the correct order.

	The bond_change_active_slave and bond_select_active_slave
functions both require rtnl, bond->lock for read and curr_slave_lock for
write_bh, and no other locks.  This is so that the lower level
mode-specific functions (notably for balance-alb mode) can release locks
down to just rtnl in order to call, e.g., dev_set_mac_address with the
locks it expects (rtnl only).
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ALPS - fix sync loss on Acer Aspire 5720ZG
  Input: psmouse - fix input_dev leak in lifebook driver
  Input: psmouse - fix potential memory leak in psmouse_connect()
  Input: usbtouchscreen - fix buffer overflow, make more egalax work
  Input: mousedev - handle mice that use absolute coordinates

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  [NIU]: Fix 1G PHY link state handling.
  [NET]: Fix TX timeout regression in Intel drivers.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix hypervisor TLB operation error reporting.

Correct wrong sized spinlock flags, form int to unsigned long.
Signed-off-by: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

call_usermodehelper_exec() has an exit path that can leave the
helper_lock() call at the top of the routine unbalanced.  The attached
patch fixes this issue.
Signed-off-by: Nigel Cunningham <nigel@tuxonice.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This reverts commit e1265205.

It's a duplicate commit of commit 74beb9db,
resulting in a duplicate section.
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix http://bugzilla.kernel.org/show_bug.cgi?id=9762

Framebuffer is ok only with default parameters only (it is 1280x800-8@60).  If
parameters are video=radeonfb:1280x800-32@60 then xres, yres and xres_virtual
are ok but yres_virtual is 1024.  It can be corrected by fbset utility so I
think it can be corrected in the driver code also.

Steps to reproduce: video=radeonfb:1280x800-32@60 or
video=radeonfb:1280x800-16@60

Add 1280x800 mode into modedb

Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch puts #ifdef CONFIG_DEBUG_VM around a check in vm_normal_page
that verifies that a pfn is valid.  This patch increases performance of the
page fault microbenchmark in lmbench by 13% and overall dbench performance
by 7% on s390x.  pfn_valid() is an expensive operation on s390 that needs a
high double digit amount of CPU cycles.  Nick Piggin suggested that
pfn_valid() involves an array lookup on systems with sparsemem, and
therefore is an expensive operation there too.

The check looks like a clear debug thing to me, it should never trigger on
regular kernels.  And if a pte is created for an invalid pfn, we'll find
out once the memory gets accessed later on anyway.  Please consider
inclusion of this patch into mm.
Signed-off-by: Carsten Otte <cotte@de.ibm.com>
Acked-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The trap handler does properly update the fraction,
but not the exponent...

Thanks to Paolo Bonzini for the bug report and the testcase.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Paolo Bonzini <bonzini@gnu.org>
Cc: Richard Henderson <rth@twiddle.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This likely fixes the oops in __lock_acquire reported as:

http://www.kerneloops.org/raw.php?rawid=2753&msgid=
http://www.kerneloops.org/raw.php?rawid=2749&msgid=

In these reported oopses, start_this_handle is returning -EROFS.
Signed-off-by: Jonas Bonn <jonas.bonn@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

With CONFIG_HOTPLUG=n and CONFIG_HOTPLUG_CPU=y we saw
following warning:
WARNING: mm/built-in.o(.text+0x6864): Section mismatch: reference to .init.text: (between 'process_zones' and 'pageset_cpuup_callback')

The culprit was zone_batchsize() which were annotated __devinit but used
from process_zones() which is annotated __cpuinit.  zone_batchsize() are
used from another function annotated __meminit so the only valid option is
to drop the annotation of zone_batchsize() so we know it is always valid to
use it.
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

- Move alignment to page size of init data outside ifdef for BLK_DEV_INITRD.
  The reservation up to page size of memory after init data was previously
  not done if BLK_DEV_INITRD was undefined.
  This caused a kernel oops when init memory pages were freed after startup,
  data placed in the same page as the last init memory would also be freed
  and reused, with disastrous results.

- Use macros for initcalls and .text sections.

- Replace hardcoded page size constant with PAGE_SIZE define.

- Change include/asm-cris/page.h to use the _AC macro to instead
  of testing __ASSEMBLY__.
Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Mikael Starvik <mikael.starvik@axis.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Wups, previous patch was ineffective in 2 cases.

http://bugzilla.kernel.org/show_bug.cgi?id=9535Signed-off-by: Len Brown <len.brown@intel.com>
Reported-by: "Hartkopp, Oliver (K-EFE/E)" <oliver.hartkopp@volkswagen.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix potential null deref introduced by commit
cf059462
http://bugzilla.kernel.org/show_bug.cgi?id=9748Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: Roman Zippel <zippel@linux-m68k.org>
Reported-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When the cpufreq driver starts up at boot time, it calls into the default
governor which might not be initialised yet.  This hurts when the
governor's worker function relies on memory that is not yet set up by its
init function.

This migrates all governors from module_init() to fs_initcall() when being
the default, as was already done in cpufreq_performance when it was the
only possible choice.  The performance governor is always initialized early
because it might be used as fallback even when not being the default.

Fixes at least one actual oops where ondemand is the default governor and
cpufreq_governor_dbs() uses the uninitialised kondemand_wq work-queue
during boot-time.
Signed-off-by: Johannes Weiner <hannes@saeurebad.de>
Cc: Dave Jones <davej@codemonkey.org.uk>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The current logic will only request an ack for the first pending
packet. No irq is triggered as soon as the CPU submits a few
packets a bit quickly.  Let's request an irq for every packet
instead.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>

The Tx skb release could not free more than one skb per call.
Add it to the fact that the xmit handler does not check for
a queue full condition and you have a recipe to leak quickly.

Let's release every pending Tx descriptor which has been given
back to the host CPU by the network controller. The xmit handler
suggests that it is done through the IPG_TFC_TFDDONE bit.

Remove the former "curr" computing: it does not produce anything
usable in its current form.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>

Spotted-by: <linux@horizon.com>
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>

The recently added support for Dell Volstro 1400 was causing protocol
synchronization errors on Acer Aspire 5720ZG, fix it.
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

The lifebook driver may register a second input device, but it never
unregisters it.  This fixes that.
Signed-off-by: Andres Salomon <dilinger@debian.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

If we successfully call input_register_device() in psmouse_connect()
but sysfs_create_group() fails, we'll enter the error path without
ever having called input_unregister_device() potentially leaking
memory.
Signed-off-by: Andres Salomon <dilinger@debian.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Fix a buffer overflow in mutli-packet handling code.  The overflow can
only happen with eGalax devices and is even there very unlikely (only
non-report packet are affected any only when truncated after the first
byte).

Also changes the mutli-packet handling code not to drop unknown packets,
but rather just drop one byte.  This allows synchronizing on report packets
in the data stream.  It's required for some egalax devices to work at all.

Also remove the pointless 'flags' member of the device struct and set the
version number to 0.6, plus some minor cleanups.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Devices like the HP Integrated Remote Console Virtual Mouse, which are
standard equipment on all Proliant and Integrity servers, produce
absolute coordinates instead of relative coordinates.  This is done to
synchronize the position of the mouse cursor on the client desktop
with the mouse cursor position on the server.  Mousedev is not
designed to pass those absolute events directly to X, but it can
translate them into relative movements.  It currently does this for
tablet like devices and touchpads.  This patch merely tells it to also
include a device with ABS_X, ABS_Y, and mouse buttons in its list of
devices to process input for.

This patch enables the mouse pointer to move when using the remote
console.
Signed-off-by: Micah Parrish <micah.parrish@hp.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

1) Trap level wasn't being passed down properly, we need to
   move it from %l4 into the correct outgoing arg register.

2) Although the TPC often provides the most direct clue, we
   have the caller PC so we should provide that as well.
Signed-off-by: David S. Miller <davem@davemloft.net>

The code in link_status_1g() computes the active speed
and duplex but does not update the link config state
with those values.

As a result the link speed is not reported correctly
and the XIF is not reprogrammed properly on link up
events.
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes a regression added by changeset
53e52c72 ("[NET]: Make ->poll()
breakout consistent in Intel ethernet drivers.")

As pointed out by Jesse Brandeburg, for three of the drivers edited
above there is breakout logic in the *_clean_tx_irq() code to prevent
running TX reclaim forever.  If this occurs, we have to elide NAPI
poll completion or else those TX events will never be serviced.
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

Merge branch 'v2.6.24-rc7-lockdep' of git://git.kernel.org/pub/scm/linux/kernel/git/peterz/linux-2.6-lockdep

* 'v2.6.24-rc7-lockdep' of git://git.kernel.org/pub/scm/linux/kernel/git/peterz/linux-2.6-lockdep:
  lockdep: more hardirq annotations for notify_die()
  lockdep: fix workqueue creation API lockdep interaction
  lockdep: fix internal double unlock during self-test

sysfs_rename/move_dir() have the following bugs.

 - On dentry lookup failure, kfree() is called on ERR_PTR() value.
 - sysfs_move_dir() has an extra dput() on success path.

Fix them.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

sysfs tries to keep dcache a strict subset of sysfs_dirent tree by
shooting down dentries when a node is removed, that is, no negative
dentry for sysfs.  However, the lookup function returned NULL and thus
created negative dentries when the target node didn't exist.

Make sysfs_lookup() return ERR_PTR(-ENOENT) on lookup failure.  This
fixes the NULL dereference bug in sysfs_get_dentry() discovered by
bluetooth rfcomm device moving around.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

On Sat, 2007-12-29 at 18:06 +0100, Marcin Slusarz wrote:
> Hi
> Today I've got this (while i was upgrading my gentoo box):
>
> WARNING: at kernel/lockdep.c:2658 check_flags()
> Pid: 21680, comm: conftest Not tainted 2.6.24-rc6 #63
>
> Call Trace:
>  [<ffffffff80253457>] check_flags+0x1c7/0x1d0
>  [<ffffffff80257217>] lock_acquire+0x57/0xc0
>  [<ffffffff8024d5c0>] __atomic_notifier_call_chain+0x60/0xd0
>  [<ffffffff8024d641>] atomic_notifier_call_chain+0x11/0x20
>  [<ffffffff8024d67e>] notify_die+0x2e/0x30
>  [<ffffffff8020da0a>] do_divide_error+0x5a/0xa0
>  [<ffffffff80522bdd>] trace_hardirqs_on_thunk+0x35/0x3a
>  [<ffffffff80255b89>] trace_hardirqs_on+0xd9/0x180
>  [<ffffffff80522bdd>] trace_hardirqs_on_thunk+0x35/0x3a
>  [<ffffffff80523c2d>] error_exit+0x0/0xa9
>
> possible reason: unannotated irqs-off.
> irq event stamp: 4693
> hardirqs last  enabled at (4693): [<ffffffff80522bdd>] trace_hardirqs_on_thunk+0x35/0x3a
> hardirqs last disabled at (4692): [<ffffffff80522c17>] trace_hardirqs_off_thunk+0x35/0x37
> softirqs last  enabled at (3546): [<ffffffff80238343>] __do_softirq+0xb3/0xd0
> softirqs last disabled at (3521): [<ffffffff8020c97c>] call_softirq+0x1c/0x30

more early fixups for notify_die()..
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Dave Young reported warnings from lockdep that the workqueue API
can sometimes try to register lockdep classes with the same key
but different names. This is not permitted in lockdep.

Unfortunately, I was unaware of that restriction when I wrote
the code to debug workqueue problems with lockdep and used the
workqueue name as the lockdep class name. This can obviously
lead to the problem if the workqueue name is dynamic.

This patch solves the problem by always using a constant name
for the workqueue's lockdep class, namely either the constant
name that was passed in or a string consisting of the variable
name.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>