Google Git
Sign in
kernel/pub/scm/linux/kernel/git/stable/stable-queue/bb1fd80e3aa7985fbf28e8a10ff2ecad3b61997a/./releases/2.6.16.12/send.mbox
blob: 1353c25bf3518aa5b508b57f7a38eb95e6eaab6d [file]
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:26 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk
Subject: [patch 00/24] -stable review
Content-Length: 734
Lines: 17
This is the start of the stable review cycle for the 2.6.16.12 release.
There are 24 patches in this series, all will be posted as a response to
this one. If anyone has any issues with these being applied, please let
us know. If anyone is a maintainer of the proper subsystem, and wants
to add a signed-off-by: line to the patch, please respond with it.
These patches are sent out with a number of different people on the Cc:
line. If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list. If you want to be off the reviewer list,
also email us.
Responses should be made by Sunday, April 30 00:00:00 UTC. Anything
received after that time, might be too late.
thanks,
the -stable release team
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001322.190063000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:27 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Arnaud MAZIN <arnaud.mazin@gmail.com>,
Stelian Pop <stelian@poppies.net>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 01/24] sonypi: correct detection of new ICH7-based laptops
Content-Disposition: inline; filename=sonypi-correct-detection-of-new-ich7-based-laptops.patch
Content-Length: 1132
Lines: 34
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Arnaud MAZIN <arnaud.mazin@gmail.com>
[PATCH] sonypi: correct detection of new ICH7-based laptops
Add a test to detect the ICH7 based Core Duo SONY laptops (such as the SZ1)
as type3 models.
Signed-off-by: Arnaud MAZIN <arnaud.mazin@gmail.com>
Acked-by: Stelian Pop <stelian@poppies.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/sonypi.c | 3 +++
1 file changed, 3 insertions(+)
--- linux-2.6.16.11.orig/drivers/char/sonypi.c
+++ linux-2.6.16.11/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct
else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+ else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+ PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+ sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
else
sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
--
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001322.331437000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:28 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Thayumanavar Sachithanantham <thayumk@gmail.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 02/24] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups
Content-Disposition: inline; filename=cs5535_gpio.c-call-cdev_del-during-module_exit-to-unmap-kobject-references-and-other-cleanups.patch
Content-Length: 1422
Lines: 41
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Thayumanavar Sachithanantham <thayumk@gmail.com>
[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups
During module unloading, cdev_del() must be called to unmap cdev related
kobject references and other cleanups(such as inode->i_cdev being set to
NULL) which prevents the OOPS upon subsequent loading, usage and unloading
of modules(as seen in the mail thread
http://marc.theaimsgroup.com/?l=linux-kernel&m=114533640609018&w=2).
Also, remove unneeded test of gpio_base.
Signed-off-by: Thayumanavar Sachithanantham <thayumk@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/cs5535_gpio.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/drivers/char/cs5535_gpio.c
+++ linux-2.6.16.11/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
static void __exit cs5535_gpio_cleanup(void)
{
dev_t dev_id = MKDEV(major, 0);
+
+ cdev_del(&cs5535_gpio_cdev);
unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
- if (gpio_base != 0)
- release_region(gpio_base, CS5535_GPIO_SIZE);
+ release_region(gpio_base, CS5535_GPIO_SIZE);
}
module_init(cs5535_gpio_init);
--
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001322.474436000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:29 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Jason Baron <jbaron@redhat.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 03/24] make vm86 call audit_syscall_exit
Content-Disposition: inline; filename=make-vm86-call-audit_syscall_exit.patch
Content-Length: 3573
Lines: 106
-stable review patch. If anyone has any objections, please let us know.
------------------
hi,
The motivation behind the patch below was to address messages in
/var/log/messages such as:
Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing
multiple contexts (1)
Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing
multiple contexts (2)
I can reproduce by running 'get-edid' from:
http://john.fremlin.de/programs/linux/read-edid/.
These messages come about in the log b/c the vm86 calls do not exit via
the normal system call exit paths and thus do not call
'audit_syscall_exit'. The next system call will then free the context for
itself and for the vm86 context, thus generating the above messages. This
patch addresses the issue by simply adding a call to 'audit_syscall_exit'
from the vm86 code.
Besides fixing the above error messages the patch also now allows vm86
system calls to become auditable. This is useful since strace does not
appear to properly record the return values from sys_vm86.
I think this patch is also a step in the right direction in terms of
cleaning up some core auditing code. If we can correct any other paths
that do not properly call the audit exit and entries points, then we can
also eliminate the notion of context chaining.
I've tested this patch by verifying that the log messages no longer
appear, and that the audit records for sys_vm86 appear to be correct.
Also, 'read_edid' produces itentical output.
thanks,
-Jason
Signed-off-by: Jason Baron <jbaron@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
---
arch/i386/kernel/vm86.c | 12 ++++++++++--
kernel/auditsc.c | 5 -----
2 files changed, 10 insertions(+), 7 deletions(-)
--- linux-2.6.16.11.orig/arch/i386/kernel/vm86.c
+++ linux-2.6.16.11/arch/i386/kernel/vm86.c
@@ -43,6 +43,7 @@
#include <linux/smp_lock.h>
#include <linux/highmem.h>
#include <linux/ptrace.h>
+#include <linux/audit.h>
#include <asm/uaccess.h>
#include <asm/io.h>
@@ -252,6 +253,7 @@ out:
static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk)
{
struct tss_struct *tss;
+ long eax;
/*
* make sure the vm86() system call doesn't try to do anything silly
*/
@@ -305,13 +307,19 @@ static void do_sys_vm86(struct kernel_vm
tsk->thread.screen_bitmap = info->screen_bitmap;
if (info->flags & VM86_SCREEN_BITMAP)
mark_screen_rdonly(tsk->mm);
+ __asm__ __volatile__("xorl %eax,%eax; movl %eax,%fs; movl %eax,%gs\n\t");
+ __asm__ __volatile__("movl %%eax, %0\n" :"=r"(eax));
+
+ /*call audit_syscall_exit since we do not exit via the normal paths */
+ if (unlikely(current->audit_context))
+ audit_syscall_exit(current, AUDITSC_RESULT(eax), eax);
+
__asm__ __volatile__(
- "xorl %%eax,%%eax; movl %%eax,%%fs; movl %%eax,%%gs\n\t"
"movl %0,%%esp\n\t"
"movl %1,%%ebp\n\t"
"jmp resume_userspace"
: /* no outputs */
- :"r" (&info->regs), "r" (task_thread_info(tsk)) : "ax");
+ :"r" (&info->regs), "r" (task_thread_info(tsk)));
/* we never return here */
}
--- linux-2.6.16.11.orig/kernel/auditsc.c
+++ linux-2.6.16.11/kernel/auditsc.c
@@ -966,11 +966,6 @@ void audit_syscall_entry(struct task_str
if (context->in_syscall) {
struct audit_context *newctx;
-#if defined(__NR_vm86) && defined(__NR_vm86old)
- /* vm86 mode should only be entered once */
- if (major == __NR_vm86 || major == __NR_vm86old)
- return;
-#endif
#if AUDIT_DEBUG
printk(KERN_ERR
"audit(:%d) pid=%d in syscall=%d;"
--
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001322.615019000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:30 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
brian.b@hp.com,
Andi Kleen <ak@suse.de>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 04/24] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages
Content-Disposition: inline; filename=x86_64-pass-32-to-the-assembler-when-compiling-the-32bit-vsyscall-pages.patch
Content-Length: 1070
Lines: 35
-stable review patch. If anyone has any objections, please let us know.
------------------
This quietens warnings and actually fixes a bug. The unwind tables would
come out wrong without -32, causing pthread cancellation during them
to crash in the gcc runtime.
The problem seems to only happen with newer binutils
(it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5)
Thanks to Brian Baker @ HP for test case and initial analysis.
Cc: brian.b@hp.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86_64/ia32/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/arch/x86_64/ia32/Makefile
+++ linux-2.6.16.11/arch/x86_64/ia32/Makefile
@@ -27,5 +27,5 @@ $(obj)/vsyscall-sysenter.so $(obj)/vsysc
$(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
$(call if_changed,syscall)
-AFLAGS_vsyscall-sysenter.o = -m32
-AFLAGS_vsyscall-syscall.o = -m32
+AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32
+AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32
--
From greg@quad.kroah.org Thu Apr 27 17:13:22 2006
Message-Id: <20060428001322.752580000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:31 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
mikew@google.com,
Andi Kleen <ak@suse.de>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 05/24] x86_64: Fix a race in the free_iommu path.
Content-Disposition: inline; filename=x86_64-fix-a-race-in-the-free_iommu-path.patch
Content-Length: 1308
Lines: 40
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Mike Waychison <mikew@google.com>
We do this by removing a micro-optimization that tries to avoid grabbing
the iommu_bitmap_lock spinlock and using a bus-locked operation.
This still races with other simultaneous alloc_iommu or free_iommu(size
> 1) which both use bus-unlocked operations.
The end result of this race is eventually ending
up with an iommu_gart_bitmap that has bits errornously set all over,
making large contiguous iommu space allocations fail with 'PCI-DMA:
Out of IOMMU space'.
Signed-off-by: Mike Waychison <mikew@google.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/x86_64/kernel/pci-gart.c | 4 ----
1 file changed, 4 deletions(-)
--- linux-2.6.16.11.orig/arch/x86_64/kernel/pci-gart.c
+++ linux-2.6.16.11/arch/x86_64/kernel/pci-gart.c
@@ -114,10 +114,6 @@ static unsigned long alloc_iommu(int siz
static void free_iommu(unsigned long offset, int size)
{
unsigned long flags;
- if (size == 1) {
- clear_bit(offset, iommu_gart_bitmap);
- return;
- }
spin_lock_irqsave(&iommu_bitmap_lock, flags);
__clear_bit_string(iommu_gart_bitmap, offset, size);
spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001322.901074000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:32 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Eric Sesterhenn <snakebyte@gmx.de>,
smurf@smurf.noris.de,
Adrian Bunk <bunk@stusta.de>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 06/24] USB: fix array overrun in drivers/usb/serial/option.c
Content-Disposition: inline; filename=usb-fix-array-overrun-in-drivers-usb-serial-option.c.patch
Content-Length: 1404
Lines: 40
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Eric Sesterhenn <snakebyte@gmx.de>
since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB] both for loops, go one
over the end of the array. This fixes coverity id #555
This patch was already included in Linus' tree.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/serial/option.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/drivers/usb/serial/option.c
+++ linux-2.6.16.11/drivers/usb/serial/option.c
@@ -582,14 +582,14 @@ static void option_setup_urbs(struct usb
portdata = usb_get_serial_port_data(port);
/* Do indat endpoints first */
- for (j = 0; j <= N_IN_URB; ++j) {
+ for (j = 0; j < N_IN_URB; ++j) {
portdata->in_urbs[j] = option_setup_urb (serial,
port->bulk_in_endpointAddress, USB_DIR_IN, port,
portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
}
/* outdat endpoints */
- for (j = 0; j <= N_OUT_URB; ++j) {
+ for (j = 0; j < N_OUT_URB; ++j) {
portdata->out_urbs[j] = option_setup_urb (serial,
port->bulk_out_endpointAddress, USB_DIR_OUT, port,
portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.038996000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:33 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
dsd@gentoo.org,
mm-commits@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 07/24] tipar oops fix
Content-Disposition: inline; filename=tipar-oops-fix.patch
Content-Length: 1036
Lines: 33
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Daniel Drake <dsd@gentoo.org>
If compiled into the kernel, parport_register_driver() is called before the
parport driver has been initalised.
This means that it is expected that tp_count is 0 after the
parport_register_driver() call() - tipar's attach function will not be
called until later during bootup.
Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/tipar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.11.orig/drivers/char/tipar.c
+++ linux-2.6.16.11/drivers/char/tipar.c
@@ -515,7 +515,7 @@ tipar_init_module(void)
err = PTR_ERR(tipar_class);
goto out_chrdev;
}
- if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+ if (parport_register_driver(&tipar_driver)) {
printk(KERN_ERR "tipar: unable to register with parport\n");
err = -EIO;
goto out_class;
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.183224000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:34 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Michael Krufky <mkrufky@linuxtv.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 08/24] get_dvb_firmware: download nxt2002 firmware from new driver location
Content-Disposition: inline; filename=get_dvb_firmware-download-nxt2002-firmware-from-new-driver-location.patch
Content-Length: 1403
Lines: 44
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael Krufky <mkrufky@linuxtv.org>
BBTI has updated their driver, and removed the old one from their website.
This patch updates the get_dvb_firmware script to download the firmware
from the new driver location.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
Documentation/dvb/get_dvb_firmware | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- linux-2.6.16.11.orig/Documentation/dvb/get_dvb_firmware
+++ linux-2.6.16.11/Documentation/dvb/get_dvb_firmware
@@ -240,9 +240,9 @@ sub dibusb {
}
sub nxt2002 {
- my $sourcefile = "Broadband4PC_4_2_11.zip";
+ my $sourcefile = "Technisat_DVB-PC_4_4_COMPACT.zip";
my $url = "http://www.bbti.us/download/windows/$sourcefile";
- my $hash = "c6d2ea47a8f456d887ada0cfb718ff2a";
+ my $hash = "476befae8c7c1bb9648954060b1eec1f";
my $outfile = "dvb-fe-nxt2002.fw";
my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
@@ -250,8 +250,8 @@ sub nxt2002 {
wgetfile($sourcefile, $url);
unzip($sourcefile, $tmpdir);
- verify("$tmpdir/SkyNETU.sys", $hash);
- extract("$tmpdir/SkyNETU.sys", 375832, 5908, $outfile);
+ verify("$tmpdir/SkyNET.sys", $hash);
+ extract("$tmpdir/SkyNET.sys", 331624, 5908, $outfile);
$outfile;
}
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.317460000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:35 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
norbert@tretkowski.de,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 09/24] for_each_possible_cpu
Content-Disposition: inline; filename=for_each_possible_cpu.patch
Content-Length: 863
Lines: 29
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Andrew Morton <akpm@osdl.org>
Backport for_each_possible_cpu() into 2.6.16. Fixes the alpha build, and any
future occurrences.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/linux/cpumask.h | 1 +
1 file changed, 1 insertion(+)
--- linux-2.6.16.11.orig/include/linux/cpumask.h
+++ linux-2.6.16.11/include/linux/cpumask.h
@@ -408,6 +408,7 @@ extern cpumask_t cpu_present_map;
})
#define for_each_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
+#define for_each_possible_cpu(cpu) for_each_cpu_mask((cpu), cpu_possible_map)
#define for_each_online_cpu(cpu) for_each_cpu_mask((cpu), cpu_online_map)
#define for_each_present_cpu(cpu) for_each_cpu_mask((cpu), cpu_present_map)
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.459743000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:36 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Jose Alberto Reguero <jareguero@telefonica.net>,
Mauro Carvalho Chehab <mchehab@infradead.org>,
Hans Verkuil <hverkuil@xs4all.nl>,
Michael Krufky <mkrufky@linuxtv.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 10/24] fix saa7129 support in saa7127 module for pvr350 tv out
Content-Disposition: inline; filename=fix-saa7129-support-in-saa7127-module-for-pvr350-tv-out.patch
Content-Length: 1013
Lines: 32
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jose Alberto Reguero <jareguero@telefonica.net>
This patch fixes tv-out support for the newer model of
the pvr350, which has a saa7129 instead of a saa7127
video encoder.
Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/video/saa7127.c | 1 +
1 file changed, 1 insertion(+)
--- linux-2.6.16.11.orig/drivers/media/video/saa7127.c
+++ linux-2.6.16.11/drivers/media/video/saa7127.c
@@ -141,6 +141,7 @@ struct i2c_reg_value {
static const struct i2c_reg_value saa7129_init_config_extra[] = {
{ SAA7127_REG_OUTPUT_PORT_CONTROL, 0x38 },
{ SAA7127_REG_VTRIG, 0xfa },
+ { 0, 0 }
};
static const struct i2c_reg_value saa7127_init_config_common[] = {
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.610742000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:37 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Michael Krufky <mkrufky@linuxtv.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 11/24] cxusb-bluebird: bug-fix: power down corrupts frontend
Content-Disposition: inline; filename=cxusb-bluebird-bug-fix-power-down-corrupts-frontend.patch
Content-Length: 2736
Lines: 77
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Michael Krufky <mkrufky@linuxtv.org>
This patch prevents a bug where the frontend is unable to tune after waking
from powered down state. Now, the device remains powered on until it is
disconnected, just like the windows driver. It seems that the bluebird
firmware is unable to successfully handle tuning after a powered down state.
This patch fixes all of the FusionHDTV Bluebird USB2 devices. The Medion
MD95700 will still behave as before, since it was unaffected by this bug.
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/media/dvb/dvb-usb/cxusb.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- linux-2.6.16.11.orig/drivers/media/dvb/dvb-usb/cxusb.c
+++ linux-2.6.16.11/drivers/media/dvb/dvb-usb/cxusb.c
@@ -149,6 +149,15 @@ static int cxusb_power_ctrl(struct dvb_u
return cxusb_ctrl_msg(d, CMD_POWER_OFF, &b, 1, NULL, 0);
}
+static int cxusb_bluebird_power_ctrl(struct dvb_usb_device *d, int onoff)
+{
+ u8 b = 0;
+ if (onoff)
+ return cxusb_ctrl_msg(d, CMD_POWER_ON, &b, 1, NULL, 0);
+ else
+ return 0;
+}
+
static int cxusb_streaming_ctrl(struct dvb_usb_device *d, int onoff)
{
u8 buf[2] = { 0x03, 0x00 };
@@ -505,7 +514,7 @@ static struct dvb_usb_properties cxusb_b
.size_of_priv = sizeof(struct cxusb_state),
.streaming_ctrl = cxusb_streaming_ctrl,
- .power_ctrl = cxusb_power_ctrl,
+ .power_ctrl = cxusb_bluebird_power_ctrl,
.frontend_attach = cxusb_lgdt3303_frontend_attach,
.tuner_attach = cxusb_lgh064f_tuner_attach,
@@ -545,7 +554,7 @@ static struct dvb_usb_properties cxusb_b
.size_of_priv = sizeof(struct cxusb_state),
.streaming_ctrl = cxusb_streaming_ctrl,
- .power_ctrl = cxusb_power_ctrl,
+ .power_ctrl = cxusb_bluebird_power_ctrl,
.frontend_attach = cxusb_dee1601_frontend_attach,
.tuner_attach = cxusb_dee1601_tuner_attach,
@@ -594,7 +603,7 @@ static struct dvb_usb_properties cxusb_b
.size_of_priv = sizeof(struct cxusb_state),
.streaming_ctrl = cxusb_streaming_ctrl,
- .power_ctrl = cxusb_power_ctrl,
+ .power_ctrl = cxusb_bluebird_power_ctrl,
.frontend_attach = cxusb_mt352_frontend_attach,
.tuner_attach = cxusb_lgz201_tuner_attach,
@@ -634,7 +643,7 @@ static struct dvb_usb_properties cxusb_b
.size_of_priv = sizeof(struct cxusb_state),
.streaming_ctrl = cxusb_streaming_ctrl,
- .power_ctrl = cxusb_power_ctrl,
+ .power_ctrl = cxusb_bluebird_power_ctrl,
.frontend_attach = cxusb_mt352_frontend_attach,
.tuner_attach = cxusb_dtt7579_tuner_attach,
--
From greg@quad.kroah.org Thu Apr 27 17:13:23 2006
Message-Id: <20060428001323.749218000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:38 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Alasdair G Kergon <agk@redhat.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 12/24] dm snapshot: fix kcopyd destructor
Content-Disposition: inline; filename=dm-snapshot-fix-kcopyd-destructor.patch
Content-Length: 3140
Lines: 111
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Alasdair G Kergon <agk@redhat.com>
Before removing a snapshot, wait for the completion of any kcopyd jobs using
it.
Do this by maintaining a count (nr_jobs) of how many outstanding jobs each
kcopyd_client has.
The snapshot destructor first unregisters the snapshot so that no new kcopyd
jobs (created by writes to the origin) will reference that particular
snapshot. kcopyd_client_destroy() is now run next to wait for the completion
of any outstanding jobs before the snapshot exception structures (that those
jobs reference) are freed.
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/md/dm-snap.c | 6 +++++-
drivers/md/kcopyd.c | 17 ++++++++++++++++-
2 files changed, 21 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/drivers/md/dm-snap.c
+++ linux-2.6.16.11/drivers/md/dm-snap.c
@@ -542,8 +542,12 @@ static void snapshot_dtr(struct dm_targe
{
struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
+ /* Prevent further origin writes from using this snapshot. */
+ /* After this returns there can be no new kcopyd jobs. */
unregister_snapshot(s);
+ kcopyd_client_destroy(s->kcopyd_client);
+
exit_exception_table(&s->pending, pending_cache);
exit_exception_table(&s->complete, exception_cache);
@@ -552,7 +556,7 @@ static void snapshot_dtr(struct dm_targe
dm_put_device(ti, s->origin);
dm_put_device(ti, s->cow);
- kcopyd_client_destroy(s->kcopyd_client);
+
kfree(s);
}
--- linux-2.6.16.11.orig/drivers/md/kcopyd.c
+++ linux-2.6.16.11/drivers/md/kcopyd.c
@@ -44,6 +44,9 @@ struct kcopyd_client {
struct page_list *pages;
unsigned int nr_pages;
unsigned int nr_free_pages;
+
+ wait_queue_head_t destroyq;
+ atomic_t nr_jobs;
};
static struct page_list *alloc_pl(void)
@@ -293,10 +296,15 @@ static int run_complete_job(struct kcopy
int read_err = job->read_err;
unsigned int write_err = job->write_err;
kcopyd_notify_fn fn = job->fn;
+ struct kcopyd_client *kc = job->kc;
- kcopyd_put_pages(job->kc, job->pages);
+ kcopyd_put_pages(kc, job->pages);
mempool_free(job, _job_pool);
fn(read_err, write_err, context);
+
+ if (atomic_dec_and_test(&kc->nr_jobs))
+ wake_up(&kc->destroyq);
+
return 0;
}
@@ -431,6 +439,7 @@ static void do_work(void *ignored)
*/
static void dispatch_job(struct kcopyd_job *job)
{
+ atomic_inc(&job->kc->nr_jobs);
push(&_pages_jobs, job);
wake();
}
@@ -670,6 +679,9 @@ int kcopyd_client_create(unsigned int nr
return r;
}
+ init_waitqueue_head(&kc->destroyq);
+ atomic_set(&kc->nr_jobs, 0);
+
client_add(kc);
*result = kc;
return 0;
@@ -677,6 +689,9 @@ int kcopyd_client_create(unsigned int nr
void kcopyd_client_destroy(struct kcopyd_client *kc)
{
+ /* Wait for completion of all jobs submitted by this client. */
+ wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
+
dm_io_put(kc->nr_pages);
client_free_pages(kc);
client_del(kc);
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001323.890281000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:39 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Junichi Nomura <j-nomura@ce.jp.nec.com>,
Alasdair G Kergon <agk@redhat.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 13/24] dm flush queue EINTR
Content-Disposition: inline; filename=dm-flush-queue-EINTR.patch
Content-Length: 1248
Lines: 41
-stable review patch. If anyone has any objections, please let us know.
------------------
If dm_suspend() is cancelled, bios already added to the deferred list need to
be submitted. Otherwise they remain 'in limbo' until there's a dm_resume().
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/md/dm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- linux-2.6.16.11.orig/drivers/md/dm.c
+++ linux-2.6.16.11/drivers/md/dm.c
@@ -1098,6 +1098,7 @@ int dm_suspend(struct mapped_device *md,
{
struct dm_table *map = NULL;
DECLARE_WAITQUEUE(wait, current);
+ struct bio *def;
int r = -EINVAL;
down(&md->suspend_lock);
@@ -1157,9 +1158,11 @@ int dm_suspend(struct mapped_device *md,
/* were we interrupted ? */
r = -EINTR;
if (atomic_read(&md->pending)) {
+ clear_bit(DMF_BLOCK_IO, &md->flags);
+ def = bio_list_get(&md->deferred);
+ __flush_deferred_io(md, def);
up_write(&md->io_lock);
unlock_fs(md);
- clear_bit(DMF_BLOCK_IO, &md->flags);
goto out;
}
up_write(&md->io_lock);
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.028668000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:40 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Joe Korty <joe.korty@ccur.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 14/24] Simplify proc/devices and fix early termination regression
Content-Disposition: inline; filename=simplify-proc-devices-and-fix-early-termination-regression.patch
Content-Length: 13788
Lines: 537
-stable review patch. If anyone has any objections, please let us know.
------------------
Repair /proc/devices early-termination regression.
2.6.16 broke /proc/devices. An application often gets an
EOF before the end of data is reached, if that application
uses a series of short read(2)s to access the data. I have
used read buffers of varying sizes with varying degrees
of unsuccess (larger sizes get further into the data than
smaller sizes, following a simple pattern). It appears
that the only safe way to get the data is to use a single
read buffer larger than all the data in /proc/devices.
The following example demonstates the problem:
# dd if=/proc/devices bs=1
Character devices:
1 mem
27+0 records in
27+0 records out
This patch is a backport of the fix recently accepted to
Linus's tree:
commit 68eef3b4791572ecb70249c7fb145bb3742dd899
[PATCH] Simplify proc/devices and fix early termination regression
It replaces the complex, state-machine algorithm introduced
in 2.6.16 with a simple algorithm, modeled on the implementation
of /proc/interrupts.
[akpm@osdl.org: cleanups, simplifications]
Signed-off-by: Joe Korty <joe.korty@ccur.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
block/genhd.c | 103 +++------------------------------
fs/char_dev.c | 87 +++-------------------------
fs/proc/proc_misc.c | 161 +++++++++++-----------------------------------------
include/linux/fs.h | 15 +---
4 files changed, 61 insertions(+), 305 deletions(-)
--- linux-2.6.16.11.orig/block/genhd.c
+++ linux-2.6.16.11/block/genhd.c
@@ -16,8 +16,6 @@
#include <linux/kobj_map.h>
#include <linux/buffer_head.h>
-#define MAX_PROBE_HASH 255 /* random */
-
static struct subsystem block_subsys;
static DECLARE_MUTEX(block_subsys_sem);
@@ -30,108 +28,29 @@ static struct blk_major_name {
struct blk_major_name *next;
int major;
char name[16];
-} *major_names[MAX_PROBE_HASH];
+} *major_names[BLKDEV_MAJOR_HASH_SIZE];
/* index in the above - for now: assume no multimajor ranges */
static inline int major_to_index(int major)
{
- return major % MAX_PROBE_HASH;
-}
-
-struct blkdev_info {
- int index;
- struct blk_major_name *bd;
-};
-
-/*
- * iterate over a list of blkdev_info structures. allows
- * the major_names array to be iterated over from outside this file
- * must be called with the block_subsys_sem held
- */
-void *get_next_blkdev(void *dev)
-{
- struct blkdev_info *info;
-
- if (dev == NULL) {
- info = kmalloc(sizeof(*info), GFP_KERNEL);
- if (!info)
- goto out;
- info->index=0;
- info->bd = major_names[info->index];
- if (info->bd)
- goto out;
- } else {
- info = dev;
- }
-
- while (info->index < ARRAY_SIZE(major_names)) {
- if (info->bd)
- info->bd = info->bd->next;
- if (info->bd)
- goto out;
- /*
- * No devices on this chain, move to the next
- */
- info->index++;
- info->bd = (info->index < ARRAY_SIZE(major_names)) ?
- major_names[info->index] : NULL;
- if (info->bd)
- goto out;
- }
-
-out:
- return info;
-}
-
-void *acquire_blkdev_list(void)
-{
- down(&block_subsys_sem);
- return get_next_blkdev(NULL);
-}
-
-void release_blkdev_list(void *dev)
-{
- up(&block_subsys_sem);
- kfree(dev);
+ return major % BLKDEV_MAJOR_HASH_SIZE;
}
+#ifdef CONFIG_PROC_FS
-/*
- * Count the number of records in the blkdev_list.
- * must be called with the block_subsys_sem held
- */
-int count_blkdev_list(void)
+void blkdev_show(struct seq_file *f, off_t offset)
{
- struct blk_major_name *n;
- int i, count;
-
- count = 0;
+ struct blk_major_name *dp;
- for (i = 0; i < ARRAY_SIZE(major_names); i++) {
- for (n = major_names[i]; n; n = n->next)
- count++;
+ if (offset < BLKDEV_MAJOR_HASH_SIZE) {
+ down(&block_subsys_sem);
+ for (dp = major_names[offset]; dp; dp = dp->next)
+ seq_printf(f, "%3d %s\n", dp->major, dp->name);
+ up(&block_subsys_sem);
}
-
- return count;
-}
-
-/*
- * extract the major and name values from a blkdev_info struct
- * passed in as a void to *dev. Must be called with
- * block_subsys_sem held
- */
-int get_blkdev_info(void *dev, int *major, char **name)
-{
- struct blkdev_info *info = dev;
-
- if (info->bd == NULL)
- return 1;
-
- *major = info->bd->major;
- *name = info->bd->name;
- return 0;
}
+#endif /* CONFIG_PROC_FS */
int register_blkdev(unsigned int major, const char *name)
{
--- linux-2.6.16.11.orig/fs/char_dev.c
+++ linux-2.6.16.11/fs/char_dev.c
@@ -15,6 +15,7 @@
#include <linux/module.h>
#include <linux/smp_lock.h>
#include <linux/devfs_fs_kernel.h>
+#include <linux/seq_file.h>
#include <linux/kobject.h>
#include <linux/kobj_map.h>
@@ -26,8 +27,6 @@
static struct kobj_map *cdev_map;
-#define MAX_PROBE_HASH 255 /* random */
-
static DECLARE_MUTEX(chrdevs_lock);
static struct char_device_struct {
@@ -38,93 +37,29 @@ static struct char_device_struct {
char name[64];
struct file_operations *fops;
struct cdev *cdev; /* will die */
-} *chrdevs[MAX_PROBE_HASH];
+} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
/* index in the above */
static inline int major_to_index(int major)
{
- return major % MAX_PROBE_HASH;
-}
-
-struct chrdev_info {
- int index;
- struct char_device_struct *cd;
-};
-
-void *get_next_chrdev(void *dev)
-{
- struct chrdev_info *info;
-
- if (dev == NULL) {
- info = kmalloc(sizeof(*info), GFP_KERNEL);
- if (!info)
- goto out;
- info->index=0;
- info->cd = chrdevs[info->index];
- if (info->cd)
- goto out;
- } else {
- info = dev;
- }
-
- while (info->index < ARRAY_SIZE(chrdevs)) {
- if (info->cd)
- info->cd = info->cd->next;
- if (info->cd)
- goto out;
- /*
- * No devices on this chain, move to the next
- */
- info->index++;
- info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
- chrdevs[info->index] : NULL;
- if (info->cd)
- goto out;
- }
-
-out:
- return info;
-}
-
-void *acquire_chrdev_list(void)
-{
- down(&chrdevs_lock);
- return get_next_chrdev(NULL);
-}
-
-void release_chrdev_list(void *dev)
-{
- up(&chrdevs_lock);
- kfree(dev);
+ return major % CHRDEV_MAJOR_HASH_SIZE;
}
+#ifdef CONFIG_PROC_FS
-int count_chrdev_list(void)
+void chrdev_show(struct seq_file *f, off_t offset)
{
struct char_device_struct *cd;
- int i, count;
-
- count = 0;
- for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
- for (cd = chrdevs[i]; cd; cd = cd->next)
- count++;
+ if (offset < CHRDEV_MAJOR_HASH_SIZE) {
+ down(&chrdevs_lock);
+ for (cd = chrdevs[offset]; cd; cd = cd->next)
+ seq_printf(f, "%3d %s\n", cd->major, cd->name);
+ up(&chrdevs_lock);
}
-
- return count;
}
-int get_chrdev_info(void *dev, int *major, char **name)
-{
- struct chrdev_info *info = dev;
-
- if (info->cd == NULL)
- return 1;
-
- *major = info->cd->major;
- *name = info->cd->name;
- return 0;
-}
+#endif /* CONFIG_PROC_FS */
/*
* Register a single major with a specified minor range.
--- linux-2.6.16.11.orig/fs/proc/proc_misc.c
+++ linux-2.6.16.11/fs/proc/proc_misc.c
@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *in
return seq_open(file, &cpuinfo_op);
}
-enum devinfo_states {
- CHR_HDR,
- CHR_LIST,
- BLK_HDR,
- BLK_LIST,
- DEVINFO_DONE
-};
-
-struct devinfo_state {
- void *chrdev;
- void *blkdev;
- unsigned int num_records;
- unsigned int cur_record;
- enum devinfo_states state;
+static struct file_operations proc_cpuinfo_operations = {
+ .open = cpuinfo_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release,
};
-static void *devinfo_start(struct seq_file *f, loff_t *pos)
+static int devinfo_show(struct seq_file *f, void *v)
{
- struct devinfo_state *info = f->private;
+ int i = *(loff_t *) v;
- if (*pos) {
- if ((info) && (*pos <= info->num_records))
- return info;
- return NULL;
+ if (i < CHRDEV_MAJOR_HASH_SIZE) {
+ if (i == 0)
+ seq_printf(f, "Character devices:\n");
+ chrdev_show(f, i);
+ } else {
+ i -= CHRDEV_MAJOR_HASH_SIZE;
+ if (i == 0)
+ seq_printf(f, "\nBlock devices:\n");
+ blkdev_show(f, i);
}
- info = kmalloc(sizeof(*info), GFP_KERNEL);
- f->private = info;
- info->chrdev = acquire_chrdev_list();
- info->blkdev = acquire_blkdev_list();
- info->state = CHR_HDR;
- info->num_records = count_chrdev_list();
- info->num_records += count_blkdev_list();
- info->num_records += 2; /* Character and Block headers */
- *pos = 1;
- info->cur_record = *pos;
- return info;
+ return 0;
}
-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
+static void *devinfo_start(struct seq_file *f, loff_t *pos)
{
- int idummy;
- char *ndummy;
- struct devinfo_state *info = f->private;
-
- switch (info->state) {
- case CHR_HDR:
- info->state = CHR_LIST;
- (*pos)++;
- /*fallthrough*/
- case CHR_LIST:
- if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
- /*
- * The character dev list is complete
- */
- info->state = BLK_HDR;
- } else {
- info->chrdev = get_next_chrdev(info->chrdev);
- }
- (*pos)++;
- break;
- case BLK_HDR:
- info->state = BLK_LIST;
- (*pos)++;
- /*fallthrough*/
- case BLK_LIST:
- if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
- /*
- * The block dev list is complete
- */
- info->state = DEVINFO_DONE;
- } else {
- info->blkdev = get_next_blkdev(info->blkdev);
- }
- (*pos)++;
- break;
- case DEVINFO_DONE:
- (*pos)++;
- info->cur_record = *pos;
- info = NULL;
- break;
- default:
- break;
- }
- if (info)
- info->cur_record = *pos;
- return info;
+ if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+ return pos;
+ return NULL;
}
-static void devinfo_stop(struct seq_file *f, void *v)
+static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
{
- struct devinfo_state *info = f->private;
-
- if (info) {
- release_chrdev_list(info->chrdev);
- release_blkdev_list(info->blkdev);
- f->private = NULL;
- kfree(info);
- }
+ (*pos)++;
+ if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+ return NULL;
+ return pos;
}
-static int devinfo_show(struct seq_file *f, void *arg)
+static void devinfo_stop(struct seq_file *f, void *v)
{
- int major;
- char *name;
- struct devinfo_state *info = f->private;
-
- switch(info->state) {
- case CHR_HDR:
- seq_printf(f,"Character devices:\n");
- /* fallthrough */
- case CHR_LIST:
- if (!get_chrdev_info(info->chrdev,&major,&name))
- seq_printf(f,"%3d %s\n",major,name);
- break;
- case BLK_HDR:
- seq_printf(f,"\nBlock devices:\n");
- /* fallthrough */
- case BLK_LIST:
- if (!get_blkdev_info(info->blkdev,&major,&name))
- seq_printf(f,"%3d %s\n",major,name);
- break;
- default:
- break;
- }
-
- return 0;
+ /* Nothing to do */
}
-static struct seq_operations devinfo_op = {
- .start = devinfo_start,
- .next = devinfo_next,
- .stop = devinfo_stop,
- .show = devinfo_show,
+static struct seq_operations devinfo_ops = {
+ .start = devinfo_start,
+ .next = devinfo_next,
+ .stop = devinfo_stop,
+ .show = devinfo_show
};
-static int devinfo_open(struct inode *inode, struct file *file)
+static int devinfo_open(struct inode *inode, struct file *filp)
{
- return seq_open(file, &devinfo_op);
+ return seq_open(filp, &devinfo_ops);
}
static struct file_operations proc_devinfo_operations = {
@@ -396,13 +312,6 @@ static struct file_operations proc_devin
.release = seq_release,
};
-static struct file_operations proc_cpuinfo_operations = {
- .open = cpuinfo_open,
- .read = seq_read,
- .llseek = seq_lseek,
- .release = seq_release,
-};
-
extern struct seq_operations vmstat_op;
static int vmstat_open(struct inode *inode, struct file *file)
{
--- linux-2.6.16.11.orig/include/linux/fs.h
+++ linux-2.6.16.11/include/linux/fs.h
@@ -1383,6 +1383,7 @@ extern int bd_claim(struct block_device
extern void bd_release(struct block_device *);
/* fs/char_dev.c */
+#define CHRDEV_MAJOR_HASH_SIZE 255
extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
extern int register_chrdev_region(dev_t, unsigned, const char *);
extern int register_chrdev(unsigned int, const char *,
@@ -1390,25 +1391,17 @@ extern int register_chrdev(unsigned int,
extern int unregister_chrdev(unsigned int, const char *);
extern void unregister_chrdev_region(dev_t, unsigned);
extern int chrdev_open(struct inode *, struct file *);
-extern int get_chrdev_list(char *);
-extern void *acquire_chrdev_list(void);
-extern int count_chrdev_list(void);
-extern void *get_next_chrdev(void *);
-extern int get_chrdev_info(void *, int *, char **);
-extern void release_chrdev_list(void *);
+extern void chrdev_show(struct seq_file *,off_t);
/* fs/block_dev.c */
+#define BLKDEV_MAJOR_HASH_SIZE 255
#define BDEVNAME_SIZE 32 /* Largest string for a blockdev identifier */
extern const char *__bdevname(dev_t, char *buffer);
extern const char *bdevname(struct block_device *bdev, char *buffer);
extern struct block_device *lookup_bdev(const char *);
extern struct block_device *open_bdev_excl(const char *, int, void *);
extern void close_bdev_excl(struct block_device *);
-extern void *acquire_blkdev_list(void);
-extern int count_blkdev_list(void);
-extern void *get_next_blkdev(void *);
-extern int get_blkdev_info(void *, int *, char **);
-extern void release_blkdev_list(void *);
+extern void blkdev_show(struct seq_file *,off_t);
extern void init_special_inode(struct inode *, umode_t, dev_t);
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.174508000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:41 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Jan Kara <jack@suse.cz>,
<reiserfs-dev@namesys.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 15/24] Fix reiserfs deadlock
Content-Disposition: inline; filename=fix-reiserfs-deadlock.patch
Content-Length: 1315
Lines: 40
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Jan Kara <jack@suse.cz>
[PATCH] Fix reiserfs deadlock
reiserfs_cache_default_acl() should return whether we successfully found
the acl or not. We have to return correct value even if reiserfs_get_acl()
returns error code and not just 0. Otherwise callers such as
reiserfs_mkdir() can unnecessarily lock the xattrs and later functions such
as reiserfs_new_inode() fail to notice that we have already taken the lock
and try to take it again with obvious consequences.
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: <reiserfs-dev@namesys.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
fs/reiserfs/xattr_acl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/fs/reiserfs/xattr_acl.c
+++ linux-2.6.16.11/fs/reiserfs/xattr_acl.c
@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct in
acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
reiserfs_read_unlock_xattrs(inode->i_sb);
reiserfs_read_unlock_xattr_i(inode);
- ret = acl ? 1 : 0;
- posix_acl_release(acl);
+ ret = (acl && !IS_ERR(acl));
+ if (ret)
+ posix_acl_release(acl);
}
return ret;
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.314150000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:42 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Greg Howard <ghoward@sgi.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 16/24] Altix snsc: duplicate kobject fix
Content-Disposition: inline; filename=altix-snsc-duplicate-kobject-fix.patch
Content-Length: 1196
Lines: 35
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Greg Howard <ghoward@sgi.com>
Fix Altix system controller (snsc) device names to include the slot number
of the blade whose associated system controller is the target of the device
interface. Including the slot number avoids a problem we're currently
having where slots within the same enclosure are attempting to create
multiple kobjects with identical names.
Signed-off-by: Greg Howard <ghoward@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/char/snsc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- linux-2.6.16.11.orig/drivers/char/snsc.c
+++ linux-2.6.16.11/drivers/char/snsc.c
@@ -391,7 +391,8 @@ scdrv_init(void)
format_module_id(devnamep, geo_module(geoid),
MODULE_FORMAT_BRIEF);
devnamep = devname + strlen(devname);
- sprintf(devnamep, "#%d", geo_slab(geoid));
+ sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+ geo_slab(geoid));
/* allocate sysctl device data */
scd = kmalloc(sizeof (struct sysctl_data_s),
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.452969000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:43 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Ivan Kokshaysky <ink@jurassic.park.msu.ru>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 17/24] Alpha: strncpy() fix
Content-Disposition: inline; filename=alpha-strncpy-fix.patch
Content-Length: 1236
Lines: 47
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
[PATCH] Alpha: strncpy() fix
As it turned out after recent SCSI changes, strncpy() was broken -
it mixed up the return values from __stxncpy() in registers $24 and $27.
Thanks to Mathieu Chouquet-Stringer for tracking down the problem
and providing an excellent test case.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/alpha/lib/strncpy.S | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- linux-2.6.16.11.orig/arch/alpha/lib/strncpy.S
+++ linux-2.6.16.11/arch/alpha/lib/strncpy.S
@@ -43,8 +43,8 @@ strncpy:
.align 4
$multiword:
- subq $24, 1, $2 # clear the final bits in the prev word
- or $2, $24, $2
+ subq $27, 1, $2 # clear the final bits in the prev word
+ or $2, $27, $2
zapnot $1, $2, $1
subq $18, 1, $18
@@ -70,8 +70,8 @@ $multiword:
bne $18, 0b
1: ldq_u $1, 0($16) # clear the leading bits in the final word
- subq $27, 1, $2
- or $2, $27, $2
+ subq $24, 1, $2
+ or $2, $24, $2
zap $1, $2, $1
stq_u $1, 0($16)
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.594722000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:44 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
James Morris <jmorris@namei.org>,
Al Viro <viro@zeniv.linux.org.uk>,
Greg Kroah-Hartman <gregkh@suse.de>,
Chris Wright <chrisw@sous-sol.org>
Subject: [patch 18/24] LSM: add missing hook to do_compat_readv_writev()
Content-Disposition: inline; filename=lsm-add-missing-hook-to-do_compat_readv_writev.patch
Content-Length: 1113
Lines: 39
-stable review patch. If anyone has any objections, please let us know.
------------------
From: James Morris <jmorris@namei.org>
This patch addresses a flaw in LSM, where there is no mediation of readv()
and writev() in for 32-bit compatible apps using a 64-bit kernel.
This bug was discovered and fixed initially in the native readv/writev
code [1], but was not fixed in the compat code. Thanks to Al for spotting
this one.
[1] http://lwn.net/Articles/154282/
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
---
fs/compat.c | 4 ++++
1 file changed, 4 insertions(+)
--- linux-2.6.16.11.orig/fs/compat.c
+++ linux-2.6.16.11/fs/compat.c
@@ -1215,6 +1215,10 @@ static ssize_t compat_do_readv_writev(in
if (ret < 0)
goto out;
+ ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
+ if (ret)
+ goto out;
+
fnv = NULL;
if (type == READ) {
fn = file->f_op->read;
--
From greg@quad.kroah.org Thu Apr 27 17:13:24 2006
Message-Id: <20060428001324.738152000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:45 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
git-commits-head@vger.kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Zachary Amsden <zach@vmware.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 19/24] x86/PAE: Fix pte_clear for the >4GB RAM case
Content-Disposition: inline; filename=x86-pae-fix-pte_clear-for-the-4gb-ram-case.patch
Content-Length: 5572
Lines: 130
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Zachary Amsden <zach@vmware.com>
[PATCH] x86/PAE: Fix pte_clear for the >4GB RAM case
Proposed fix for ptep_get_and_clear_full PAE bug. Pte_clear had the same bug,
so use the same fix for both. Turns out pmd_clear had it as well, but pgds
are not affected.
The problem is rather intricate. Page table entries in PAE mode are 64-bits
wide, but the only atomic 8-byte write operation available in 32-bit mode is
cmpxchg8b, which is expensive (at least on P4), and thus avoided. But it can
happen that the processor may prefetch entries into the TLB in the middle of an
operation which clears a page table entry. So one must always clear the P-bit
in the low word of the page table entry first when clearing it.
Since the sequence *ptep = __pte(0) leaves the order of the write dependent on
the compiler, it must be coded explicitly as a clear of the low word followed
by a clear of the high word. Further, there must be a write memory barrier
here to enforce proper ordering by the compiler (and, in the future, by the
processor as well).
On > 4GB memory machines, the implementation of pte_clear for PAE was clearly
deficient, as it could leave virtual mappings of physical memory above 4GB
aliased to memory below 4GB in the TLB. The implementation of
ptep_get_and_clear_full has a similar bug, although not nearly as likely to
occur, since the mappings being cleared are in the process of being destroyed,
and should never be dereferenced again.
But, as luck would have it, it is possible to trigger bugs even without ever
dereferencing these bogus TLB mappings, even if the clear is followed fairly
soon after with a TLB flush or invalidation. The problem is that memory above
4GB may now be aliased into the first 4GB of memory, and in fact, may hit a
region of memory with non-memory semantics. These regions include AGP and PCI
space. As such, these memory regions are not cached by the processor. This
introduces the bug.
The processor can speculate memory operations, including memory writes, as long
as they are committed with the proper ordering. Speculating a memory write to
a linear address that has a bogus TLB mapping is possible. Normally, the
speculation is harmless. But for cached memory, it does leave the falsely
speculated cacheline unmodified, but in a dirty state. This cache line will be
eventually written back. If this cacheline happens to intersect a region of
memory that is not protected by the cache coherency protocol, it can corrupt
data in I/O memory, which is generally a very bad thing to do, and can cause
total system failure or just plain undefined behavior.
These bugs are extremely unlikely, but the severity is of such magnitude, and
the fix so simple that I think fixing them immediately is justified. Also,
they are nearly impossible to debug.
Signed-off-by: Zachary Amsden <zach@vmware.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/asm-i386/pgtable-2level.h | 3 +++
include/asm-i386/pgtable-3level.h | 20 ++++++++++++++++++++
include/asm-i386/pgtable.h | 4 +---
3 files changed, 24 insertions(+), 3 deletions(-)
--- linux-2.6.16.11.orig/include/asm-i386/pgtable-2level.h
+++ linux-2.6.16.11/include/asm-i386/pgtable-2level.h
@@ -18,6 +18,9 @@
#define set_pte_atomic(pteptr, pteval) set_pte(pteptr,pteval)
#define set_pmd(pmdptr, pmdval) (*(pmdptr) = (pmdval))
+#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
+#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
+
#define ptep_get_and_clear(mm,addr,xp) __pte(xchg(&(xp)->pte_low, 0))
#define pte_same(a, b) ((a).pte_low == (b).pte_low)
#define pte_page(x) pfn_to_page(pte_pfn(x))
--- linux-2.6.16.11.orig/include/asm-i386/pgtable-3level.h
+++ linux-2.6.16.11/include/asm-i386/pgtable-3level.h
@@ -85,6 +85,26 @@ static inline void pud_clear (pud_t * pu
#define pmd_offset(pud, address) ((pmd_t *) pud_page(*(pud)) + \
pmd_index(address))
+/*
+ * For PTEs and PDEs, we must clear the P-bit first when clearing a page table
+ * entry, so clear the bottom half first and enforce ordering with a compiler
+ * barrier.
+ */
+static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+{
+ ptep->pte_low = 0;
+ smp_wmb();
+ ptep->pte_high = 0;
+}
+
+static inline void pmd_clear(pmd_t *pmd)
+{
+ u32 *tmp = (u32 *)pmd;
+ *tmp = 0;
+ smp_wmb();
+ *(tmp + 1) = 0;
+}
+
static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
{
pte_t res;
--- linux-2.6.16.11.orig/include/asm-i386/pgtable.h
+++ linux-2.6.16.11/include/asm-i386/pgtable.h
@@ -204,12 +204,10 @@ extern unsigned long long __PAGE_KERNEL,
extern unsigned long pg0[];
#define pte_present(x) ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
-#define pte_clear(mm,addr,xp) do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
/* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
#define pmd_none(x) (!(unsigned long)pmd_val(x))
#define pmd_present(x) (pmd_val(x) & _PAGE_PRESENT)
-#define pmd_clear(xp) do { set_pmd(xp, __pmd(0)); } while (0)
#define pmd_bad(x) ((pmd_val(x) & (~PAGE_MASK & ~_PAGE_USER)) != _KERNPG_TABLE)
@@ -269,7 +267,7 @@ static inline pte_t ptep_get_and_clear_f
pte_t pte;
if (full) {
pte = *ptep;
- *ptep = __pte(0);
+ pte_clear(mm, addr, ptep);
} else {
pte = ptep_get_and_clear(mm, addr, ptep);
}
--
From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
Message-Id: <20060428001324.879818000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:46 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org,
<jgarzik@pobox.com>
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
netdev@vger.kernel.org,
<jesse.brandeburg@intel.com>,
<john.ronciak@intel.com>,
<Jeffrey.t.kirsher@intel.com>,
<auke@foo-projects.org>,
<davem@davemloft.net>,
Auke Kok <auke-jan.h.kok@intel.com>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 20/24] NET: e1000: Update truesize with the length of the packet for packet split
Content-Disposition: inline; filename=net-e1000-update-truesize-with-the-length-of-the-packet-for-packet-split.patch
Content-Length: 764
Lines: 28
-stable review patch. If anyone has any objections, please let us know.
------------------
Update skb with the real packet size.
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/net/e1000/e1000_main.c | 1 +
1 file changed, 1 insertion(+)
--- linux-2.6.16.11.orig/drivers/net/e1000/e1000_main.c
+++ linux-2.6.16.11/drivers/net/e1000/e1000_main.c
@@ -3851,6 +3851,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapt
skb_shinfo(skb)->nr_frags++;
skb->len += length;
skb->data_len += length;
+ skb->truesize += length;
}
e1000_rx_checksum(adapter, staterr,
--
From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
Message-Id: <20060428001325.019060000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:47 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Ralf Baechle <ralf@linux-mips.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 21/24] MIPS: Use "R" constraint for cache_op.
Content-Disposition: inline; filename=MIPS-0001.patch
Content-Length: 743
Lines: 26
-stable review patch. If anyone has any objections, please let us know.
------------------
Gcc might emit an absolute address for the the "m" constraint which
gas unfortunately does not permit.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/asm-mips/r4kcache.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.11.orig/include/asm-mips/r4kcache.h
+++ linux-2.6.16.11/include/asm-mips/r4kcache.h
@@ -37,7 +37,7 @@
" cache %0, %1 \n" \
" .set pop \n" \
: \
- : "i" (op), "m" (*(unsigned char *)(addr)))
+ : "i" (op), "R" (*(unsigned char *)(addr)))
static inline void flush_icache_line_indexed(unsigned long addr)
{
--
From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
Message-Id: <20060428001325.159252000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:48 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Ralf Baechle <ralf@linux-mips.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 22/24] MIPS: R2 build fixes for gcc < 3.4.
Content-Disposition: inline; filename=MIPS-0002.patch
Content-Length: 2821
Lines: 113
-stable review patch. If anyone has any objections, please let us know.
------------------
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/asm-mips/bitops.h | 14 ++++++++++++--
include/asm-mips/byteorder.h | 4 ++++
include/asm-mips/interrupt.h | 8 ++++++++
3 files changed, 24 insertions(+), 2 deletions(-)
--- linux-2.6.16.11.orig/include/asm-mips/bitops.h
+++ linux-2.6.16.11/include/asm-mips/bitops.h
@@ -654,7 +654,12 @@ static inline unsigned long fls(unsigned
{
#ifdef CONFIG_32BIT
#ifdef CONFIG_CPU_MIPS32
- __asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
+ __asm__ (
+ " .set mips32 \n"
+ " clz %0, %1 \n"
+ " .set mips0 \n"
+ : "=r" (word)
+ : "r" (word));
return 32 - word;
#else
@@ -678,7 +683,12 @@ static inline unsigned long fls(unsigned
#ifdef CONFIG_64BIT
#ifdef CONFIG_CPU_MIPS64
- __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
+ __asm__ (
+ " .set mips64 \n"
+ " dclz %0, %1 \n"
+ " .set mips0 \n"
+ : "=r" (word)
+ : "r" (word));
return 64 - word;
#else
--- linux-2.6.16.11.orig/include/asm-mips/byteorder.h
+++ linux-2.6.16.11/include/asm-mips/byteorder.h
@@ -19,7 +19,9 @@
static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
{
__asm__(
+ " .set mips32r2 \n"
" wsbh %0, %1 \n"
+ " .set mips0 \n"
: "=r" (x)
: "r" (x));
@@ -30,8 +32,10 @@ static __inline__ __attribute_const__ __
static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
{
__asm__(
+ " .set mips32r2 \n"
" wsbh %0, %1 \n"
" rotr %0, %0, 16 \n"
+ " .set mips0 \n"
: "=r" (x)
: "r" (x));
--- linux-2.6.16.11.orig/include/asm-mips/interrupt.h
+++ linux-2.6.16.11/include/asm-mips/interrupt.h
@@ -20,7 +20,9 @@ __asm__ (
" .set reorder \n"
" .set noat \n"
#ifdef CONFIG_CPU_MIPSR2
+ " .set mips32r2 \n"
" ei \n"
+ " .set mips0 \n"
#else
" mfc0 $1,$12 \n"
" ori $1,0x1f \n"
@@ -63,7 +65,9 @@ __asm__ (
" .set push \n"
" .set noat \n"
#ifdef CONFIG_CPU_MIPSR2
+ " .set mips32r2 \n"
" di \n"
+ " .set mips0 \n"
#else
" mfc0 $1,$12 \n"
" ori $1,0x1f \n"
@@ -103,8 +107,10 @@ __asm__ (
" .set reorder \n"
" .set noat \n"
#ifdef CONFIG_CPU_MIPSR2
+ " .set mips32r2 \n"
" di \\result \n"
" andi \\result, 1 \n"
+ " .set mips0 \n"
#else
" mfc0 \\result, $12 \n"
" ori $1, \\result, 0x1f \n"
@@ -133,9 +139,11 @@ __asm__ (
* Slow, but doesn't suffer from a relativly unlikely race
* condition we're having since days 1.
*/
+ " .set mips32r2 \n"
" beqz \\flags, 1f \n"
" di \n"
" ei \n"
+ " .set mips0 \n"
"1: \n"
#elif defined(CONFIG_CPU_MIPSR2)
/*
--
From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
Message-Id: <20060428001325.298860000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:49 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Atsushi Nemoto <anemo@mba.ocn.ne.jp>,
Ralf Baechle <ralf@linux-mips.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 23/24] MIPS: Fix tx49_blast_icache32_page_indexed.
Content-Disposition: inline; filename=MIPS-0003.patch
Content-Length: 1058
Lines: 30
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Fix the cache index value in tx49_blast_icache32_page_indexed().
This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/mips/mm/c-r4k.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- linux-2.6.16.11.orig/arch/mips/mm/c-r4k.c
+++ linux-2.6.16.11/arch/mips/mm/c-r4k.c
@@ -154,7 +154,8 @@ static inline void blast_icache32_r4600_
static inline void tx49_blast_icache32_page_indexed(unsigned long page)
{
- unsigned long start = page;
+ unsigned long indexmask = current_cpu_data.icache.waysize - 1;
+ unsigned long start = INDEX_BASE + (page & indexmask);
unsigned long end = start + PAGE_SIZE;
unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
unsigned long ws_end = current_cpu_data.icache.ways <<
--
From greg@quad.kroah.org Thu Apr 27 17:13:25 2006
Message-Id: <20060428001325.444493000@quad.kroah.org>
References: <20060428001226.204293000@quad.kroah.org>
User-Agent: quilt/0.44-1
Date: Thu, 27 Apr 2006 17:12:50 -0700
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org,
stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
Theodore Ts'o <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
torvalds@osdl.org,
akpm@osdl.org,
alan@lxorguk.ukuu.org.uk,
Win Treese <treese@acm.org>,
Ralf Baechle <ralf@linux-mips.org>,
Greg Kroah-Hartman <gregkh@suse.de>
Subject: [patch 24/24] MIPS: Fix branch emulation for floating-point exceptions.
Content-Disposition: inline; filename=MIPS-0004.patch
Content-Length: 1095
Lines: 33
-stable review patch. If anyone has any objections, please let us know.
------------------
From: Win Treese <treese@acm.org>
In the branch emulation for floating-point exceptions, __compute_return_epc
must determine for bc1f et al which condition code bit to test. This is
based on bits <4:2> of the rt field. The switch statement to distinguish
bc1f et al needs to use only the two low bits of rt, but the old code tests
on the whole rt field. This patch masks off the proper bits.
Signed-off-by: Win Treese <treese@acm.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
arch/mips/kernel/branch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.16.11.orig/arch/mips/kernel/branch.c
+++ linux-2.6.16.11/arch/mips/kernel/branch.c
@@ -184,7 +184,7 @@ int __compute_return_epc(struct pt_regs
bit = (insn.i_format.rt >> 2);
bit += (bit != 0);
bit += 23;
- switch (insn.i_format.rt) {
+ switch (insn.i_format.rt & 3) {
case 0: /* bc1f */
case 2: /* bc1fl */
if (~fcr31 & (1 << bit))
--