Summary of changes from v2.6.6-rc1 to v2.6.6-rc2 ============================================ [IEEE1394/OHCI]: Deal with some OHCI implementations that have an invalid max_rec field. IEEE1394/Lynx(r1182): Explicitly set LCtrl bit in phy register set. [TG3]: Jumbo frames and FTQ reset patch. 1. Set extended packet length bit in phy register 0x18 shadow register 0 on all chips that support jumbo frames (i.e. all chips except 5705 and its variants). Jumbo frame reception is less reliable (more CRC errors) if this bit is not set. This bit can be set regardless of the current MTU setting. 2. Remove FTQ reset during chip init. This is the best fix for the ASF race condition problem that I mentioned a few months ago. The FTQ reset is redundant as it is already reset during GRC reset. [TG3]: Just completely delete the disabled FTQ reset code. Driver Core: fix spaces instead of tabs problem in the Kconfig file. add sysfs support for vc devices. VC: fix bug in vty_init() where vcs_init() was not called early enough. It was being used before initialized, not nice :( Driver class: remove possible oops This happens when the device associated with a class device goes away before the class does. [PATCH] QIC-02 tape drive hookup to classes in sysfs Here is a patch to hook up the qic02 tape device to have class support in sysfs. I have verified it compiles. I do not have access to the hardware to test. Could someone who does please verify? From the file: * This is a driver for the Wangtek 5150 tape drive with * a QIC-02 controller for ISA-PC type computers. * Hopefully it will work with other QIC-02 tape drives as well. [PATCH] add class support to floppy tape driver zftape-init.c Here is a patch to add class support to zftape-init.c: MODULE_DESCRIPTION(ZFTAPE_VERSION " - " "VFS interface for the Linux floppy tape driver. " "Support for QIC-113 compatible volume table " "and builtin compression (lzrw3 algorithm)"); I have verified it compiles but do not have the hardware to test it. [PATCH] Sysfs for framebuffer the following patch (against 2.6.5-rc2) teaches fb to use class_simple. With this patch udev will automagically create device nodes for each framebuffer registered. Once all drivers are converted to framebuffer_{alloc,release} we can switch to our own class. This is what sysfs dir looks like: notebook:~# tree /sys/class/graphics/ /sys/class/graphics/ `-- fb0 `-- dev Remove mention of non-existent tulip.txt from Doc/netwrk/00-INDEX [BK] ignore build-generated files in scripts/basic/ and drivers/md/ [MAINTAINERS] remove mention of defunct linux-via mailing list Noticed by Adrian Bunk. [PATCH] added class support to stallion.c Here is a patch to add class support to the Stallion multiport serial driver. [PATCH] added class support to istallion.c Here is a patch to add class support to the Stallion Intelligent multiport serial driver. [PATCH] tipar char driver (divide by zero) A patch about the tipar.c char driver has been sent on lkml by Sebastien Bourdeau. It fixes a divide-by-zero error when we try to read/write data after setting the timeout to 0. PCI: add ability to access pci extended config space for PCI Express devices Patch originally written by Intel, cleaned up and made sane by Matthew Wilcox and then tweaked a bit more by me. From Matt's original email: - Add cfg_size to struct pci_dev. - Use it in sysfs and procfs. - Introduce pci_find_ext_capability() for finding extended capabilities. - Change the PCI_X_STATUS defines to match the spec (mea culpa there). - Add defines for the extended capabilities. [PATCH] PCI: Updates for PCI Express hot-plug driver [PATCH] PCI Hotplug: Don't up() twice in acpiphp On the error path, we currently try to up() a semaphore twice. There was also a typo in an error message. [PATCH] PCI Hotplug: Rewrite acpiphp detect_used_resource There are two unrelated problems in acpiphp that are fixed by this patch. First, acpiphp can be a module, so it is unsafe to probe the BARs of each device while it initialises -- the device may be active at the time. Second, it does not know about PCI-PCI bridge registers and so it reads garbage for the last 4 registers of the PCI-PCI bridge card and doesn't take into account the ranges that are forwarded by the bridge. This patch avoids all that by using the struct resources embedded in the pci_dev. Note that we no longer need to recurse as all the devices on the other side of a PCI-PCI bridge have their resources entirely contained within the PCI-PCI bridge's ranges. [TG3]: Kill 'force' arg to tg3_phy_reset, it is always set. [TG3]: At start of tg3_phy_copper_begin, force phy out of loopback mode. [TG3]: Do not allow illegal ethtool advertisement bits. [NETFILTER]: Optimization of ip_conntrack_proto_tcp:tcp_packet() A: Pablo Neira D: This patch cleans up tcp_packet(). No semantical change, just juggling D: code pieces. [NETFILTER]: Locking optimization in ip_conntrack_core A: Pablo Neira D: This patch puts tightens up a lock protected section in D: ip_ct_refresh() [NETFILTER]: Cleanup conntrack helper API A: Pablo Neira D: This patch changes the conntrack helper API. Rather than having the D: helper allocate an expect on the stack and then have the core D: kmalloc and memcpy, it is now the job of a helper to call D: ip_conntrack_expect_alloc() [NETFILTER]: Add nf_log handler, from Jozsef Kadlecsik. [NETFILTER]: Missed these files in nf_log commit. [NETFILTER]: Add 'raw' table, from Jozsef Kadlecsik. Cset exclude: jgarzik@redhat.com|ChangeSet|20040323051558|61282 [PATCH] PCI: add DMA_{64,32}BIT constants On Tue, 23 Mar 2004 00:23:05 -0500 Jeff Garzik wrote: >>Yeah well... in the intervening time, somebody on IRC commented >> >>"so what is so PCI-specific about those constants?" >> >>They probably ought to be DMA_{32,64}BIT_MASK or somesuch. Here's an updated patch, applies to 2.6.5-rc2-bk9. I left the DMA_xxBIT_MASK defines in linux/pci.h, although they aren't necessarily PCI-specific. Would we prefer to have them in linux/dma-mapping.h ? [TG3]: Add missing 5704 BX workaround, and fix typo in autoneg fix. [TG3]: Set GRC_MISC_CFG prescaler more safely. [TG3]: Fix serdes cfg programming on 5704. [TG3]: When link is down, set stats coalescing ticks to zero. [TG3]: Wait a bit for BMSR/BMCR bits to settle in PHY setup. [PATCH] PCI: move DMA_nnBIT_MASK to linux/dma-mapping.h [PATCH] PCI Hotplug: RPA PCI Hotplug - redundant free Please commit the following patch, which removes a redundant call to a cleanup function from an error path of the module init code. [PATCH] PCI: Allow arch-specific pci_set_dma_mask and friends The patch provides the ability for architectures to have custom implementations of pci_set_dma_mask() and friends (dac_set_dma_mask and set_consistent_dma_mask). The reason I need this is b/c I have a chipset (Intel ARM IXP425) that has a broken PCI interface that only allows PCI dma to/from the bottom 64MB of system memory. To get around this limitation, I trap a custom dma-mapping implementation that bounces buffers outside the 64MB window. At device discover time, my custom platform_notify() function gets called and it sets the dma_mask to (64MB-1) and in ARM's dma-mapping code, I check for dma_mask != 0xffffffff and if that is true, I call the special bounce helpers. This works great except that certain drivers (e100, ide-pci) call pci_set_dma_mask() with 0xffffffff and the generic implementation only allows for the architecture-defined pci_dma_supported() to return true or false. There is no method for the architecture to tell the PCI layer "I can't set the mask to 0xffffffff, but I can set it to this other value" and there is no way to pass that back to the driver. What this means is that if I have pci_set_dma_supported() return failure on full 32-bit DMA, the driver will not initialize the card; however, if I return true, pci_set_dma_mask() will set the dma mask to full 32-bits and I can no longer trap and will have buffers that are not dma-able and cause PCI master aborts. Both of those are not acceptable. IMHO, the driver shouldn't care if the architecture has to bounce DMA outside of 64MB and since this is not something most architectures have to worry about, the easiest way to get around the issue is by allowing custom pci_set_dma_mask() for arches that need it but keeping the generic implementation for those that do not. In my case, it simply returns 0 to the driver but keeps the device mask set to 64MB-1 so I can trap. [PATCH] kobject_set_name() doesn't allocate enough space [SPARC]: Add C99 initializers to Sparc frame buffer devices. [NET]: Mark lock_sock and release_sock as FASTCALL. [AF_KEY]: pfkey_send_new_mapping marks dest address incorrectly. [TG3]: Verify link advertisement correctly on 10/100 only chips. [IPV4]: Fix IGMP version number and timer printing for procfs. [BRIDGE]: Allow non-root to inspect the status of a bridge. [TG3]: All 5705 chips need PHY reset on link-down. [BRIDGE]: Lift ioctl limits on number of bridges/ports. Get rid of some arbitrary API restrictions that limit the kernel to 64 bridges and 256 ports. Retain compatibility in GET_PORT_LIST, the existing bridge API passes 0 for the third argument, and expects 256 entries. Note: there still is limit of 256 ports due to STP, but this shouldn't show up in the API, it needs to be handled by the 'add port to bridge ioctl'. [BRIDGE]: Correctly handle up to 256 ports per bridge. Bridge code is limited to 256 ports per bridge because the Spanning Tree Protocol has limit of one octet for port number. This code fixes: * bogus unlock in error path when port list is full. * passes different error status for out of memory, vs port list full. * O(n) vs O(n^2) lookup for free port number * since port and priority are both limited to one byte don't store them as int's * makes limit explicit in code [TG3]: More PHY programming fixes. - Break out advertisement register verification into a function, tg3_copper_is_advertising_all. - At device probe time, reset PHY if not Serdes and ASF is not enabled. - Add some missing necessary PHY init to PHY probe code as well. [TG3]: Bump driver version and reldate. [TG3]: Print list of important probed capabilities at driver load. [TG3]: Two PHY fixes. - Do not probe PHY ID register if ASF firmware is running. - Fix two errors in PCI subsys to PHY ID table. [TG3]: Kill uninitialized var warning. [TG3]: Reset fixes. - Put more code into common area in tg3_chip_reset() - Set GRC_MODE, even sanes host-stackup bit, after enabling memory arbiter. - After every core-clock reset, reprobe ASF enabling state. [TG3]: Update driver version and release date. [IPV6]: Add MIBs counters in MLD. [SPARC]: Add sysctl to control serial console power-off restrictions. [SPARC64]: hugetlbpage.c needs module.h [Bluetooth] Remove architecture specific compat ioctl's The compat ioctl definitions are now maintained in a single place, so it is no longer needed to keep the architecture specific defines. This patch removes the leftover Bluetooth parts from x86_64 and sparc64. [Bluetooth] Fix broken HCI security filter The HCI security filter is broken on 64-bit architectures and this patch restores the version from 2.4, which is working perfect on 32-bit and 64-bit machines. [Bluetooth] Allocate hdev before device configuration The hdev structure must be allocated before the device is configured and before any interrupt is started. [Bluetooth] Add UART protocol id's for 3-Wire and H4DS This patch adds the id's for the 3-Wire and H4DS UART transport protocols. [IPV6]: Provide ipv6 multicast/anycast addresses through netlink. [NETLINK]: Split up netlink_unicast. [NET]: Update networking config menu (v3) Networking support/options and Networking drivers have been, uhm, messy to navigate for some time now. BenH mentioned this and I was already looking into options to clean it up. This is a cleanup of Networking support/options and Networking Drivers. It presents a more consistent interface and lists similar driver groups and protocol groups closer together. It also moves the IBMVETH driver so that it no longer breaks the dependency tree, allowing other drivers (nearby in Kconfig file) to be presented in a more linear manner. [SCTP] Fix typo in entry name of the remove_proc_entry() call. [IEEE-1394] Sync IEEE-1394 to r1203 [net/fc iph5526] s/rx_dropped/tx_dropped/ in TX routines Spotted by Denis Valesko(sp?). Maybe one day we'll either kill this driver, or someone will fix it up for the current SCSI API. [NET] define HAVE_NETDEV_PRIV back-compat hook [netdrvr natsemi] correct DP83816 IntrHoldoff register offset Spotted by Manfred Spraul. [PATCH] Update MAINTAINERS with new e100/e1000/ixgb maintainers Jeff, Adding John/Ganesh/Ayyappan for e100/e100/ixgb in 2.6. Keeping myself on for e100 for a couple more 2.6.x releases. -scott [PATCH] com20020-isa.c warning fix From: "Luiz Fernando N. Capitulino" drivers/net/arcnet/com20020-isa.c:188: warning: unused variable `dev' drivers/net/arcnet/com20020-isa.c:189: warning: unused variable `lp' [SCTP] Update sctp_ulpevent structure to include assoc pointer and only the receive specific fields of sctp_sndrcvinfo. [SCTP] Use id to ptr translation service in lib/idr.c to assign and validate ids of associations. This patch avoids the use of virt_addr_valid() to validate the address of associations passed by the user. Currently the address of an association is used as its id. virt_addr_valid doesn't work as expected when PAGEALLOC debugging is enabled. [Bluetooth] Allocate the BCM203x URB buffer seperately The buffer shares cachelines with other fields of the structure. On architectures which require synchronisation before or after doing DMA to or from a buffer, any access to such fields sharing cachelines can corrupt the content of the buffer. The allocation primitives guarantee that cachelines are not shared. Noticed by Oliver Neukum Update amd8111 net driver. version 3.04 for 2.4 kernel: + 1. Added set_mac_address routine for bonding driver support. + 2. Tested the driver for bonding support + 3. Bug fix: Fixed mismach in actual receive buffer lenth and lenth + indicated to the h/w. + 4. Modified amd8111e_rx() routine to receive all the received packets + in the first interrupt. + 5. Bug fix: Corrected rx_errors reported in get_stats() function. version 3.05 for 2.6 kernel: + 1. Added NAPI support [PATCH] PCI Hotplug: Fix interpretation of 0/1 for MRL in SHPC & PCI-E hot-plug This patch contains fixes for interpretation of 0/1 for MRL to match pcihpview, bus speed definition in shpchp_hpc.c etc. [NET]: Use const args in eth_copy_and_sum and is_valid_ether_addr. [PATCH] add class support to dsp56k.c Here is a patch that adds sysfs class support to /drivers/char/dsp56k.c [PATCH] Add sysfs class support to fs/coda/psdev.c Here is a patch to add class support to psdev.c. I have verified it compiles and works. [Bluetooth] Fix URB unlink race in the USB drivers The code in hci_usb_unlink_urbs() calls usb_unlink_urb() to perform a synchronous unlink of each pending URB. It then moves each URB to the completed list, and then frees everything on the completed list. By doing this, the code implicitly assumes that when usb_unlink_urb() returns the URB will have completed and be ready to be deallocated. That's not always true. The same applies to the BlueFRITZ! USB driver. Patch from Alan Stern [Bluetooth] Make use of request_firmware() for the 3Com driver The 3Com Bluetooth PCMCIA cards need a firmware download every time they are inserted. With request_firmware() the file BT3CPCC.bin is now loaded directly from the userspace and the external firmware loader program is no longer needed. [Bluetooth] Improve NULL pointer handling This small patch adds more checks for NULL pointers. [Bluetooth] Add support for Anycom CF-300 The Anycom CF-300 compact flash card contains a new Bluetooth chip and thus it needs some special handling for the faster UART baud rate. This patch detects this new card and does the different initialization. [SBP2]: Fix compile for older gcc's [Kconfig]: eth1394 requires INET [SBP2]: Sync revision [Bluetooth] Allow normal users to release the previous created TTY In the case the RFCOMM device node can't be found, the user must be able to release the previous created TTY. [Bluetooth] Fix race in RX complete routine of the USB drivers The test of the HCI_RUNNING flags bit in the RX complete routine should be made while holding the completion lock. Otherwise there can be a race on SMP systems in which RX complete finds the bit is set and on another processor the close routine clears the bit, grabs and releases the lock and then unlinks all the active URB's. Then the first processor acquires the lock and resubmits the URB. Patch from Alan Stern [PATCH] Add sysfs class support for CAPI here is a patch that adds class support to the ISDN CAPI module. Without it udev won't create the /dev/capi20 device node. [PATCH] fix sysfs class support to fs/coda/psdev.c --On Friday, April 09, 2004 12:02:19 AM +0200 Marcel Holtmann wrote: >> +static struct class_simple coda_psdev_class; > > I think coda_psdev_class must be a pointer. > > Regards > > Marcel Doh! I tested on one system and fixed this there. Then accidentally mailed out the original. Sorry about that. Here is a patch to fix it: [PATCH] Fix for patch to add class support to stallion.c Oops. Realized I had a / in the file name in this patch too. Please apply to correct it: [PATCH] Fix class support to istallion.c Realized I put a / in the filename of this device too. Here is the fix: [IPV6]: In ndisc_netdev_event, handle NETDEV_DOWN. Based upon patches and commentary from Thomas Spatzier, Stephen Hemminger, and Andi Kleen. [IPSEC]: Support draft-ietf-ipsec-udp-encaps-00/01, some ipec impls need it. [ISDN]: Add missing IPPP_FILTER entry to Kconfig. [ISDN]: Fix kernel PPP/IPPP active/passiv filter code. [IPV6]: Add missing MIB counter increments. [SOUND]: Proper deps for SND_BIT32_EMUL. [SOUND]: Add amd7930 to sndmagic.h [NET]: Kill __FUNCTION__ string literal concatenation. From Tony Breeds [NETFILTER]: Add more debug info to TFTP helper. From Vineet Mehta [ATM]: get atm_guess_pdu2truesize() right [ATM]: [nicstar] using dev_alloc_skb() (reported by Johnston, [IRDA]: Move IRDA device headers to more appropriate place. [IPV6]: Mark MLDv2 report as known. Mark MLDv2 Report as known ICMPv6 type. (We just ignore MLDv2 Reports on hosts as the spec says.) [NET]: Add random_ether_addr to ether_device.h [NET]: Use random address in dummy driver. [NET]: Use random address in usb gadget driver. [NET]: Use random address in usbnet driver. [SCTP]: Fix printk warnings. [ATM]: Fix printk warnings in ambassador driver. [IRDA]: Fix warnings in sir_dev.c [IRDA]: Fix 32-bit pointer bug in donauboe.c [NET]: Fix printk warnings in wireless/strip.c [NET]: Fix printk warnings in strip driver. [NET]: Fix memset args in sk_mca, noticed by Jean Delvare [SPARC64]: Control -fomit-frame-pointer using CONFIG_FRAME_POINTER. [NET_SCHED]: Check for NULL opt in dsmark_init. [CRYPTO]: ARC4 Kconfig clarification. [SPARC64]: Provide _mcount as well as mcount. [PATCH] Fix sysfs class support for CAPI this patch fixes a bug in the CAPI TTY support, because the ->name value of the TTY driver shouldn't contain a "/". After changing this there are now a "capi20" TTY device and a "capi20" control device and so I renamed the control device to "capi". The userspace visible part must be done by udev and I added these two rules to restore the old namespace: # CAPI devices KERNEL="capi", NAME="capi20", SYMLINK="isdn/capi20" KERNEL="capi*", NAME="capi/%n" [PATCH] PCI Hotplug: php_phy_location.patch Adds a file to show the pci hotplug slot location for the ppc64 driver only. [SPARC64]: Disable -Werror for a bit. [PATCH] sk_mca multicast fix Spotted by Jean Delvare : it has its memset arguments the wrong way round. [PATCH] etherh updates Update Acorn EtherH driver - convert to use mmio instead of emulated PIO. Convert card-specific parameters to a data structure rather than code-based selected. Please review and submit upstream. Thanks. [PATCH] netpoll early ARP handling Handle ARP requests while device is trapped before in_dev is initialized using netpoll config. Allows early kgdboe usage. From Stelian Pop [PATCH] netpoll transmit busy bugfix Fix for handling of full transmit queue when netpoll trap is enabled. From Stelian Pop [netdrvr 8390] Fix 8390 log spam It seems that PCMCIA 8390 users get spammed with a few annoying messages upon card removal. I guess 8390 could be taught to better detect and deal with these things, but here is a quick fix. [libata] abstract SCSI->ATA translation a bit [libata] move some PIO state init to its proper place [libata sata_promise] fix taskfile delivery cases We should only be touching the ATA shadow registers if we are doing PIO. [PATCH] Fix mq_notify with SIGEV_NONE notification From: Jakub Jelinek mq_notify (q, NULL) and struct sigevent ev = { .sigev_notify = SIGEV_NONE }; mq_notify (q, &ev) are not the same thing in POSIX, yet the kernel treats them the same. Only the former makes the notification available to other processes immediately, see http://www.opengroup.org/onlinepubs/007904975/functions/mq_notify.html Without the patch below, http://sources.redhat.com/ml/libc-hacker/2004-04/msg00028.html glibc test fails. I looked at mq in Solaris and they behave the same in this regard as Linux with this patch. Kernel with this patch passes both Intel POSIX testsuite (with testsuite fixes from Ulrich) and glibc mq testsuite. [PATCH] radix-tree comment fix Fix various bogons and outright lies. [PATCH] mq_open() and close_on_exec From: Chris Wright SUSv3 doesn't seem to specify one way or the other. I don't have the POSIX specs, and the old docs I have suggest that mq_open() creates an object which is to be closed upon exec. Jakub said: I think it is valid and required: http://www.opengroup.org/onlinepubs/007904975/functions/exec.html All open message queue descriptors in the calling process shall be closed, as described in mq_close() I'll add a new test for this into glibc testsuite. [PATCH] ext3: journalled quotas From: Jan Kara Journalled quota support for ext3: The patch consists of two parts - ext3 changes and changes in generic quota code. The main idea of the changes is that a transaction is always started before any operation which changes quota file and dirtifying of the quota causes its write to disk. These two changes assure that quota change is journalled into the same transaction as the file change and hence after journal replay quota is consistent with the filesystem state. As during journal replay inodes from orphan list are deleted/truncated we have to do quota_on before the replay of the orphan list - this problem is solved by additional mount options to ext3 with quota file names and format. Some changes in generic code were also needed to assure that quota structure in file is always allocated and so ordinary quota operations (like adding/deleting a block/inode) need only a few blocks from the transaction. [PATCH] Add mqueue support to x86-64 From: Andi Kleen Add POSIX mqueue support to x86-64. [PATCH] light-weight auditing framework for s390. From: Martin Schwidefsky This patch adds the TIF_SYSCALL_AUDIT option to the s390 ptrace interface. [PATCH] posix messages queues for s390. From: Martin Schwidefsky The new message queue interface needs the following patch to get it working on s390 (31-bit, 64-bit and 31-bit compat). [PATCH] ppc64: Fix possible duplicate MMU hash entries The current code has a subtle race where 2 hash PTEs can be inserted for the same virtual address for a short period of time. There should not be a stale one as the "old" one ultimately gets flushed, but the architecture specifies that having two hash PTE is illegal and can result in undefined behaviour. This patch fixes it by never clearing the _PAGE_HASHPTE bit when doing test_and_clear_{young,dirty}. That means that subsequent faults on those pages will have a bit more overhead to "discover" that the hash entry was indeed evicted. It also adds a small optisation to avoid doing the atomic operation and the hash flush in test_and_clear_dirty when the page isn't dirty or when setting write protect while it's already set. [PATCH] ppc64: update g5_defconfig This adds IOMMU support & IOMU virtual merging to the default g5 config. This will not impair performances of machines that don't need the iommu (the kernel will only enable it if you have more than 2Gb of RAM, though you can explicitely enable it using a command line argument). [PATCH] fix 4k irqstacks on x86 (and add voyager support) There's a bug in the x86 code in that it sets the boot CPU to zero. This isn't correct since some subarch's use physically indexed CPUs. However, subarchs have either set the boot cpu before irq_INIT() (or just inherited the default zero from INIT_THREAD_INFO()), so it's safe to believe current_thread_info()->cpu about the boot cpu. [PATCH] USB: Fix vicam debug compile, fix user access The last copy_from_user patch to the vicam driver broke compilation with VICAM_DEBUG on. There is also another copy_from_user missing in case VIDIOCSPICT. This fixes both issues. [PATCH] fix non-PC subarchs which were broken by i386 probe_roms change The author apparently didn't understand that only the mach-default include directory is included by fallback for header files only. You can't stick a .c file in mach-default and expect all subarchs to be able to use it. The correct fix is to put std_resources.c in the kernel directory and give it its own Kconfig symbol for conditional compile so that subarchs may choose to include it or not. [PATCH] Amiga Zorro8390 Ethernet section conflict Jeff Garzik notes that the previous cleanup highlights a bug: > > static const struct card_info { > zorro_id id; > const char *name; > unsigned int offset; > } cards[] __initdata = { > > and the lone user is __devinit: > > static int __devinit zorro8390_init_one(struct zorro_dev *z, > const struct zorro_device_id *ent) Here's the fix.. [E1000]: e1000.h needs dma-mapping.h [IXGB]: ixgb.h needs dma-mapping.h [PATCH] NMI watchdog Pentium M support This adda nmi_watchdog=2 support to the Pentium M processor. The P-M is a P6 chip, but it shares some chipset logic with the Pentium 4, so it requires this workaround to function. Without this patch, NMI gets stuck after 1 count. With it, the NMI fires and breaks me out of UHCI-related hard lockups. This patch is basically a modified version of the same patch for oprofile. See the threaded discussion here: http://lkml.org/lkml/2004/2/12/181 [PATCH] ppc64: catch branch to 0 in real mode We have been debugging some strange fails where we branch to 0 in real mode. At the moment this results in the cpu running through the initialisation code and failing somewhere well into it. The following patch uses the featuring nop'ing code to remove the branch at real address 0 so it falls through to a trap instruction and gets caught early. [PATCH] ppc64: always initialise dn->type and dn->name This fix comes from ppc32. Always initialise dn->type and dn->name so that code doesnt have to check for NULL everywhere. There is at least one bug report where we oopsed because of this. [PATCH] ppc64: Fix RTAS races on pSeries The low level kernel interface to RTAS (the firmware runtime services) was plagued with races that could cause from bogus results of RTAS operations to total machine crashes in some circumstances. This patch fix the ones I could identify, hoping I didn't miss any. I also added a WARN_ON (well, it's asm equivalent) to enter_rtas to make sure we never _ever_ try to call that with interrupts enabled. [ARM] Add --no-undefined to linker command line. Many binutils versions over the last year appear to silently build assembler files with undefined constants, and able to successfully create executables from such files. The assembler appears to add undefined symbols to the symbol table without any corresponding relocation information. Obviously this is bad news since the resulting executable may not be what the programmer intended. Work around the problem by forcing the linker to fail if there are any undefined symbols in the final object(s). [PATCH] amd8111e retval fix drivers/net/amd8111e.c: In function `amd8111e_vlan_rx': drivers/net/amd8111e.c:677: warning: control reaches end of non-void function [netdrvr via-rhine] Fix MII phy scanning Noticed by Roger Luethi, via-rhine maintainer. [PATCH] pcnet32 transmit performance fix When the pcnet32 adapter is installed in a system with long PCI latency and the read burst bit is not set, performance on transmission is very low (under 20Mbit on a 100Mbit link). This patch against 2.6.6-rc1 will make sure that read and write bursts are enabled. Tested on ppc64 and ia32. [SPARC64]: Fix branch prediction in switch_to(). [NET]: Do lazy gettimeofday for network packets. [ARM] Remove needless export of __do_softirq() [IPV6]: Limit network triggerable printks. [NET]: Add some sparse annotations to network driver stack. [ARM] Update mach-types file. [ARM] Add __user address space identifiers for sparse. [BRIDGE]: Include file cleanup. Cleanup some of the include file's in the bridge code. * if_bridge.h defines net_bridge, but not needed as part of the API. * get rid of places that include if_bridge.h and uaccess.h but don't actually do API work. [BRIDGE]: Fix rmmod race. Fix observed race between removing bridge module and ip packets in flight. Need to remove the hook last, after all bridges are gone not the other way around. [BRIDGE]: Make use of jiffies_to_clock. [BRIDGE]: Use ethtool to get port speed. The bridge code needs to keep track of a cost estimate for each port in the bridge. Instead of a hack based on device name, try and use ethtool to get port speed from device. This has been tested on e100 (uses ethtool_ops) and e1000 (does ethtool the hard way) and dummy (no ethtool). Need to export dev_ethtool() to allow bridge module to get to it easily. Code takes care to maintain same locking and semantics as if ioctl was being done from application. [BRIDGE]: Multicast address as const. [BRIDGE]: Forwarding database changes. Make forwarding database more robust. + Don't insert invalid ether address, + Report errors back so adding an interface to bridge can fail + get rid of unneeded explicit pads in data structure + replace bitfields with byte's for simple booleans. [BRIDGE]: STP unsigned fields. Use correct types for fields related to spanning tree protocols. * costs are 32 bit unsigned * ports are 16 bit unsigned * booleans are bytes rather than bitfield * arrange for better packing [BRIDGE]: Support lots of 1k ports. Support >256 ports on a bridge. Use the suggestion of reducing the number of bits of priority and increasing the number of bits for port number. Easy to increase to even larger if necessary. [BRIDGE]: FDB cache alloc. Since forwarding database gets a lot of memory alloc/free on a busy bridge, use kmem_cache_alloc to provide cache and better stats. [BRIDGE]: Replace CLEAR_BITMAP with memset. [PATCH] remount: fs/sysv fixes - several variants of sysv fs are supported only r/o. Driver does force r/o on mount, but doesn't do anything on remount. As the result, one can remount them r/w and results are Not Pretty(tm). Missing checks added, code cleaned up. - we had double-brelse() in v7fs - if sanity checks on root inode will succeed, but allocation of root dentry fails, we brelse() the same buffer_head twice. Fixed. [PATCH] remount: fs/udf fixes - same problem as with sysv - mount-time checks for fs being good for writing are absent on remount. Check added. [PATCH] remount: fs/openpromfs - we should force noatime both on mount and remount. Fixed. [PATCH] remount: fs/jffs2 - jff2->remount_fs() was buggy - it played with sb->s_flags instead of doing modifications to *flags (->s_flags will be overwritten using *flags right after the call of ->remount_fs()). Moreover, it tried to do the wrong thing - it should just enforce noatime and be done with that. Fixed, ACKed by maintainer. [PATCH] remount: forced-ro filesystems - a bunch of r/o filesystems did force MS_RDONLY on mount but forgot to do the same on remount. Fixed. [PATCH] remount: forced-nodiratime filesystems - a bunch of filesystems force MS_NODIRATIME on mount but forgot to do the same on remount. Fixed. [PATCH] remount: mount flags filtering - we could pass MS_ACTIVE in mount flags and it would be passed into ->get_sb(), leading to interesting failure modes. This flag is only for internal use (it's set once fill_super is complete and reset before the inode eviction on umount); made sure that we never get tricked into having it set it too early. [SPARC64]: Fix binfmt_elf32.c warning by redefining TASK_SIZE. [IRDA]: Convert vlsi_ir /proc/driver to seq_file. From Stephen Hemminger. [IRDA]: Fix handling of RD:RSP to be spec compliant From Martin Diehl. [IRDA]: Get rid of local CRC table in donauboe. From Stephen Hemminger. [IRDA]: Fix namespace pollution of print_ret_code. From Stephen Hemminger. [IRDA]: Rename handle_filter_request to irlan_filter_request. From Stephen Hemminger. [IRDA]: irlan_common cleanup. Minor type changes in irlan_common for clarity: - use const - init and exit can be static - use skb_queue_purge to flush queue - get rid of noisy old comment From Stephen Hemminger. [IRDA]: irlan_eth cleanup. Use IrTTP flow control to stop/wake netif From Stephen Hemminger. Change irlan_eth device initialization: *bug* address never set in DIRECT mode because access not set in alloc_netdev -> irlan_eth_setup path + make eth_XXX handles static and provide alloc_irlandev hook + use netdev_priv (and get rid of truly impossible ASSERT's) + use skb_queue_purge [IRDA]: Replace sleep_on with wait_event From Stephen Hemminger. [IPV6]: Use IANA icmpv6 type for MLDv2 report. [IPV6]: Fix IPSEC AH typo. [IPV6]: Fix OOPS in udp6 with extension headers using ancillary data. [NET]: Fix lapbether bad scheduling while atomic. Bring up/down network devices with lapbether causes scheduling while atomic (if preempt enabled). The calls to rcu_read_lock are unnecessary since lapb_device_event is called from notifier with the rtnetlink semaphore held, it is already protected from the labp_devices list changing. [PATCH] ide-probe.c: SanDisk is flash From: Meelis Roos This is self-explanatory - former SunDisk renamed itself to SanDisk and now there are flash disks with both names. [PATCH] Fix edd driver dereferencing before pointer checks. Lots of occurences of the same bug.. [PATCH] Fix mprotect bogus check. If we want to trap NULL vma's, we'd better be sure that we don't dereference it first.. [BRIDGE]: br_fdb.c needs init.h [PATCH] Fix typo in the openpromfs remount patch The just merged openpromfs remount patch contains a silly typo in the field of the super_operations structure. Fixed like this. Make sock_no_{get|set}opt() use the proper __user annotation Add sparse __safe annotation [IPV6]: Fix esp6.c typo in LIMIT_NETDEBUG changes. [PCMCIA] Conversion to module_param Patch from: Pavel Roskin As it turns out, mixing MODULE_PARM and module_param in one module is wrong. The parameters specified in module_param are ignored. I've just posted a patch to LKML that will detect this condition and warn about it. The new debugging code used the new-style module_param, which means that all instances of MODULE_PARM should be converted. The attached patch does that. An additional bonus is that module_param_array provides the number of array elements. This allowed me to change tcic.c and i82365.c to use this number for IRQ list. This change was tested with i82365. If "irq_list" is not specified, irq_list_count is 0. I set all permissions to 0444 to be safe. I think we have no secrets from the users regarding those parameters. If some parameters can be changed safely at the runtime, the permissions could be changed to 0644. I didn't examine how safe (and how useful) it would be, so it's 0444 for now. [SERIAL] Remove check_region() [SERIAL] Use module_param/module_param_array Update serial to use new module parameters rather than MODULE_PARM. [ARM] Add detailed documentation concerning ARM page tables This adds detailed documentation concerning how we map the Linux page table structure onto the hardware tables on ARM. In addition, it also adds documentation describing how we emulate the "dirty" and "young" or "accessed" page table bits. This should be of interest to Linux MM developers. [PATCH] Fix exec in multithreaded application The recent controlling terminal changes broke exec from multithreaded application because de_thread was not upgraded to new arrangement. I know that I should not have LD_PRELOAD library which automatically creates one thread, but it looked like a cool solution to the problem I had. de_thread must initialize the controlling terminal information in the new thread group. [PATCH] dm: Fix 64/32 bit ioctl problems. From: Kevin Corry Fix 64/32 bit ioctl problems. [PATCH] dm: Check the uptodate flag in sub-bios to see if there was an error. From: Kevin Corry Check the uptodate flag in sub-bios to see if there was an error. [Mike Christie] [PATCH] dm: Handle interrupts within suspend. From: Kevin Corry Handle interrupts within suspend. [PATCH] dm: Use wake_up() rather than wake_up_interruptible() From: Kevin Corry dm.c: Use wake_up() rather than wake_up_interruptible() with the eventq. [PATCH] dm: Log an error if the target has unknown target type, or zero length. From: Kevin Corry Log an error if the target has unknown target type, or zero length. [PATCH] dm: Correctly align the dm_target_spec structures during retrieve_status(). From: Kevin Corry Correctly align the dm_target_spec structures during retrieve_status(). [PATCH] dm: fix a comment From: Kevin Corry Clarify the comment regarding the "next" field in struct dm_target_spec. The "next" field has different behavior if you're performing a DM_TABLE_STATUS command than it does if you're performing a DM_TABLE_LOAD command. See populate_table() and retrieve_status() in drivers/md/dm-ioctl.c for more details on how this field is used. [PATCH] dm: avoid ioctl buffer overrun From: Kevin Corry dm-ioctl.c::retrieve_status(): Prevent overrunning the ioctl buffer by making sure we don't call the target status routine with a buffer size limit of zero. [Kevin Corry, Alasdair Kergon] [PATCH] dm: Use an EMIT macro in the status function. From: Kevin Corry Striped: Use an EMIT macro in the status function. [PATCH] kNFSdv4: nfsd4_readdir fixes From: NeilBrown From: "J. Bruce Fields" Fix out-of-spec errors in nfs4 readdir. Add checks for bad cookie values. (plus compile fix from akpm) [PATCH] kNFSdv4: Fix bad error returm from svcauth_gss_accept From: NeilBrown From: "J. Bruce Fields" Error return when the client supplies a bad service should be badcred. [PATCH] kNFSdv4: Keep state to allow replays for 'close' to work. From: NeilBrown From: "J. Bruce Fields" From: Andros: Idea is to keep around a list of openowners recently released by closes, and make sure they stay around long enough so that replays still work. [PATCH] kNFSdv4: Allow locku replays aswell From: NeilBrown From: "J. Bruce Fields" From: Andros: locku replies should be saved for possible replay as well. [PATCH] kNFSdv4: Improve how locking copes with replays From: NeilBrown From: "J. Bruce Fields" From: Andros: Hold state_lock longer so the stateowner doesn't diseappear out from under us before we get the chance to encode the replay. Don't attempt to save replay if we failed to find a stateowner. [PATCH] kNFSdv4: Set credentials properly when puutrootfh is used From: NeilBrown The credentials (uid/gid) of a process are set when a filehandle is verified. Nfsv4 allows requests without an explicit filehandle (instead, an implicit 'root' filehandle) so we much make sure the credentials are set for these requests too. From: "J. Bruce Fields" From: Andros: added a call to nfsd_setuser in nfsd4_putrootfh so that nfsd runs as the rpc->cred user. [PATCH] kNFSdv4: Implement server-side reboot recovery (mostly) From: NeilBrown From: "J. Bruce Fields" From: Andros: Implement server-side reboot recovery (server now handles open and lock reclaims). Not completely to spec: we don't yet store the state in stable storage that would be required to recover correctly in certain situations. [PATCH] kill submit_{bh,bio} return value From: Jeff Garzik Nobody ever checks the return value of submit_bh(), and submit_bh() is the only caller that checks the submit_bio() return value. This changes the kernel I/O submission path -- a fast path -- so this cleanup is also a microoptimization. [PATCH] PCI MSI Kconfig consolidation From: Bjorn Helgaas This consolidates the PCI MSI configuration into drivers/pci/Kconfig, removing it from the i386, x86_64, and ia64 Kconfig. It also changes the default for ia64 from "y" to "n". The default on i386 is "n" already, and I'm not sure why ia64 should be different. [PATCH] remove buffer_error() From: Jeff Garzik It was debug code, no longer required. [PATCH] Fix mq 32-bit compatibility From: Jakub Jelinek The first change removes just a useless put_user (si_int and si_ptr are part of the same union, si_ptr is on all arches covering whole union), the rest is fixes for signal handling of SI_MESGQ. [PATCH] ppc64: hugepage cleanup From: David Gibson This is a small cleanup to the PPC64 hugepage code. It removes an unhelpful function, removing some studlyCaps in the process. It was originally this way to match the normal page path, but that has all been rewritten since. [PATCH] Add "commit=0" to reiserfs From: Bart Samwel Add support for value 0 to the commit option of reiserfs. Means "restore to the default value". For the maximum commit age, this default value is normally read from the journal; this patch adds an extra variable to cache the default value for the maximum commit age. [PATCH] reiserfs: fsync() speedup From: Chris Mason Updates the reiserfs-logging improvements to use schedule_timeout instead of yield when letting the transaction grow a little before forcing a commit for fsync/O_SYNC/O_DIRECT. Also, when one process forces a transaction to end and plans on doing the commit (like fsync), it sets a flag on the transaction so the journal code knows not to bother kicking the journal work queue. queue_delayed_work is used so that if we get a bunch of tiny transactions ended quickly, we aren't constantly kicking the work queue. These significantly improve reiserfs performance during fsync heavy workloads. [PATCH] reiserfs: remove final sleep_on From: Chris Mason Get rid of the last sleep_on in the reiserfs code [PATCH] floppy98.c build fixes From: "Randy.Dunlap" floppy98.c (along with other PC-9800 files) has not been updated lately. It won't build currently (2.6.5). This patch makes floppy98 build cleanly. [PATCH] ipmi build fix From: Geert Uytterhoeven While compiling drivers/char/ipmi/ipmi_si_intf.c in 2.6.6-rc1 on m68k, I noticed a missing include (needed for disable_irq_nosync() and enable_irq()) [PATCH] ppc64: yet another hugepage cleanup From: David Gibson Trivial cleanup to flush_hash_hugepage() in the ppc64 hugepage code. [PATCH] Fix bogus get_page() calls in hugepage code From: David Gibson Some versions of follow_huge_addr() and follow_huge_pmd() are doing a get_page() on the target page. They shouldn't: follow_page() returns an unpinned page and it is the caller's responsibility to pin the page (if desired) before dropping page_table_lock. [PATCH] mqueue permission fix From: Manfred Spraul Any user can delete any entries in a mqueue mounted filesystem. The attached patch prevents that. - remove the writable test from mq_unlink. - set the sticky bit in the root inode. This affects both mq_unlink and sys_unlink: only the owner (and root) should be allowed to remove queues. [PATCH] aty128fb dereference before null check From: Dave Jones [PATCH] ARM-related ptep_to_address() fix From: William Lee Irwin III rmk mentioned that ARM was borked as the relation, assumed by generic rmap, PTRS_PER_PTE*sizeof(pte_t) == PAGE_SIZE, fails to hold. The following patch, developed jointly with him (or depending on POV, by him with me acting as codemonkey), is reported to resolve the issue. Specifically, while ARM dedicates an entire PAGE_SIZE -sized block of memory to each PTE table, the PTE table itself only spans half that, the remainder being dedicated to hardware-interpreted structures. As the hardware structure must be contiguous, wider ptes can't be used. So the core-visible PTE table only spans PAGE_SIZE/2 bytes, violating the assumption. This corrects masking and scaling done in ptep_to_address(). [PATCH] Remove unused 'kobject' from superblock The field in question is a) unused b) damn next to impossible to use correctly, due to struct super_block lifetime and locking rules. [PATCH] Fix vma corruption It occurred to me that if vma and new_vma are one and the same, then vma_relink_file will not do a good job of linking it after itself - in that pretty unlikely case when move_page_tables fails. And more generally, whenever copy_vma's vma_merge succeeds, we have no guarantee that old vma comes before new_vma in the i_mmap lists, as we need to satisfy Rajesh's point: that ordering is only guaranteed in the newly allocated case. We have to abandon the ordering method when/if we move from lists to prio_trees, so this patch switches to the less glamorous use of i_shared_sem exclusion, as in my prio_tree mremap. Allow non-LFS sendfile to work on LFS files. But obviously only if we're not passing in any offset pointer. This is how 2.4.x worked, and vsftpd relies on it. Bug reported by Chris < chris@scary.beasts.org> [PATCH] ppc64: Fix CPU hot unplug deadlock From: Benjamin Herrenschmidt My RTAS locking fixes incorrectly added a spinlock around the function used to stop a CPU, that function never returns, thus the lock becomes stale. The correct fix is to disable interrupts instead (the RTAS params beeing per-CPU, this should be safe enough) [PATCH] Fix unix module From: Rusty Russell # lsmod Module Size Used by 1 26060 6 # The compiler #define's unix to 1: we use -DKBUILD_MODNAME=unix. We used to #undef unix at the top of af_unix.c, but now the name is inserted by modpost, that doesn't help. #undef unix in modpost.c's generated C file. [PATCH] Oprofilefs cant handle > 99 cpus From: Anton Blanchard Oprofilefs cant handle > 99 cpus. This should fix it. [PATCH] rmap: flush_dcache revisited From: Hugh Dickins One of the callers of flush_dcache_page is do_generic_mapping_read, where file is read without i_sem and without page lock: concurrent truncation may at any moment remove page from cache, NULLing ->mapping, making flush_dcache_page liable to oops. Put result of page_mapping in a local variable and apply mapping_mapped to that (if we were to check for NULL within mapping_mapped, it's unclear whether to say yes or no). parisc and arm do have other locking unsafety in their i_mmap(_shared) searching, but that's a larger issue to be dealt with down the line. [PATCH] rmap: swap_unplug page From: Hugh Dickins Good example of "swapper_space considered harmful": swap_unplug_io_fn was originally designed for calling via swapper_space.backing_dev_info; but that way it loses track of which device is to be unplugged, so had to unplug all swap devices. But now sync_page tests SwapCache anyway, can call swap_unplug_io_fn with page, which leads direct to the device. Reverted -mc4's CONFIG_SWAP=n fix, just add another NOTHING for it. Reverted -mc3's editorial adjustments to swap_backing_dev_info and swapper_space initializations: they document the few fields which are actually used now, as comment above them says (sound of slapped wrist). [PATCH] rmap: nonlinear truncation From: Hugh Dickins The earlier changes introducing PageAnon left truncated pages mapped into nonlinear vmas unswappable. Once we go to object-based rmap, it's impossible to find where file page is mapped once page->mapping cleared: switching them to anonymous is odd, and breaks strict commit accounting. So now handle truncation of nonlinear vmas correctly. And factor in Daniel's cluster filesystem needs while we're there: when invalidating local cache, we do want to unmap shared pages from all mms, but we do not want to discard private COWed modifications of those pages (which truncation discards to satisfy the SIGBUS semantics demanded by specs). Drew from Daniel's patch (LKML 2 Mar 04), but didn't always follow it; fewer name changes, but still some - "unmap" rather than "invalidate". zap_page_range is not exported, safe to give it and all the too-many layers an extra zap_details arg, in normal cases just NULL. Given details, zap_pte_range checks page mapping or index to skip anon or untruncated pages. I didn't realize before implementing, that in nonlinear case, it should set a file pte when truncating - otherwise linear pages might appear in place of SIGBUS. I suspect this implies that ->populate functions ought to set file ptes beyond EOF instead of failing, but haven't changed them as yet. To avoid making yet another copy of that ugly linear pgidx test, added inline function linear_page_index (to pagemap.h to get PAGE_CACHE_SIZE, though as usual things don't really work if it differs from PAGE_SIZE). Ooh, I thought I'd removed ___add_to_page_cache last time, do so now. unmap_page_range static, shift its hugepage check up into sole caller unmap_vmas. Killed "killme" debug from unmap_vmas, not seen it trigger. unmap_mapping_range is exported without restriction: I'm one of those who believe it should be generally available. But I'm wrongly placed to decide that, probably just sob quietly to myself if _GPL added later. [PATCH] jbd: journal_dirty_metadata locking speedup Reduce the locking coverage of the oft-used j_list_lock: the per-bh jbd_lock_bh_state() gives us sufficient locking of buffer_head and journal_head internals. [PATCH] Print warning for common symbols in modules From: Rusty Russell People still build modules wrong, particularly without -fno-common. The resulting modules don't load, but we should at least warn about it. [PATCH] set_anon_super locking fix Take the idr's lock while removing an element on the error path. Spotted by Nathan Lynch . [PATCH] Fix laptop mode writeback triggered by hdparm -y. From: Bart Samwel Currently, an `hdparm -Y' can trigger a sync in laptop mode. We should only count fs-originated requests as being "disk activity". [PATCH] fix visws build From: Andrey Panin this small patch fixes visws build error in 2.6.5. [PATCH] Amiga A2065 Ethernet debug Amiga A2065 Ethernet: Add missing variable in debug code [PATCH] Amiga Ariadne Ethernet KERN_* Amiga Ariadne Ethernet: Add KERN_* prefixes to printk() messages [PATCH] Amiga Hydra Ethernet KERN_* Amiga Hydra Ethernet: Add KERN_* prefixes to printk() messages [PATCH] Amiga Zorro8390 Ethernet KERN_* Amiga Zorro8390 Ethernet: Add KERN_* prefixes to printk() messages Fix permission problem on include/video/neomagic.h [ARM] Clean up ARM includes This removes a number of unnecessary includes from the ARM specific files throughout the kernel. Most notably asm/pgalloc.h is needlessly included in several places. There were some places including it as a means to get at the cache flushing functions, so this has been corrected. [PATCH] Fix typo in previous patch This is my brown paper bag day, I sent you the wrong patch for fixing the deadlock in rtas.c, here's one to apply on top of current bk that fixes build. [PATCH] mace register_netdev printk small cosmetic fix for powermac mace network driver. eth%d: MACE at 00:05:02:f4:1b:1d, chip revision 25.64 vs. eth0: MACE at 00:05:02:f4:1b:1d, chip revision 25.64 [PATCH] 3c509 oops fix If __ISAPNP__ and CONFIG_X86_PC9800 are not set, we forget to link the device into the global chain and el3_init_module dereferences NULL. [wireless orinoco] Remove bogus !dev check Caught by Stanford checker. [PATCH] wan sdla: fix probable security hole > [BUG] minor > /home/kash/linux/linux-2.6.5/drivers/net/wan/sdla.c:1206:sdla_xfer: > ERROR:TAINT: 1201:1206:Passing unbounded user value "(mem).len" as arg 0 > to function "kmalloc", which uses it unsafely in model > [SOURCE_MODEL=(lib,copy_from_user,user,taintscalar)] > [SINK_MODEL=(lib,kmalloc,user,trustingsink)] [MINOR] [PATH=] [Also > used at, line 1219 in argument 0 to function "kmalloc"] > static int sdla_xfer(struct net_device *dev, struct sdla_mem *info, int > read) > { > struct sdla_mem mem; > char *temp; > > Start ---> > if(copy_from_user(&mem, info, sizeof(mem))) > return -EFAULT; > > if (read) > { > Error ---> > temp = kmalloc(mem.len, GFP_KERNEL); > if (!temp) > return(-ENOMEM); > sdla_read(dev, mem.addr, temp, mem.len); Hrm, I believe you could use this to read 128k of kernel memory. sdla_read() takes len as a short, whereas mem.len is an int. So, if mem.len == 0x20000, the allocation could still succeed. When cast to short, len will be 0x0, causing the read loop to copy nothing into the buffer. At least it's protected by a capable() check. I don't know what proper upper bound is for this hardware, or how much it's used/cared about. Simple memset() is trivial fix. [PATCH] remove redundant check in de2104x ->get_regs() Trivial patchlet...ethtool core already caps regs.len at a max of ->get_regs_len(): reglen = ops->get_regs_len(dev); if (regs.len > reglen) regs.len = reglen; So doing the same in the in de2104x driver ->get_regs() is redundant. Patch below simply removes it to clarify the guarantee of the API. [hamradio baycom] Remove bogus check in interrupt handler Tangentially noticed by Stanford checker. [netdrvr rcpci] Remove bogus check in ->remove handler [netdrvr r8169] remove driver-local DMA_xxBIT_MASK definitions They are now upstream, we don't need driver-local ones anymore. [PATCH] fix warning in drivers/net/tulip/timer.c I get the following warning in 2.6.5-mm6 and 2.6.6-rc1: <-- snip --> ... CC drivers/net/tulip/timer.o drivers/net/tulip/timer.c: In function `comet_timer': drivers/net/tulip/timer.c:156: warning: unused variable `ioaddr' ... <-- snip --> Since the [netdrvr tulip] add MII support for Comet chips patch has removed the only use of this variable, the fix is simple: [PATCH] e1000: fix probable security hole * Ken Ashcraft (ken@coverity.com) wrote: > [BUG] > /home/kash/linux/linux-2.6.5/drivers/net/e1000/e1000_ethtool.c:1494:e1000_ethtool_ioctl: ERROR:TAINT: 1487:1494:Passing unbounded user value "(regs).len" as arg 2 to function "copy_to_user", which uses it unsafely in model [SOURCE_MODEL=(lib,copy_from_user,user,taintscalar)] [SINK_MODEL=(lib,copy_to_user,user,trustingsink)] [PATH=] > } > case ETHTOOL_GREGS: { > struct ethtool_regs regs = {ETHTOOL_GREGS}; > uint32_t regs_buff[E1000_REGS_LEN]; > > Start ---> > if(copy_from_user(®s, addr, sizeof(regs))) > return -EFAULT; > e1000_ethtool_gregs(adapter, ®s, regs_buff); > if(copy_to_user(addr, ®s, sizeof(regs))) > return -EFAULT; > > addr += offsetof(struct ethtool_regs, data); > Error ---> > if(copy_to_user(addr, regs_buff, regs.len)) > return -EFAULT; > > return 0; Looks like a bug. Possible patch below zeros the buffer (since it's not filled completely by e1000_ethtool_gregs()), and truncates len. [PATCH] Mixed PCI/ISA device name conflicts In systems with mixed network cards, and all drivers compiled into the kernel; the PCI device (eth0) will get probed first, before the ISA. The problem is that the ISA device can mistakenly try to probe for eth0. The problem is that the ISA driver will not detect the failure until it goes to call register_netdevice, and not all drivers have perfect error unwind code. This patch short circuits the device probe, so it won't bother looking for devices that already are registered. [PATCH] fix arm/etherh.c On Tue, Apr 13, 2004 at 02:35:40PM -0400, Jeff Garzik wrote: > Russell, > > Would you be willing to provide an updated diff of this? I didn't particularly like the PRIV() method implemented previously - gcc appears to want to avoid some optimisations it if its an inline function rather than a macro. Also, 'ei_local' may look unused in some functions, but it's your typical hidden-use-in-a-macro crap which 8390 likes. [PATCH] Fix hw_random build on ia64 The following patch allows hw_random.c to build on ia64. (The problem was just that the VIA stuff has i386 assembly in it. The current code only probes for VIA on i386 anyway, so this patch just adds more ifdefs so the VIA code is only built for i386.) [PATCH] airo: Fix suspend support [PATCH] remove 8139too ring size option. On Wed, 31 Mar 2004 15:05:16 -0500 Jeff Garzik wrote: > I really should remove the ability to configure 8139_RXBUF_IDX=3. [PATCH] pcnet32.c add support for 79C976 Please apply the following patch to 2.6.5-rc2-bk9 and 2.4.26-rc1 to include support for the 79C976. Tested on IA32. [PATCH] Call SET_NETDEV_DEV() in a bunch of net drivers Used for sysfs support. [PATCH] missing s/dev->priv/netdev_priv(dev) in drivers/net/pcmcia/ On Wednesday 24 March 2004 23:25, Jeff Garzik wrote: > Daniel Ritz wrote: > > clean up the last two instances of dev->priv in drivers/net/pcmcia. > > against 2.6.5-rc2-bk. > > > > --- 1.27/drivers/net/pcmcia/3c589_cs.c Wed Mar 3 01:03:51 2004 > > +++ edited/drivers/net/pcmcia/3c589_cs.c Wed Mar 24 22:29:35 2004 > > @@ -716,7 +716,7 @@ > > "status %4.4x.\n", dev->name, (long)skb->len, > > inw(ioaddr + EL3_STATUS)); > > > > - ((struct el3_private *)dev->priv)->stats.tx_bytes += skb->len; > > + ((struct el3_private *)netdev_priv(dev))->stats.tx_bytes += skb->len; > > > > /* Put out the doubleword header... */ > > outw(skb->len, ioaddr + TX_FIFO); > > --- 1.24/drivers/net/pcmcia/ibmtr_cs.c Wed Mar 3 01:06:03 2004 > > +++ edited/drivers/net/pcmcia/ibmtr_cs.c Wed Mar 24 22:29:51 2004 > > @@ -444,7 +444,7 @@ > > link->state &= ~DEV_PRESENT; > > if (link->state & DEV_CONFIG) { > > /* set flag to bypass normal interrupt code */ > > - ((struct tok_info *)dev->priv)->sram_virt |= 1; > > + ((struct tok_info *)netdev_priv(dev))->sram_virt |= 1; > > netif_device_detach(dev); > > ibmtr_release(link); > > > although the patch is OK, the code itself is a bit yucky. > > Can you please create a temporary variable, of struct el3_private or > tok_info type, and eliminate that cast? > > struct el3_private *priv = netdev_priv(dev); > priv->stats.tx_bytes += skb->len; > > Much nicer :) > agreed. here we go... [PATCH] Tulip endianess fix My tulip ethernet card doesn't work on Blue&White G3 PowerMac with Linux 2.6.5-rc2. The card is shown by lspci as 01:03.0 Ethernet controller: Linksys Network Everywhere Fast Ethernet 10/100 model NC100 (rev 11) The kernel detects it as "ADMtek Comet rev 17". The MAC address reported by the kernel looked obviously wrong. Also, I could only ping the system successfully if the interface was in promiscuous mode (running Ethereal). Those two symptoms indicated two different problems - one for reading the MAC address from the card on module load (tulip_init_one), and the other for writing the address to the card when the interface was brought up (tulip_up). I have fixed both, and here's the explanation: tulip_init_one: When reading the first 4 bytes of the address, inl() returns the same data to the CPU on all platforms, interpreting the data from the lowest port address as the least significant byte. In other words, I/O is little endian on all platforms; it's the memory that differs across platforms. We want to write the data to memory preserving little-endianness of the PCI bus. To force little endian write to the memory, the data should be converted to the little endian format. When reading the remaining 2 bytes, the CPU gets them in 2 least significant bytes. To write those 2 bytes to the memory in a 16-bit operation, they should be byte-swapped for the 16-bit operation. tulip_up: The first 4 bytes are processed correctly, but the code is confusing. Reading from memory needs conversion to CPU format, while writing to I/O ports doesn't. So I replaced cpu_to_le32() to le32_to_cpu(). The second 2 bytes are read in a 16-bit memory operation, so they should be passed to le16_to_cpu() rather than cpu_to_le32() to make them CPU independent and suitable for outl(). All those conversions do nothing on little-endian machines, so they should not be affected. The patch has been tested. The driver is working fine. ping is OK, ssh is OK, X11 over ssh is OK. Even netconsole is working fine. [SPARC]: Add MQ syscall support. [ATM]: Warning fix for lec.h [NET]: Fix pc300_drv warnings. [IPV6]: Prevent IPV6=m and IP6_NF_QUEUE=y [IPSEC]: Add SPD priority for PF_KEY interface. [PATCH] ppc/ppc64: Add posix message queue syscalls From: Benjamin Herrenschmidt This patch adds the posix message queue syscalls to ppc32 and 64 and fixes our implementation of compat copy siginfo to 32 bits userland which wasn't using the si_code but still doing a switch/case on the signal number. I also reserved some syscalls for the numa API [PATCH] CPU_MASK_ALL fix From: Nick Piggin Do the typecast thing to permit CPU_MASK_ALL to be used both as an initialiser and as a normal rvalue. [PATCH] Rename PF_IOTHREAD to PF_NOFREEZE From: Nigel Cunningham A few weeks ago, Pavel and I agreed that PF_IOTHREAD should be renamed to PF_NOFREEZE. This reflects the fact that some threads so marked aren't actually used for IO while suspending, but simply shouldn't be frozen. This patch, against 2.6.5 vanilla, applies that change. In the refrigerator calls, the actual value doesn't matter (so long as it's non-zero) and it makes more sense to use PF_FREEZE so I've used that. [PATCH] idr.c: extra features enhancements From: Jim Houston - Adds idr_get_new_above(), whihc permits us to do a first-fit search from a specified offset rather than always from zero. - Add IDR_INIT() DEFINE_IDR() constructors. Often idr's are singletons and having to cook up an initcall for them is a pain. This is needed by the "Increase number of dynamic inodes in procfs" patch. [PATCH] fix load_elf_binary error path on unshare_files error From: Chris Wright Make sure to return proper retval on unshare_files() error in load_elf_binary. Error noted by Kirill Korotaev . [PATCH] Increase number of dynamic inodes in procfs From: Nathan Lynch On some larger ppc64 configurations /proc/device-tree is exhausting procfs' dynamic (non-pid) inode range (16K). This patch makes the dynamic inode range 0xf0000000-0xffffffff and changes the inode number allocator to use the idr.c allocator for the first-fit allocations. [PATCH] direct-IO return type fixes From: me, Badari Pulavarty Currently a direct-IO read or write of more than 2G on 64-bit machines is broken. Replace int with ssize_t in various places to fix that up. [PATCH] Fix default value for commit interval for older reiserfs filesystems. From: Bart Samwel The reiserfs patch that adds support for "commit=0" saves the default max commit age in a variable when the fs is originally mounted, so that it can later restore it. Unfortunately it makes some mistakes with that: - The default is not saved when the original mount has a commit=NNN option. - The default is not correctly saved for older reiserfs filesystems, where the default was not stored on disk. This patch fixes these mistakes. [PATCH] From: David Gibson hugepage_vma() is both misleadingly named and unnecessary. On most archs it always returns NULL, and on IA64 the vma it returns is never used. The function's real purpose is to determine whether the address it is passed is a special hugepage address which must be looked up in hugepage pagetables, rather than being looked up in the normal pagetables (which might have specially marked hugepage PMDs or PTEs). This patch kills off hugepage_vma() and folds the logic it really needs into follow_huge_addr(). That now returns a (page *) if called on a special hugepage address, and an error encoded with ERR_PTR otherwise. This also requires tweaking the IA64 code to check that the hugepage PTE is present in follow_huge_addr() - previously this was guaranteed, since it was only called if the address was in an existing hugepage VMA, and hugepages are always prefaulted. [PATCH] h8300 stack bounds checking From: William Lee Irwin III The stack is now shared with struct thread_info on most arches, not task_t. This mostly affects get_wchan() and stack usage debug. [PATCH] m68k stack bounds checking From: William Lee Irwin III The stack is now shared with struct thread_info on most arches, not task_t. This mostly affects get_wchan() and stack usage debug. [PATCH] m68knommu stack bounds checking From: William Lee Irwin III The stack is now shared with struct thread_info on most arches, not task_t. This mostly affects get_wchan() and stack usage debug. [PATCH] ppc32 stack bounds checking From: William Lee Irwin III The stack is now shared with struct thread_info on most arches, not task_t. This mostly affects get_wchan() and stack usage debug. [PATCH] sparc32 stack bounds checking From: William Lee Irwin III The stack is now shared with struct thread_info on most arches, not task_t. This mostly affects get_wchan() and stack usage debug. [PATCH] nfs token table can be __initdata nfs token table can be __initdata [PATCH] Warn if module_param and MODULE_PARM mixed From: Rusty Russell From: Pavel Roskin If you use both module_param (new) and MODULE_PARM (obsolete) in a module, only the second gets recognised. Warn. Remove unnecessary declaration of inline functions [PATCH] ide.c: split init_hwif_default() out of init_hwif_data() [PATCH] ide_init_default_hwifs() -> ide_init_default_irq() init_ide_data() initializes default IDE interfaces but without default IRQ (hwif->irq and hwif->hw.irq fields) so introduce ide_init_default_irq() and remove redundant ide_init_default_hwifs() (except arm26 and arm ones). As a side-effect it fixes: - CONFIG_BLK_DEV_HD_IDE if !CONFIG_BLK_DEV_IDEPCI (i386) - hwif->noprobe shouldn't be 0 if !hwif->io_ports[IDE_DATA_OFFSET] (alpha, i386, ia64, mips, sh, x86_64) [PATCH] generic ide_init_hwif_ports() Add generic ide_init_hwif_ports() to and remove arch specific versions except arm26, arm, h8300, i386-pc9800, m68k and m68knommu ones. [PATCH] ppc64: siginfo conversion fix My message queue patch fixes the 64 bits -> 32 bits conversion of siginfo, but didn't change the 32 -> 64 bits conversion done in sys32_rt_sigqueueinfo() which was apparently bogus as well. After much discussion & debate on the right way of converting that structure, I decided to go the sparc64 / s390 way, and not the x86_64 way, that is to copy the various unions data "as is". This guarantees that whatever a 32 bist app passes there, another 32 bits app will understand it. Crossover between 32 and 64 bits apps on such things as home-made userland siginfo isn't something we can help with anyway. The x86_64 choice of converting as if it was an RT signal, thus converting the sigval, cannot easily be applied to big endian archs since the sigval is a union of a ptr and an int, on BE, the int happens to be on the wrong half of the 64 bits ptr, thus we can't do a simple conversion. [PATCH] fix for potential deadlock after posix-timers change Ulrich has been working on the glibc code using posix-timers and stressing it more now than it has before. He ran into an SMP deadlock on process exit in the case there are pending queued signals from a timer. The deadlock arises because in the path through exit_itimers, the tasklist_lock is already held (for writing). When a timer is being deleted, sigqueue_free will try to take it (for reading) in the case where that timer has a pending signal queued on somebody's queue. This patch avoids the problem by making sure the queues are flushed before calling exit_itimers, thus ensuring its code path won't try to take tasklist_lock. [PATCH] reiserfs use-after-free fix From: Chris Mason reiserfs-delayed-work started using queue_delayed_work, but did not make sure the timer was finished before it freed the work queue structs during unmount. This leads to timer oopsen if you unmount at just the right time. [PATCH] fix madvise(MADV_DONTNEED) for nonlinear vmas From: Hugh Dickins Jamie points out that madvise(MADV_DONTNEED) should unmap pages from a nonlinear area in such a way that the nonlinear offsets are preserved if the pages do turn out to be needed later after all, instead of reverting them to linearity: needs to pass down a zap_details block. (But this still leaves mincore unaware of nonlinear vmas: bigger job.) [PATCH] pcnet32.c build fix Remove a duplicated case which recently snuck in there. [PATCH] hlist_add_after() fix From: "Pedro Emanuel M. D. Pinto" This currently-unused function is incorrectly implemented. Fix. [PATCH] remove duplicated COPYING file in fs/hfs/ From: Christoph Hellwig We don't need a copy of COPYING down in fs/hfs. Roman said he didn't mind, so.. [PATCH] MIPS: don't offer SERIAL_DZ on 64-bit DEC From: Ralf Baechle Limit the DZ driver to MIPS32 as the supported hardware is only present in R2k/R3k-based systems (unless someone sends Maciej a PMAC-A board for driver development). [PATCH] MIPS: update documentation files From: Ralf Baechle The pending changes to the MIPS doc files, more changes needed... [PATCH] MIPS update From: Ralf Baechle - more work on resurrecting AMD Alchemy platforms - cleanup of unnecessary inclusions - update default config files - cleanup 32-bit compat ioctl code - support for Montum Jaguar ATX - workarounds for early revs of the RM9000 - fixes for RM5000 and RM7000 cache handling - add support for PMC-Sierra Yosemite eval board - further cleanup and bugfixes for SGI IP27 - make LASAT and VR41xx build and work in 2.6 - improved SGI IP32 support - plenty of small fixes [PATCH] Fix CFQ elevator problem Remove bogus assert in CFQ and remove merge hints. Linux 2.6.6-rc2