ChangeSet@1.2026, 2005-02-11 20:42:01-08:00, dmo@osdl.org [PATCH] raid5 and raid6 fixes to current bk tree This fixes the raid5 and raid6 prolems that crept in with the recent introduction of "bi_max_vecs". Since raid5/raid6 allocate their own bio's, they need to make sure that bi_max_vecs is updated along with bi_vcnt. ChangeSet@1.2025, 2005-02-11 18:15:08-08:00, viro@parcelfarce.linux.theplanet.co.uk [PATCH] megaraid_mbox fix wrong order of arguments in memset(). This, BTW, shows why cross-builds are useful - the only indication of problem had been a new warning showing up in sparse output on alpha build (number exceeding 256 got truncated). Signed-off-by: Al Viro ChangeSet@1.2024, 2005-02-11 18:03:52-08:00, ak@suse.de [PATCH] Fix small vmalloc per allocation limit The vmap vmalloc rework in 2.5 had a unintended side effect. vmalloc uses kmalloc now to allocate an array with a list of pages. kmalloc has a 128K maximum. This limits the vmalloc maximum size to 64MB on a 64bit system with 4K pages. That limit causes problems with other subsystems, e.g. iptables relies on allocating large vmallocs for its rule sets. This is a bug IMHO - on 64bit platforms there shouldn't be such a low limit on the vmalloc size. And even on 32bit it's too small for custom kernels with enlarged vmalloc area. Another problem is that this makes vmalloc unreliable. After the system has been running for some time it is unlikely that kmalloc will be able to allocate >order 2 pages due to memory fragmentation. This patch takes the easy way out for fixing this by just allocating this array with vmalloc when it is larger than a page. While more complicated and intrusive solutions would be possible they didn't use vmalloc recursively they didn't seem it worth to handle this very infrequent case. Please note that the vmalloc recursion is strictly bounded because each nested allocation will generate a much smaller stack frame. Also the kernel stack can handle even a few recursion steps easily because vmalloc has only a small stack frame. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2023, 2005-02-11 18:03:37-08:00, akonovalov@ru.mvista.com [PATCH] ppc32: fix typos in cpm_uart_cpm2.c This patch removes excess '~' before the bit masks. Signed-off-by: Andrei Konovalov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2022, 2005-02-11 18:03:23-08:00, venkatesh.pallipadi@intel.com [PATCH] kmalloc() bug in pci-dma.c dma_declare_coherent_memory() is calling kmalloc with wrong arguments. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2021, 2005-02-11 16:53:38-08:00, galak@freescale.com [PATCH] ppc32: Fix PCI2 support on MPC8555/41 CDS systems This fixes an issue related to the second PCI host controller working on MPC8555/41 systems. We track the last PCI bus number on PCI1 so that the PCI2 host controller can properly exclude itself at the right time, exclusion should occur after initial setup so that the early pci config cycles in setting PCI2 actually get to the controller. Signed-off-by: Kumar Gala Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.15, 2005-02-11 12:50:47-08:00, armin@melware.de [PATCH] Eicon driver: code cleanups Cleanups (initially sent by Adrian Bunk): - make some needlessly global code static - removed obsolete #define OLD_MAX_DESCRIPTORS - removed more platform independend code not used in linux - removed dos- at end of lines - fix indentation in already modified files Signed-off-by: Armin Schindler Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.14, 2005-02-11 12:49:19-08:00, armin@melware.de [PATCH] Eicon driver: convert to pci_register_driver convert from pci_module_init to pci_register_driver Signed-off-by: Christophe Lucas Signed-off-by: Armin Schindler Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.13, 2005-02-11 12:48:00-08:00, hugh@veritas.com [PATCH] general split_vma hugetlb fix My recent do_munmap hugetlb fix has proved inadequate. There are other places (madvise, mbind, mlock, mprotect) where split_vma is called. Only mprotect excludes a hugetlb vma: the others are in danger of splitting at a misaligned address, causing later BUGs. So move the ~HPAGE_MASK check from do_munmap to split_vma itself; and fix up those places (madvise and mlock) which expect split_vma can fail only with -ENOMEM, and wish to convert that to -EAGAIN. (It appears genuine that some of these syscalls should be failing with -ENOMEM and some with -EAGAIN, so respect those behaviours.) madvise_dontneed doesn't use split_vma, but is equally in danger of causing a hugetlb BUG via zap_page_range. Whereas elsewhere the patch is permissive (allowing the operation on a hugetlb vma even when pointless, so long as it doesn't missplit it), here we must use -EINVAL on any hugetlb vma, since a page fault would hit the BUG in its nopage. Signed-off-by: Hugh Dickins Acked-by: William Irwin Signed-off-by: Linus Torvalds ChangeSet@1.2018.1.3, 2005-02-11 12:45:20-08:00, davem@nuts.davemloft.net [TG3]: Update driver version and reldate. Signed-off-by: David S. Miller ChangeSet@1.2018.1.2, 2005-02-11 12:42:59-08:00, mchan@broadcom.com [TG3]: capacitive coupling detection fix This patch fixes the problem reported in: http://marc.theaimsgroup.com/?l=linux-kernel&m=110798711911645&w=2 The 5700 link problem was caused by reading uninitialized values in sram and causing capacitive coupling mode to be enabled by mistake. This patch fixes the problem by properly validating the sram contents. Signed-off-by: Michael Chan Signed-off-by: David S. Miller ChangeSet@1.2018.2.12, 2005-02-11 11:01:29-08:00, dhowells@redhat.com [PATCH] Fix the mincore() syscall This fixes the mincore syscall in three ways: (1) It moves as much argument checking outside of the semaphore-holding region as possible. (2) It checks the region parameters against TASK_SIZE so that a 32-bit binary on a 64-bit platform will get the right error when calling this syscall on a region that overlaps the end of the 32-bit address space. (3) It tidies up the VMA checking loop a little. Signed-Off-By: David Howells Signed-Off-By: Linus Torvalds ChangeSet@1.2018.2.11, 2005-02-11 08:19:59-08:00, dhowells@redhat.com [PATCH] FRV: Fix sigaltstack handling for RT signals The attached patch fixes sigaltstack handling for RT signal return. It was reading a userspace struct into kernel space and then passing the kernel copy to a generic signalling routine which then assumed it had been passed a userspace pointer... Signed-Off-By: David Howells Signed-Off-By: Alexander Viro Signed-Off-By: Linus Torvalds ChangeSet@1.2018.2.10, 2005-02-11 08:19:45-08:00, viro@parcelfarce.linux.theplanet.co.uk [PATCH] i2c compat ioctl breakage do_i2c_rdwr_ioctl() does two compat_alloc_user_space(). That doesn't work; no state is kept and second allocation will ignore the first one (i.e. give overlapping chunk of user stack). Fixed by doing allocation at once, slightly cleaned up. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.9, 2005-02-11 08:04:10-08:00, viro@parcelfarce.linux.theplanet.co.uk [PATCH] portability problem in dm-stripe.c dm-stripe does do_div() on potentially 32bit data. do_div() implementation has every right to be Not Happy(tm) with that... The fix is obvious - that's what sector_div() is for... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.8, 2005-02-11 08:03:57-08:00, yuasa@hh.iij4u.or.jp [PATCH] mips: remove TANBAC_TB0219 doubly registered in kernel config This patch removes TANBAC_TB0219 doubly registered in kernel config. Signed-off-by: Yoichi Yuasa Cc: Ralf Baechle Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.7, 2005-02-11 08:03:43-08:00, bunk@stusta.de [PATCH] mark the mcd cdrom driver as BROKEN The mcd driver drives only very old hardware (some single and double speed CD drives that were connected either via the soundcard or a special ISA card), and the mcdx driver offers more functionality for the same hardware. My plan is to mark MCD as broken in 2.6.11 and if noone complains completely remove this driver some time later. Signed-off-by: Adrian Bunk Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.6, 2005-02-11 08:03:30-08:00, benh@kernel.crashing.org [PATCH] radeonfb update It adds the sleep support for newer powermacs, improve power saving on some laptops, makes use of the new fbdev modelist management routines, and fixes a few backlight related issues. I tested it on a thinkpad T30 and a few PPC boxes with success. It should be less invasive than the previous one (I don't try to restore the mode on exit, that is what breaks the thinkpad and possibly other stuffs that boot in VGA text mode), plus fixed a couple of bugs in the mode detection code. I also reverted the memory map fix on ppc since it doesn't work properly on some recent laptops where the firmware sets a tiled display. I'll rework that completely to update the memory map as part of the mode setting later. That should fix various issues when switching with X/DRI on x86. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.5, 2005-02-11 08:03:14-08:00, benh@kernel.crashing.org [PATCH] update aty128fb sleep/wakeup code for new powermac changes This patch updates aty128fb power management code to the changes of the powermac sleep mecanism. It makes the driver use the new hook for early wakeup, adds the call to the arch code indicating wether it can wakeup the chip, etc... This patch shouldn't break non-ppc, but this should be tested. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.4, 2005-02-11 08:03:00-08:00, benh@kernel.crashing.org [PATCH] Add try_acquire_console_sem The new PowerMac sleep code provides an arch hook that can be used by video drivers on laptops to bring back the screen very early, pretty much before anything else. This basically turns reports of the style "my laptop doesn't wakeup" to "I get this or this oops/error/panic on wakeup", making fixing the PM related bugs possible on a whole range of them. However, the fbdev wakeup code triggers WARN_ON's in the VT subsystem if called without the console semaphore when redrawing the screen (I added those warnings a couple of kernel versions ago), and we can't call acquire_console_sem() since we are so early in the wakeup process that we are considered as in_atomic() (we hold irqs off too). This patch addds a try_acquire_console_sem() function that can be used by those video drivers that implement this early wakeup hook. If the acquire fails (which should never happen in practice), wakeup is delayed to the normal PCI callback which does a blocking acquire_console_sem(). Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.3, 2005-02-11 08:02:47-08:00, minyard@acm.org [PATCH] Update to IPMI driver to support old DMI spec The 1999 version of the DMI spec had a different configuration than the newer versions for the IPMI configuration information. This patch handles the differences between the two. Signed-off-by: Corey Minyard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.2, 2005-02-11 08:02:33-08:00, bstroesser@fujitsu-siemens.com [PATCH] uml: use PTRACE_OLDSETOPTIONS instead of PTRACE_SETOPTIONS In linux 2.6, PTRACE_SETOPTIONS is redefined to 0x4200, while the old 2.4 value (21) is still available as PTRACE_OLDSETOPTIONS. So, if UML uses PTRACE_SETOPTIONS, an UML-kernel built on a 2.6 won't run on a 2.4 host. Hence we must use PTRACE_OLDSETOPTIONS. For cases when PTRACE_OLDSETOPTIONS does not exists (i.e. 2.4 host or archs which miss it because they don't have a "deprecated" value), we fallback this macro to PTRACE_SETOPTIONS. Signed-off-by: Bodo Stroesser Signed-off-by: Paolo 'Blaisorblade' Giarrusso Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2018.2.1, 2005-02-11 08:02:19-08:00, jdike@addtoit.com [PATCH] uml: fix makefile typo Fix a typo in the Makefile cleanup merged earlier, which causes compile failures in some edge cases. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.21.4, 2005-02-10 19:20:37-08:00, yoshfuji@linux-ipv6.org [NET]: Use TASK_COMM_LEN instead of magic constant. Signed-off-by: Hideaki YOSHIFUJI Signed-off-by: David S. Miller ChangeSet@1.1998.23.16, 2005-02-10 19:17:56-08:00, davem@nuts.davemloft.net [DOC]: Fix typo in atomic_ops.txt s/smb_/smp_/ Noticed by Werner Almesberger. Signed-off-by: David S. Miller ChangeSet@1.1998.23.15, 2005-02-10 19:12:30-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: sunlance iomem annotations. Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.14, 2005-02-10 19:10:57-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC64]: NULL noise removal in arch/sparc64/prom/memory.c Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.13, 2005-02-10 19:10:08-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: __user annotations in ELF_CORE_COPY_REGS Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.12, 2005-02-10 19:09:26-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: Fix I/O accessor routines. * insb et.al. first argument is unsigned long, not void * (just look at their callers). There _is_ a variant that takes void __iomem *, but that's ioread8_rep() and its friends. * exported the rest of these suckers (insl/outsl already had been). Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.11, 2005-02-10 19:08:35-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: No iBCS2 on sparc, TYVM... Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.10, 2005-02-10 19:07:55-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: __user annotations in sparc checksum.h Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.9, 2005-02-10 19:07:05-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: __user annotations around sparc{32,64} ptrace ...succ_return...() Signed-off-by: Al Viro Signed-off-by: David S. Miller ChangeSet@1.1998.23.8, 2005-02-10 19:06:10-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC64]: fbio.h __user annotations Signed-off-by: Al Viro ChangeSet@1.1998.23.7, 2005-02-10 19:05:23-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC64]: Fix prototype of check_signature() - it already gets a pointer Signed-off-by: Al Viro ChangeSet@1.1998.23.6, 2005-02-10 19:04:26-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: NULL noise removal from sparc floppy.h Signed-off-by: David S. Miller ChangeSet@1.1998.23.5, 2005-02-10 19:03:40-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC]: Trivial annotations in sparc signal.c / svr4.h Signed-off-by: David S. Miller ChangeSet@1.1998.23.4, 2005-02-10 19:00:32-08:00, davem@nuts.davemloft.net [SPARC]: nop() macro has bogus trailing semicolon Noticed by Bob Breuer. Signed-off-by: David S. Miller ChangeSet@1.1998.23.3, 2005-02-10 18:08:27-08:00, viro@parcelfarce.linux.theplanet.co.uk [SPARC32]: Fix UP build with spinlock debugging enabled. atomic32.c assumes that arbitrary stuff can be passed into spin_lock() on non-SMP builds, which is true except for when spinlock debugging is enabled. Signed-off-by: David S. Miller ChangeSet@1.1998.23.2, 2005-02-10 17:14:28-08:00, ahaas@airmail.net [SPARC32]: Fix SPIN_LOCK_UNLOCKED define. Signed-off-by: David S. Miller ChangeSet@1.1998.23.1, 2005-02-10 17:12:02-08:00, mroos@linux.ee [SPARC32]: Fix syntax errors from smp_{mb,rmb,wmb} on sparc32. smp_mb(), smp_rmp() and smp_wmb() definitions have a trailing semicolon and cause compilation errors in single statement context, like if-then-else on line 358 in include/linux/skbuff.h. This patch removes all three offending semicolons to make it compile. Signed-off-by: Meelis Roos Acked-by: William Irwin Signed-off-by: David S. Miller ChangeSet@1.1998.21.3, 2005-02-10 17:01:47-08:00, davem@nuts.davemloft.net [TCP]: Set PSH bit on all outgoing TSO frames. Helps with crazy Mac OS-X TCP implementations which delay the recvmsg() wakeup of the user until push is seen. Based upon ideas from Alexey Kuznetsov, and a preliminary patch by Stephen Hemminger. Signed-off-by: David S. Miller ChangeSet@1.2015, 2005-02-10 14:41:41-08:00, Andries.Brouwer@cwi.nl [PATCH] nls_cp936.c is not synchronized with M$'s translation table The nls_cp936.c is not synchronized with MS's translation table, there are some characters have different code from the code in updated table of MS. For example, the unicode for character 0xB8A3 (GBK) should be U+798F, but the code is U+FA1B in nls_cp936.c. Regenerated the tables. The number of differences is rather large, so I did not check every change, but looking at a random sample the changes seem OK. Mostly the CJK Compatibility Ideographs have been replaced by their ordinary equivalents. Some code points that were unassigned now got a meaning. Acked-by: OGAWA Hirofumi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2014, 2005-02-10 14:41:26-08:00, olh@suse.de [PATCH] ppc64: typo in arch/ppc64/kernel/prom_init.c prom_debug local variable is base, not vbase. Signed-off-by: Olaf Hering Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2013, 2005-02-10 14:41:13-08:00, zwane@arm.linux.org.uk [PATCH] OProfile: ARM/XScale1 PMU support fix Richard Purdie provided a patch to fix support for XScale1 processors (this is the PMU version i never had access to initially), we weren't clearing the overflow flags after an overflow interrupt had triggered resulting in no additional interrupts occuring. Additionally i've added basic power management support. Signed-off-by: Zwane Mwaikambo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2012, 2005-02-10 14:40:57-08:00, ak@suse.de [PATCH] Force read implies exec for all 32bit processes in x86-64 This effectively enables executable stack and executable heap for all 32bit programs on x86-64, except if noexec32=on is specified. This does not support changing this with personality right now, this would need more intrusive changes. A 64bit process will always turn it off and a 32bit process turn it on. Also readd the noexec32=on option to turn this off and fix a minor bug in noexec=... (would be reported as unknown option) Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2011, 2005-02-10 14:40:45-08:00, zwane@arm.linux.org.uk [PATCH] OProfile: exit.text referenced in init.text The linker doesn't complain, but i got this error on ARM which has similar code. oprofile_arch_exit: discarded in section `.exit.text' from arch/arm/oprofile/built-in.o arch/arm/oprofile/built-in.o(.init.text+0x4c): In function `oprofile_init': : relocation truncated to fit: R_ARM_PC24 oprofile_arch_exit oprofile_arch_init() oprofile_arch_exit() __exit nmi_exit() __exit exit_driverfs() Signed-off-by: Zwane Mwaikambo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2010, 2005-02-10 14:40:30-08:00, pavel@ucw.cz [PATCH] binfmt_elf: clearing bss may fail So we discover that Borland's Kylix application builder emits weird elf files which describe a non-writeable bss segment. So remove the clear_user() check at the place where we zero out the bss. I don't _think_ there are any security implications here (plus we've never checked that clear_user() return value, so whoops if it is a problem). Signed-off-by: Pavel Machek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2009, 2005-02-10 14:40:13-08:00, schwidefsky@de.ibm.com [PATCH] Fix shmget for ppc64, s390-64 & sparc64. The second parameter of the sys_ipc system wrapper on ppc64, s390-64 and sparc64 is an "int". sys_shmget gets called with this 32 bit value as the size parameter. This limits the maximum shared memory segment on these three architectures to 2GB. To fix this the second parameter is declared as an "unsigned long" and is then casted to the type required by the The same int vs. unsigned long bug is fixed for sys_msgsnd and sys_msgrcv as well. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2008, 2005-02-10 14:39:59-08:00, ak@suse.de [PATCH] Fix compat shmget overflow This fixes an incorrect sign extension in the compat layer that breaks 32bit shmget that are >2GB. sys_shmget has a signed size_t size argument, and the int size argument coming from 32bit user space would get sign extended to 64bit, which is wrong. I fixed it on all compat architectures, except PPC64 which was already ok. It was originally debugged and fixed by Karl Rister @ IBM for SLES9 on x86-64. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2007, 2005-02-10 14:39:42-08:00, stkn@gentoo.org [PATCH] alpha: add missing dma_mapping_error Attached patch defines dma_mapping_error on alpha. Without this libata-core.c won't compile. Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.2006, 2005-02-10 14:39:28-08:00, nico@cam.org [PATCH] L18 flash corruption fix Another fix to the put_chip() concurrency logic. Problem was occurring when: 1) one thread was erasing a block in partition x; 2) another thread suspended the erase in order to write to partition y; 3) a third thread came along to read a different block from partition x and, when it called put_chip(), chip->oldstate was FL_ERASING and the erase (mistakenly) resumed; 4) the write in partition y obviously failed at that point. Incidentally, the fix for this problem also fixed the case where suspending writes for MTD XIP usage was not working properly. Signed-off-by: Nicolas Pitre Signed-off-by: David Woodhouse Signed-off-by: Linus Torvalds ChangeSet@1.2004, 2005-02-10 10:47:29-08:00, torvalds@ppc970.osdl.org Merge bk://linux-scsi.bkbits.net/scsi-rc-fixes-2.6 into ppc970.osdl.org:/home/torvalds/v2.6/linux ChangeSet@1.1998.22.1, 2005-02-10 13:16:50-05:00, jgarzik@pobox.com [gen_init_cpio] When outputting a buffer, don't use char-at-a-time I/O. ChangeSet@1.1998.1.166, 2005-02-10 09:48:07-08:00, stelian@popies.net [PATCH] sonypi: add fan and temperature status/control 1. FAN Status/Control: you can now get the fan status (running or not) and also set the fan speed (for <5 seconds only). The problem is that there is an auto regulator that kicks in within about 5 seconds after that to restart the fan if it is above a threshold temperature (39 Degree C in my Vaio). It is useful just to get the fan status (primarily). It also appears that you can change the speed by increasing the values (much like the LCD control) - there are effectively only about 6 speeds (it seems - not sure, but from what I've played with on my Vaio). 2. Temperature: you can get the current temperature (same as reported by ACPI). This is primarily useful for APM users (since ACPI already gives this). I have used this to detect when the fan comes on in my Vaio (39 Degree C). From: Narayanan R S Signed-off-by: Stelian Pop Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.165, 2005-02-10 09:47:54-08:00, stelian@popies.net [PATCH] sonypi: fold the contents of sonypi.h into sonypi.c Fold the contents of sonypi.h into sonypi.c making some structures static. Partly-from: Adrian Bunk Suggested-by: Dmitry Torokhov Signed-off-by: Stelian Pop Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.164, 2005-02-10 09:47:37-08:00, stelian@popies.net [PATCH] sonypi: use MISC_DYNAMIC_MINOR in miscdevice.minor assignment. Use MISC_DYNAMIC_MINOR in miscdevice.minor assignment. Patch-from: Olaf Hering Signed-off-by: Stelian Pop Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.163, 2005-02-10 09:47:23-08:00, stelian@popies.net [PATCH] sonypi: add another HELP button event Add another HELP button event. Increment the version number. Signed-off-by: Stelian Pop Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.162, 2005-02-10 09:47:08-08:00, stelian@popies.net [PATCH] sonypi: replace schedule_timeout() with msleep() Replace schedule_timeout() with msleep() - from janitors. Signed-off-by: Stelian Pop Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.161, 2005-02-10 07:35:00-08:00, tiwai@suse.de [PATCH] [ALSA] Add missing FORWARD ioctl Added the missing PCM FORWARD ioctl. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.160, 2005-02-10 07:34:46-08:00, tiwai@suse.de [PATCH] [ALSA] Fix struct alignment on PPC64 Fixed the struct size mismatch (due to alignment) of snd_ctl_elem_value_t for PPC64 and SPARC64. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.159, 2005-02-10 07:34:32-08:00, tiwai@suse.de [PATCH] [ALSA] AC'97 Audio support for Intel ICH7 This patch adds the ICH7 AC'97 DID the the intel8x0.c AC'97 audio driver. This patch was build against 2.6.11-rc1. Signed-off-by: Jason Gaston Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.158, 2005-02-10 07:34:17-08:00, tiwai@suse.de [PATCH] [ALSA] Enable HP jack sense for FSC Scenic-W Enable 'Headphone Jack Sense' control on FSC Scenic-W as default, too. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.157, 2005-02-10 07:34:04-08:00, tiwai@suse.de [PATCH] [ALSA] Fix silent output on some machines with AD1981x codecs Fixed the default state of 'Headphone Jack Sense' switch on AD1981x codecs. Setting this on affects the output of some machines (e.g. Thindpads). The default value is set on only hardwares which are known to work. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.156, 2005-02-10 07:33:52-08:00, tiwai@suse.de [PATCH] [ALSA] Special AC97 patch for ASUS W1000/CMI9739 laptop This patch fixes sound output on the ASUS W1000 laptop with the CMI9739 chip. It wrongly reports that it has a SPDIF in, when in fact we wish to use the EAPD pin. Signed-off-by: James Courtier-Dutton Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.155, 2005-02-10 07:33:38-08:00, tiwai@suse.de [PATCH] [ALSA] Add quirk for HP nc8000 Added ac97 quirk for HP nc8000. The list is sorted again. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.154, 2005-02-10 07:33:23-08:00, tiwai@suse.de [PATCH] [ALSA] Add quirk for HP pavilion ZV5030US Added ac97 quirk for HP Pavilion ZV5030US to bind the control with mute-LED. Signed-off-by: Takashi Iwai Signed-off-by: Linus Torvalds ChangeSet@1.2003, 2005-02-10 09:32:03-05:00, hch@lst.de [PATCH] cciss: handle scsi_add_host failure Signed-off-by: Mike Miller Signed-off-by: James Bottomley ChangeSet@1.2002, 2005-02-10 09:30:32-05:00, jejb@mulgrave.(none) qla2xxx: fix BUG's for smp_processor_id() on interrupt From: Andrew Vasquez replace them with _smp_processor_id() Signed-off-by: James Bottomley ChangeSet@1.1998.19.6, 2005-02-09 21:44:45+00:00, rmk@flint.arm.linux.org.uk [ARM] Fix VFP for entry-armv.S macro-isation. Unfortunately, VFP got forgotten with when entry-armv.S was updated to use macros, and the PC value changed from being passed in r5 to r2. This fixes VFP. Signed-off-by: Russell King ChangeSet@1.1998.21.1, 2005-02-09 07:35:29-08:00, michael@ellerman.id.au [PATCH] Fix oops in alloc_zeroed_user_highpage() when page is NULL The generic and IA-64 versions of alloc_zeroed_user_highpage() don't check the return value from alloc_page_vma(). This can lead to an oops if we're OOM. This fixes my oops on PPC64, but I haven't got an IA-64 machine/compiler handy. Signed-off-by: Michael Ellerman Signed-off-by: Linus Torvalds ChangeSet@1.1998.19.5, 2005-02-09 13:51:39+00:00, ben-linux@org.rmk.(none) [ARM PATCH] 2455/1: shark: fix uninitialised variable in head Patch from Ben Dooks stop compiler warning about uninitialised variable Signed-off-by: Ben Dooks Signed-off-by: Russell King ChangeSet@1.1998.19.4, 2005-02-09 13:44:22+00:00, ben-linux@org.rmk.(none) [ARM PATCH] 2454/1: cleanup shark_defconfig Patch from Ben Dooks remove a number of warnings from the default shark build Signed-off-by: Ben Dooks Signed-off-by: Russell King ChangeSet@1.1998.19.3, 2005-02-09 13:35:55+00:00, sascha@de.rmk.(none) [ARM PATCH] 2463/1: Hynix h7202 serial ports fixes Patch from Sascha Hauer This patch fixes the membase/mapbase of serial ports 1-4 and actually enables them. Signed-off-by: Sascha Hauer Signed-off-by: Russell King ChangeSet@1.1998.19.2, 2005-02-09 11:18:11+00:00, ben-linux@org.rmk.(none) [ARM PATCH] 2462/1: IXP2000 - fixes for warnings from io.h Patch from Ben Dooks Fix the include/asm-arm/arch-ipx2000/io.h to remove the warnings generated due to the IO addresses not being of the type `void __iomem *` Signed-off-by: Ben Dooks Signed-off-by: Russell King ChangeSet@1.1998.20.8, 2005-02-08 20:24:20-08:00, kaber@trash.net [PKT_SCHED]: Fix u32 double listing. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller ChangeSet@1.1998.20.7, 2005-02-08 20:22:16-08:00, tgraf@suug.ch [TCP]: Fix calculation for collapsed skb size Noticed by Denis V. Lunev and based upon original patch by Alexey Kuznetsov Signed-off-by: Thomas Graf Signed-off-by: David S. Miller ChangeSet@1.1998.20.6, 2005-02-08 20:05:07-08:00, nacc@us.ibm.com [IPV4]: ipconfig: Replace schedule_timeout() with msleep() Description: Use msleep() instead of schedule_timeout() to guarantee the task delays as expected. Change the units of the two constants to be msecs and secs respectively. Signed-off-by: Nishanth Aravamudan Signed-off-by: David S. Miller ChangeSet@1.1998.20.5, 2005-02-08 20:04:08-08:00, nacc@us.ibm.com [IPVS]: Replace schedule_timeout() with ssleep() Description: Use ssleep() instead of schedule_timeout() to guarantee the task delays as expected. The first two replacements use TASK_INTERRUPTIBLE but do not check for signals, so ssleep() should be appropriate. Signed-off-by: Nishanth Aravamudan Signed-off-by: David S. Miller ChangeSet@1.1998.20.4, 2005-02-08 16:20:23-08:00, nacc@us.ibm.com [NET]: Replace schedule_timeout() with msleep() in netdev_wait_allrefs() Description: Use msleep() instead of schedule_timeout() to guarantee the task delays as expected. The current code uses TASK_INTERRUPTIBLE, but does not respond to signals, so msleep() should be ok. Signed-off-by: Nishanth Aravamudan Signed-off-by: David S. Miller ChangeSet@1.1998.20.3, 2005-02-08 16:18:48-08:00, bunk@stusta.de [XFRM]: Kill xfrm_export.c This patch removes xfrm_export.c and moves the EXPORT_SYMBOL{,_GPL}'s to the files where the actual functions are. Signed-off-by: Adrian Bunk Signed-off-by: David S. Miller ChangeSet@1.1998.20.2, 2005-02-08 15:59:00-08:00, davem@nuts.davemloft.net [TG3]: Update driver version and reldate. Signed-off-by: David S. Miller ChangeSet@1.1998.20.1, 2005-02-08 15:57:45-08:00, grundler@parisc-linux.org [TG3]: Clean up grc_local_ctrl usage. Make the code more readable by only flipping the specific bits that need to change each register write. Signed-off-by: Grant Grundler (grundler@parisc-linux.org) Signed-off-by: David S. Miller ChangeSet@1.1998.18.1, 2005-02-08 22:10:09+00:00, buytenh@org.rmk.(none) [ARM PATCH] 2457/1: fix two typos in arch/arm/mm/tlb*.S Patch from Lennert Buytenhek Fix two typos in arch/arm/mm/tlb*.S Signed-off-by: Lennert Buytenhek Signed-off-by: Russell King ChangeSet@1.1998.1.152, 2005-02-08 09:59:28-08:00, kaos@sgi.com [IA64] mca_asm.S: Correctly dereference ia64_mca_data arch/ia64/kernel/mca_asm.S is treating per_cpu__ia64_mca_data as the start of the mca data, instead of as a pointer to the mca data. It ends up overwriting the rest of the per cpu area with the MCA stack and bspstore. Since we dereference ia64_mca_data several times, make it a macro. Signed-off-by: Keith Owens Signed-off-by: Tony Luck ChangeSet@1.1998.1.150, 2005-02-08 08:05:27-08:00, dhowells@redhat.com [PATCH] NOMMU: Documentation of no-MMU mmap The attached patch adds documentation for the behaviour of the no-MMU mmap. Signed-Off-By: David Howells Signed-Off-By: Linus Torvalds ChangeSet@1.1998.1.149, 2005-02-08 08:05:10-08:00, dhowells@redhat.com [PATCH] NOMMU: Improved handling of get_unmapped_area() errors The attached patch does two things: (1) We no longer check the return value of file->f_op->get_unmapped_area() unless we actually called it. We know addr is zero otherwise because we'd've given an error earlier if it wasn't. (2) If -ENOSYS was returned by that operation, then we assume we actually called a driver (such as the framebuffer driver) that might want to invoke the operation in a lower level driver (such as matroxfb) if one exists, and that it found that one didn't. We translate the -ENOSYS error into -ENODEV - the error we would have given if the operation was not supplied in the file ops. Doing this permits us an opportunity for arch_get_unmapped_area() or something else to be called if we want that to happen, particularly in the MMU case. Signed-Off-By: David Howells Signed-Off-By: Linus Torvalds ChangeSet@1.1998.1.148, 2005-02-08 07:59:56-08:00, torvalds@ppc970.osdl.org Fix ATM copy-to-user usage. More of the Guninski "copy_to_user() takes a size_t" series. ChangeSet@1.1998.1.147, 2005-02-08 07:48:20-08:00, neilb@cse.unsw.edu.au [PATCH] nfsd: Allow read access over NFS to files with APPEND bit set. Write access cannot safely be allowed as NFS doesn't support append, but read access should be ok. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.146, 2005-02-08 07:48:07-08:00, neilb@cse.unsw.edu.au [PATCH] nfsd: Don't try to cache reply to nfsv2 readdir. As readdir returns the reply in a separate page, the cache code cannot find the reply (and it would probably be too big anyway) so flag readdir for NOCACHE Signed-off-by: Olaf Kirch Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.145, 2005-02-08 07:47:54-08:00, neilb@cse.unsw.edu.au [PATCH] raid5 overlapping read hack If we detect an overlap, we set a flag and wait for a wakeup. When requests are handled, if the flag was set, we perform the wakeup. Note that the code currently in -mm is badly broken. With this patch applied, it passes tests the use O_DIRECT to cause lots of overlapping requests. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.144, 2005-02-08 07:47:40-08:00, neilb@cse.unsw.edu.au [PATCH] md: remove extra loop from copy_data copy_data currently loops over bio's in a list, but the caller also does the same looping, sometimes with extra work. So remove the loop from copy_data. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.143, 2005-02-08 07:47:26-08:00, neilb@cse.unsw.edu.au [PATCH] md: fix endless loop when syncing an array that doesn't need any resync. If the resync checkpoint for an array is at the end of the array, It doesn't get set to MAX_SECTOR, so resyncing will be retried. By updating curr_resync early, this problem is fixed. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.142, 2005-02-08 07:47:13-08:00, neilb@cse.unsw.edu.au [PATCH] md: make md work a bit better with devfs - set ->devfs_name - create initial devfs names slightly differently so as not to conflict - re-read partition table when an array is assembled at boot time - not sure why this is needed, but it is. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.141, 2005-02-08 07:46:57-08:00, neilb@cse.unsw.edu.au [PATCH] md: prevent oops when drive set faulty in inactive md array. hot_add_disk and hot_remove_disk check mddev->pers before proceeding. set_disk_faulty should too. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.140, 2005-02-08 07:46:44-08:00, neilb@cse.unsw.edu.au [PATCH] md: fix problems with verion-1 superblock code - off-by-one error - missing recalc of checksum Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.17.2, 2005-02-08 20:57:43+11:00, airlied@starflyer.(none) drm: fix race condition in radeon driver Close a race which could allow for privilege escalation by users with DRI privileges on Radeon hardware. Essentially, a malicious program could submit a packet containing an offset (possibly in main memory) to be rendered from/to, while a separate thread switched that offset in userspace rapidly between a valid value and an invalid one. radeon_check_and_fixup_offset() would pull the offset in from user space, check it, and spit it back out to user space to be copied in later by the emit code. It would sometimes catch the bad value, but sometimes the malicious program could modify it after the check and get an invalid offset rendered from/to. Fix this by allocating a temporary buffer and copying the data in at once. While here, make the cliprects stuff not do the VERIFYAREA_READ and COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on FreeBSD. Performance impact is negligible -- no difference on r200 to ~1% improvement on rv200 in quake3 tests (P4 1Ghz, demofour at 1024x768, n=4 or 5) From: Eric Anholt Signed-off-by: Dave Airlie ChangeSet@1.1998.17.1, 2005-02-08 19:26:24+11:00, airlied@starflyer.(none) Invalid bound check of driver defined ioctls in drm_ioctl Bug fd.o 2489 Reporter: Aapo Tahkola Signed-off-by: Dave Airlie ChangeSet@1.1998.16.11, 2005-02-07 21:32:50-08:00, andrew.vasquez@qlogic.com [PATCH] qlogic nonatomic warning fix The qlogic driver complains about the use of smp_processor_id() in preemptible code. And it's right. But it's just for an affinity optimisation and we can validly quash the warning. Signed-off-by: Andrew Vasquez Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.10, 2005-02-07 21:32:36-08:00, yuasa@hh.iij4u.or.jp [PATCH] mips: add unknown page size string This patch had fixed the following warning. arch/mips/lib-32/dump_tlb.c: In function 'dump_tlb': arch/mips/lib-32/dump_tlb.c:69: warning: control may reach end of non-void function 'msk2str' being inlined This patch adds return value, when page size is not match. Signed-off-by: Yoichi Yuasa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.9, 2005-02-07 21:32:21-08:00, e9925248@student.tuwien.ac.at [PATCH] serial: fix low-latency mode deadlock We presently deadlock in low-latency mode because the receive code holds port.lock while calling into the tty code to perform echoing. The tty code calls back into the driver, which then takes port.lock. Fix that by dropping the lock around the echo call. Acked-by: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.8, 2005-02-07 21:32:06-08:00, suresh.b.siddha@intel.com [PATCH] x86_64: missing lock prefix in switch_to Add the missing "lock" prefix in switch_to macro. Signed-off-by: Suresh Siddha Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.7, 2005-02-07 21:31:52-08:00, blaisorblade@yahoo.it [PATCH] uml: hostfs: (security) fix chmod +s permission check Frank Fricke reported that hostfs does not verify that a chmod +s, for instance, is done by a sufficiently privileged user, as long as the UML kernel itself can complete the operation on the host. So, for instance, if UML is run as root and under /mnt/host we have a hostfs mount, this works successfully: paolo@zion:~ (0)$ chmod 4755 /mnt/host/bin/bash paolo@zion:~ (0)$ ll /mnt/host/bin/bash -rwsr-xr-x 1 root root 662724 2004-10-20 02:15 /mnt/host/bin/bash* (bash refuses running as setuid, but you could have another shell on the host, as dash or whatever). In general, if UML is run as uid 500 on the host, a hostfs mount is done and under the hostfs mount there is a file with uid 500 on the host, I can freely make it setuid (if it's executable). This is especially bad when UML is run as root (which you should not do), but is a problem in general, since it allows any user to create setuid 500 (in this example) executables on the host filesystem. Finally, while I was looking at the chmod() implementation, I spotted a kludge in the code and explained it with a comment. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Cc: Frank 'xraz' Fricke Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.6, 2005-02-07 21:31:37-08:00, blaisorblade@yahoo.it [PATCH] uml: kbuild: add further cleaning Descend into arch/um/kernel/skas/util during make clean. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.5, 2005-02-07 21:31:22-08:00, mingo@elte.hu [PATCH] add design comment to kick_process() Signed-off-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.4, 2005-02-07 21:31:08-08:00, nickpiggin@yahoo.com.au [PATCH] fix wait_task_inactive race When a task is put to sleep, it is dequeued from the runqueue while it is still running. The problem is that one some arches that have non-atomic scheduling, the runqueue lock can be dropped and retaken in schedule() before the task actually schedules off, and wait_task_inactive did not account for this. Signed-off-by: Nick Piggin Signed-off-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.3, 2005-02-07 21:30:52-08:00, yust@anti-leasure.ru [PATCH] Add missing configure calls to intel agp resume code. Fix for resume on i850. Maybe for i855GM. Signed-off by: Nigel Cunningham Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.16.2, 2005-02-07 21:30:37-08:00, hch@lst.de [PATCH] add MAP_POPULATE/sys_remap_file_pages support to XFS filemap_populate needs to be exported so that filesystems with their own vm_operations (like XFS) can use it. Cc: Nathan Scott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.137, 2005-02-07 20:27:33-08:00, davem@nuts.davemloft.net [SPARC64]: Mask off stack ptr in compat_alloc_user_space() for 32-bit. Signed-off-by: David S. Miller ChangeSet@1.1998.16.1, 2005-02-07 16:43:44-08:00, johnrose@austin.ibm.com [PATCH] PCI Hotplug: fix rpaphp firmware dependency Noted by David Woodhouse Here's a fix for the ppc64 crash during boot. This corrects the offending function to use more conventional error codes. I'll follow up with return code cleanups for the entire module, and for RTAS code, since these are probably too big for 2.6.11. Signed-off-by: John Rose Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.136, 2005-02-07 15:29:42-08:00, davem@nuts.davemloft.net [SPARC64]: Update defconfig. Signed-off-by: David S. Miller ChangeSet@1.1998.11.4, 2005-02-07 11:35:09-08:00, davem@nuts.davemloft.net [SPARC64]: Fix off-by-one handling of size in user_fixup.c Noticed by Jurij Smakov Signed-off-by: David S. Miller ChangeSet@1.1998.1.134, 2005-02-07 08:37:08-08:00, torvalds@ppc970.osdl.org Undo recent tty_io.c "fix". The fix was just trying to hide the real bug, which was in an old udev script. The change made matters worse. Cset exclude: pavenis@latnet.lv[torvalds]|ChangeSet|20050202164823|05506 ChangeSet@1.1998.1.133, 2005-02-07 08:28:04-08:00, petero2@telia.com [PATCH] Make mousedev.c report all events to user space immediately mousedev_packet() clears list->ready too early when called with "tail == head - 1". The effect is that the last mouse event from the hardware isn't reported to userspace until another hardware mouse event arrives. This can make the left mouse button get stuck when tapping on a touchpad. When this happens, the butten doesn't unstick until you interact with the touchpad again. Signed-off-by: Peter Osterlund Signed-off-by: Linus Torvalds ChangeSet@1.1998.13.2, 2005-02-07 03:41:33-05:00, jgarzik@pobox.com [BK] ignore drivers/md/raid6altivec[1248].c ChangeSet@1.1998.13.1, 2005-02-07 03:00:00-05:00, jgarzik@pobox.com [block sx8] fix warning As 'i' and 'host->id' are of different types (signed vs. unsigned), we need a cast. Eventually host->id should probably be made unsigned, but this requires further analysis. ChangeSet@1.1998.12.12, 2005-02-06 22:20:30-08:00, matthew@wil.cx [IPV4]: ipconfig should use memmove() instead of strcpy() strcpy is undefined if src and dest overlap. That's clearly possible here with a sufficiently deep path on the server. Use memmove instead. Signed-off-by: Matthew Wilcox Signed-off-by: David S. Miller ChangeSet@1.1998.12.11, 2005-02-06 22:19:21-08:00, chas@cmf.nrl.navy.mil [ATM]: [zatm] replace sleep_on() with wait_event() Signed-off-by: Nishanth Aravamudan Signed-off-by: Chas Williams Signed-off-by: David S. Miller ChangeSet@1.1998.12.10, 2005-02-06 22:18:39-08:00, chas@cmf.nrl.navy.mil [ATM]: [iphase] remove sleep_on*() usage Signed-off-by: Nishanth Aravamudan Signed-off-by: Chas Williams Signed-off-by: David S. Miller ChangeSet@1.1998.12.9, 2005-02-06 22:17:47-08:00, chas@cmf.nrl.navy.mil [ATM]: [horizon] replace interruptible_sleep_on() with wait_event_interruptible() Signed-off-by: Nishanth Aravamudan Signed-off-by: Chas Williams Signed-off-by: David S. Miller ChangeSet@1.1998.12.8, 2005-02-06 22:11:58-08:00, bunk@stusta.de [CRYPTO]: Make some code static in i386 crypto AES. This patch makes some needlessly global code static. Signed-off-by: Adrian Bunk Signed-off-by: James Morris Signed-off-by: David S. Miller ChangeSet@1.1998.12.7, 2005-02-06 22:00:12-08:00, tgraf@suug.ch [NETLINK]: Use SKB_MAXORDER to calculate NLMSG_GOODSIZE NLMSG_GOODSIZE specifies a good default size for the skb tailroom used in netlink messages when the size is unknown at the time of the allocation. The current value doesn't make much sense anymore because skb_shared_info isn't taken into account which means that depending on the architecture NLMSG_GOOSIZE can exceed PAGE_SIZE resulting in a waste of almost a complete page. Using SKB_MAXORDER solves this potential leak at the cost of slightly smaller but safer sizes for some architectures. Signed-off-by: Thomas Graf Signed-off-by: David S. Miller ChangeSet@1.1998.12.6, 2005-02-06 21:49:00-08:00, kaber@trash.net [NETFILTER]: Clean NAT status bits on module unload another patch which I think should go in 2.6.11, it fixes a crash when unloading, then reloading iptable_nat. ip_nat_core doesn't clear the status bits in struct ip_conntrack on module unload, but zeroes out the nat area. When the module is loaded again and a connection times out ip_nat_cleanup_conntrack tries to list_del the zeroed list-head and crashes. There are probably more conditions under which it can crash or cause other misbehaviour. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller ChangeSet@1.1998.12.4, 2005-02-06 21:43:24-08:00, shemminger@osdl.org [PKT_SCHED]: netem: memory leak Good catch.. netem needs to free skb's that are dropped due to loss simulation. Signed-off-by: David S. Miller ChangeSet@1.1998.12.3, 2005-02-06 21:41:12-08:00, yoshfuji@linux-ipv6.org [IPV6]: Fix tunnel list locking in ip6_tunnel.c We need to fix tunnel list locking in ip6_tunnel.c as well. Noticed by jean-mickael guerin . Signed-off-by: Hideaki YOSHIFUJI Signed-off-by: David S. Miller ChangeSet@1.1998.12.2, 2005-02-06 21:40:01-08:00, kaber@trash.net [PKT_SCHED]: ipt action: add back pskb_expand_head() call Jamal asked me to add back the call to pskb_expand_head before 2.6.11. This fixes a regression caused by my tc action cleanup patches, the tc actions most not replace packets, so it must prevent netfilter from doing so. Signed-off-by: Patrick McHardy Signed-off-by: David S. Miller ChangeSet@1.1998.11.3, 2005-02-06 21:20:23-08:00, davem@nuts.davemloft.net [DOC]: Some atomic_ops.txt updates. Based upon feedback from Linus: - Touch on xchg(), cmpxchg() and spinlocks lightly. - Discuss atomic_dec_and_test() - Add some historical platform notes. Signed-off-by: David S. Miller ChangeSet@1.1998.11.2, 2005-02-06 20:52:02-08:00, davem@nuts.davemloft.net [SPARC64]: Correct rwlock membars. read_unlock should order all previous memory operations before the atomic counter update to drop the lock. The debugging version of write_unlock had a similar error. Signed-off-by: David S. Miller ChangeSet@1.1998.11.1, 2005-02-06 20:43:48-08:00, davem@nuts.davemloft.net [SPARC64]: Add missing membars for xchg() and cmpxchg(). Signed-off-by: David S. Miller ChangeSet@1.1998.10.2, 2005-02-06 22:58:27+00:00, rmk@flint.arm.linux.org.uk [ARM] Re-order lubbock includes Include asm/hardware/*.h before asm/arch/*.h Signed-off-by: Russell King ChangeSet@1.1998.10.1, 2005-02-06 22:49:26+00:00, nico@org.rmk.(none) [ARM PATCH] 2458/1: prevent PXA2xx defines from clashing with SA1111's Patch from Nicolas Pitre A more elegant solution could be applied which would require more work. However there is only one platform using both chips (Lubbock) and half of the SA1111 features are unusable due to botched DMA support at the PCB level anyway. Therefore this solution should be sufficient for now. Also removed the SADIV defines which use would not constitute good programming practice. Divisors should be computed directly in the code especially since different PXA2xx versions have different clock source frequencies. No in-tree driver uses them so this is low impact.. Finally changed alignment to fit rest of file. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King ChangeSet@1.1998.7.21, 2005-02-06 14:21:12+01:00, tj@home-tj.org [ide] remove unused pkt_task_t definition from ide.h Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.20, 2005-02-06 14:15:43+01:00, tj@home-tj.org [ide serverworks] merge serverworks.h into serverworks.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.19, 2005-02-06 14:06:28+01:00, tj@home-tj.org [ide serverworks] remove unused SVWKS_DEBUG_DRIVE_INFO Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.18, 2005-02-06 14:02:54+01:00, tj@home-tj.org [ide piix] merge piix.h into piix.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.17, 2005-02-06 13:57:51+01:00, bzolnier@trik.(none) [ide piix] remove useless comment Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.16, 2005-02-06 13:54:04+01:00, tj@home-tj.org [ide pdc202xx_old] merge pdc202xx_old.h into pdc202xx_old.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.9.1, 2005-02-06 02:49:13-08:00, davem@kernel.bkbits.net Merge davem@nuts.davemloft.net:/disk1/BK/net-2.6 into kernel.bkbits.net:/home/davem/net-2.6 ChangeSet@1.1992.7.11, 2005-02-06 01:57:50-05:00, jgarzik@pobox.com [libata ahci] Add support for ULi M5288 Contributed by Peer Chen @ ULi ChangeSet@1.1992.7.10, 2005-02-06 00:04:29-05:00, mkrikis@yahoo.com [PATCH] libata: fix ata_piix on ICH6R in RAID mode Here is the cleaned up patch (as you suggested) that enables ata_piix to work in RAID mode on ICH6R. I tested it and it seems to behave correctly in all the modes---sees all 4 disks in IDE and RAID modes, doesn't see any in Compatibility mode (which is right, because only two are available and the regular IDE driver has picked them up already). Change description: only test for PCI IDE legacy mode, via the PCI programming interface register, if the PCI device is of class PCI_CLASS_STORAGE_IDE. Signed-off-by: Martins Krikis Signed-off-by: Jeff Garzik ChangeSet@1.1998.6.5, 2005-02-05 19:51:48-08:00, davem@nuts.davemloft.net [SPARC64]: Kill spurious semicolons in some system.h macros Signed-off-by: David S. Miller ChangeSet@1.1992.10.7, 2005-02-05 19:24:20-08:00, herbert@gondor.apana.org.au [NET]: Add barriers for dst refcnt. In light of the recent discussion about sk_buff, I think we need the following patch for dst_entry. This adds a memory barrier before dst_release drops the refcnt, and a read memory barrier before dst_destroy starts destroying the entry. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller ChangeSet@1.1992.10.6, 2005-02-05 19:23:27-08:00, herbert@gondor.apana.org.au [NET]: Add missing memory barrier to kfree_skb(). Also kill kfree_skb_fast(), that is a relic from fast switching which was killed off years ago. The bug is that in the case where we do the atomic_read() optimization, we need to make sure that reads of skb state later in __kfree_skb() processing (particularly the skb->list BUG check) are not reordered to occur before the counter read by the cpu. Thanks to Olaf Kirch and Anton Blanchard for discovering and helping fix this bug. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller ChangeSet@1.1992.7.9, 2005-02-05 21:54:35-05:00, jpaana@s2.org [libata sata_promise] add PCI ID for new SATAII TX2 card ChangeSet@1.1992.7.8, 2005-02-05 21:29:11-05:00, syntax@pa.net [libata sata_sil] add another Seagate drive to blacklist ChangeSet@1.1998.7.15, 2005-02-06 03:21:50+01:00, tj@home-tj.org [ide pdc202xx_old] remove SPLIT_BYTE() macro Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.7.7, 2005-02-05 21:20:34-05:00, zaitcev@redhat.com [libata] fix probe object allocation bugs The code previously alloced a 2-entry array, then freed each entry individually, for users of "combined mode". Convert code to use allocation function that only allocates one object at a time. Also, un-export ata_pci_init_legacy_mode(), as its only user is libata-core. ChangeSet@1.1998.7.14, 2005-02-06 03:15:30+01:00, tj@home-tj.org [ide pdc202xx_new] merge pdc202xx_new.h into pdc202xx_new.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.13, 2005-02-06 03:03:28+01:00, tj@home-tj.org [ide opti621] merge opti621.h into opti621.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.12, 2005-02-06 02:56:04+01:00, tj@home-tj.org [ide it8172] merge it8172.h into it8172.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.11, 2005-02-06 02:46:43+01:00, tj@home-tj.org [ide hpt366] merge hpt366.h into hpt366.c bart: while at it do whitespace cleanup and add missing FIXME Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.7.6, 2005-02-05 20:22:23-05:00, russb@emc.com [libata scsi] verify cmd bug fixes/support Also, trim trailing whitespace. ChangeSet@1.1998.7.10, 2005-02-06 02:14:06+01:00, bzolnier@trik.(none) [ide hpt366] remove dead fifty_base_hpt374[] table Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.9, 2005-02-06 02:00:32+01:00, tj@home-tj.org [ide pci generic] merge generic.h into generic.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.8, 2005-02-06 01:56:35+01:00, bzolnier@trik.(none) [ide pci generic] remove dummy init_chipset_generic() ->init_chipset is optional Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.7, 2005-02-06 01:40:45+01:00, bzolnier@trik.(none) [ide pci generic] remove dead unknown_chipset[] table from generic.h Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.6, 2005-02-06 01:34:16+01:00, tj@home-tj.org [ide cy82c693] merge cy82c693.h into cy82c693.c bart: do small whitespace cleanup while at it Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.5, 2005-02-06 01:21:00+01:00, tj@home-tj.org [ide cmd64x] merge cmd64x.h into cmd64x.c Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.4, 2005-02-06 01:13:44+01:00, tj@home-tj.org [ide aec62xx] merge aec62xx.h into aec62xx.c bart: s/byte/u8/ Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.3, 2005-02-06 01:02:31+01:00, tj@home-tj.org [ide aec62xx] remove SPLIT_BYTE() and MAKE_WORD() macros bart: leave BUSCLOCK() alone for now Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.7.2, 2005-02-06 00:44:27+01:00, viro@parcelfarce.linux.theplanet.co.uk [ide] fix ide_dump_atapi_status() From: Al Viro On Fri, 4 Feb 2005, Al Viro wrote: > BTW, ide-lib.c code that triggers the ICE happens to be completely broken. > Jens, it's your patch from September 2002 - what used to be > if ((stat & (BUSY_STAT|ERR_STAT)) == ERR_STAT) { > became > if ((status.all & (status.b.bsy|status.b.check)) == status.b.check) { > and that's *not* an equivalent transformation. Fixing it doesn't get rid > of ICE, but it certainly deserves fixing. Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.6.4, 2005-02-05 15:39:15-08:00, davem@nuts.davemloft.net [DOC]: Add asm/atomic.h asm/bitops.h implementation specification. Signed-off-by: David S. Miller ChangeSet@1.1998.6.3, 2005-02-05 15:25:59-08:00, davem@nuts.davemloft.net [SPARC64]: atomic and bitop fixes. 1) Correct memory barriers. Routines not returning a value need no memory barriers, however routines returning values do need them. 2) Actually implement non-atomic ext2 bitops. Thanks to Anton Blanchard for pointing out the memory barrier requirements. Signed-off-by: David S. Miller ChangeSet@1.1998.1.125, 2005-02-05 15:25:54-08:00, torvalds@ppc970.osdl.org FRV: "len" is size_t Georgi Guninski has some tools that warn about bad user accesses. This one was harmless, but still.. ChangeSet@1.1998.7.1, 2005-02-06 00:11:07+01:00, khali@linux-fr.org [ide] fix hwif_init() to not return error for "empty" interfaces Return success if no device is connected to the interface. Signed-off-by: Jean Delvare Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.1.124, 2005-02-05 15:10:06-08:00, fabbione@fabbione.net [PATCH] x86_64: parse noexec=[on|off] The patch fixes the noexec= boot option on x86_64 to actually work when other options come after it. Credits (if any ;)) should go to Matt Zimmerman and Colin Watson for spotting the problem and providing/testing the fix. Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.123, 2005-02-05 15:09:52-08:00, ak@muc.de [PATCH] x86-64: CONFIG_PM=n build fix This patch fixes a compile problem on x86-64 when CONFIG_PM is turned off. Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.122, 2005-02-05 15:09:38-08:00, matthias.christian@tiscali.de [PATCH] speedstep-lib.c: fix frequency multiplier for Pentium4 models 0&1 The Pentium4 models 0&1 have a longer MSR_EBC_FREQUENCY_ID register as the models 2&3, so the bit shift must be bigger. Signed-off-by: Matthias-Christian Ott Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.121, 2005-02-05 15:09:24-08:00, hugh@veritas.com [PATCH] do_munmap() hugetlb fix The hugetlb_page test in do_munmap is too permissive. It checks start vma, but forgets that end vma might be different and huge though start is not: so hits unmap_hugepage_range BUG if misaligned end was given. And it's too restrictive: munmap has always succeeded on unmapped areas within its range, why should it behave differently near a hugepage vma? And the additional checks in is_aligned_hugepage_range are irrelevant here, when the hugepage vma already exists. But the function is still required (on some arches), as the default for prepare_hugepage_range - leave renaming cleanup to another occasion. Signed-off-by: Hugh Dickins Acked-by: William Irwin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.120, 2005-02-05 15:09:11-08:00, agruen@suse.de [PATCH] Long-standing xattr sharing bug When looking for identical xattr blocks to share, we were not comparing the name_index fields. This could lead to false sharing when two xattr blocks ended up with identical attribute names and values, and the only default acls. Because acls are cached, the bug was hidden until the next reload of the affected inode. $ mkdir -m 700 a b $ setfacl -m u:bin:rwx a < acl of a goes in the mbcache $ setfacl -dm u:bin:rwx b < acl of b differs only in name_index, so a's acl is reused $ getfacl b < shows the result from the inode cache < empty inode cache (remount, etc.) $ getfacl b < shows an access acl instead of a default acl. Signed-off-by: Andreas Gruenbacher Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.119, 2005-02-05 15:08:57-08:00, hugh@veritas.com [PATCH] remove truncate mapped BUG It's time to remove truncate_complete_page's BUG_ON(page_mapped(page)): it was there to give confidence in the new vm_truncate_count mechanism. Earlier releases had no such check, and it wouldn't be at all helpful if it ever bugged up file truncation on a production system - though we don't know of any scenario in which that could happen now. Signed-off-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.118, 2005-02-05 15:08:43-08:00, hugh@veritas.com [PATCH] tmpfs caused truncate BUG Just before removing truncate_complete_page's BUG_ON(page_mapped(page)), thought I'd recheck on a few filesystems. The shame! Easily triggered with tmpfs: not because of recent changes, but because shmem_nopage omitted the i_size_read from Andrea's careful truncate_count/i_size_read /cachelookup/truncate_count sequence. For varying reasons, other users of shmem_getpage can't go beyond i_size, so just add it to shmem_nopage. Signed-off-by: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.6.2, 2005-02-05 14:54:09-08:00, davem@nuts.davemloft.net [SPARC64]: Consolidate pgd_cache calculations. Do it in one spot, a macro named get_pgd_cache(), instead of three different places. Signed-off-by: David S. Miller ChangeSet@1.1998.6.1, 2005-02-04 21:33:26-08:00, breuerr@mc.net [SPARC]: Fix crashing of cg14 driver when serial console and vsimm installed. Signed-off-by: David S. Miller ChangeSet@1.1998.1.117, 2005-02-04 20:12:20-08:00, torvalds@ppc970.osdl.org Add extra debugging help for bad user accesses. ChangeSet@1.1998.1.116, 2005-02-04 19:49:54-08:00, paulus@samba.org [PATCH] Fix PPC rwlock code on SMP Currently, the kernel won't compile for SMP ppc32 if preempt is enabled. This patch adds suitable read_can_lock and write_can_lock definitions. This patch also adds a real _raw_read_trylock (inline and out-of-line versions), changes the rwlock->lock field to a signed int, which is what it really was all along, and cleans up the out-of-line rwlock code in arch/ppc/lib/locks.c. It removes the debug fields from the rwlock struct because we were never using them, even with CONFIG_DEBUG_SPINLOCK set. I have compile and boot tested this with the four combinations of CONFIG_DEBUG_SPINLOCKS on and off, and CONFIG_PREEMPT on and off. Please put this patch into 2.6.11 so that 2.6.11 will work for ppc32 with CONFIG_SMP and CONFIG_PREEMPT. Signed-off-by: Paul Mackerras Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.115, 2005-02-04 19:20:45-08:00, venkatesh.pallipadi@intel.com [PATCH] x86: HPET setup, duplicate HPET_T0_CMP needed for some platforms This patch fixes the issue with HPET on some platforms. According to Vojtech Pavlik: The first write after writing TN_SETVAL to the config register sets the counter value, the second write sets the threshold. When you only do the first write you never set the threshold and interrupts won't be generated properly. Thanks to John Stultz and Andrew Walrond for reporting, root causing the issue and verifying this fix. Signed-off-by: Venkatesh Pallipadi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.114, 2005-02-04 19:20:31-08:00, sfr@canb.auug.org.au [PATCH] ppc64: replace last usage of vio dma mapping routines This patch just replaces the last usage of the vio dma mapping routines with the equivalent generic dma mapping routines. Signed-off-by: Stephen Rothwell Signed-off-by: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.113, 2005-02-04 19:20:17-08:00, nathanl@austin.ibm.com [PATCH] ppc64: show -1 for physical_id of non-present cpus Make the physical_id cpu sysfs attribute on ppc64 show -1 instead of 65535 for non-present cpus. Signed-off-by: Nathan Lynch Signed-off-by: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.112, 2005-02-04 19:20:03-08:00, paulus@samba.org [PATCH] ppc64: correct return code in syscall auditing This patch is from David Woodhouse . We were pretending that every syscall returned zero. Don't do that. Signed-Off-By: David Woodhouse Signed-off-by: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.111, 2005-02-04 19:19:47-08:00, anton@samba.org [PATCH] Use MM_VM_SIZE in exit_mmap The 4 level pagetable code changed the exit_mmap code to rely on TASK_SIZE. On some architectures (eg ppc64 and ia64), this is a per task property and bad things can happen in certain circumstances when using it. It is possible for one task to end up "owning" an mm from another - we have seen this with the procfs code when process 1 accesses /proc/pid/cmdline of process 2 while it is exiting. Process 2 exits but does not tear its mm down. Later on process 1 finishes with the proc file and the mm gets torn down at this point. Now if process 1 was 32bit and process 2 was 64bit then we end up using a bad value for TASK_SIZE in exit_mmap. We only tear down part of the address space and leave half initialised pagetables and entries in the MMU etc. MM_VM_SIZE() was created for this purpose (and is used in the next line for tlb_finish_mmu), so use it. I moved the PGD round up of TASK_SIZE into the default MM_VM_SIZE. Signed-off-by: Anton Blanchard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.110, 2005-02-04 19:19:34-08:00, dwmw2@infradead.org [PATCH] TASK_SIZE is variable. Bad things can happen if a 32-bit process is the last user of a 64-bit mm. TASK_SIZE isn't a constant, and we can end up clearing page tables only up to the 32-bit TASK_SIZE instead of all the way. We should probably double-check every instance of TASK_SIZE or USER_PTRS_PER_PGD for this kind of problem. We should also double-check that MM_VM_SIZE() and other such things are correctly defined on all architectures. I already fixed ppc64 which let it stay as TASK_SIZE, and hence dependent on the _current_ context instead of the mm in the argument. Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.109, 2005-02-04 19:19:20-08:00, trini@kernel.crashing.org [PATCH] ppc32: MPC82xx PCI9 errata workaround broken Changeset 1.1938.196.11 broke MPC8260 PCI9 Errata workaround. This pach makes it work again. Signed-off-by: Rune Torgersen Signed-off-by: Tom Rini Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.108, 2005-02-04 19:19:04-08:00, jdike@addtoit.com [PATCH] uml: fix x86_64 submode compilation Forgot to use ARCH_USER_CFLAGS after defining it for x86_64. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.107, 2005-02-04 19:18:49-08:00, jdike@addtoit.com [PATCH] uml: fix STATIC_LINK compilation This fixes a bug which assumes that __binary_start starts on a page boundary, which isn't true when UML is configured to load into the normal executable area. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.106, 2005-02-04 19:18:36-08:00, jdike@addtoit.com [PATCH] uml: fix broken #ifdef clause causing crashes The previous ifdef to check whether to use the host's vsyscall page was buggy. This bug can cause crashes. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.105, 2005-02-04 19:18:22-08:00, jdike@addtoit.com [PATCH] uml: fix jiffies initialization Initialize jiffies_64 to INITIAL_JIFFIES. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.104, 2005-02-04 19:18:08-08:00, bstroesser@fujitsu-siemens.com [PATCH] uml: disallow stack access below $esp like i386 / x86_64 When a page fault occurs on an address below the stack-vma, UML tries to expand the stack. On i386 and x86_64, the failing address is compared to the current userspace stack pointer. If the failing address is below "esp-32" resp. "rsp-128", stack expansion is not allowed, and a SIGSEGV is given to the user. This patch makes UML behave like i386/x86_64. Signed-off-by: Bodo Stroesser Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.103, 2005-02-04 19:17:54-08:00, jdike@addtoit.com [PATCH] uml: Fix SKAS sig-handler reentrancy This adds code which enables SIGSEGV reception to the SKAS sig_handler_common, which matches the tt code. I still need to figure out why the SA_NODEFER flag was backed out in favor of this. Signed-off-by: Paolo 'Blaisorblade' Giarrusso CC: uml-devel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.102, 2005-02-04 19:17:41-08:00, blaisorblade@yahoo.it [PATCH] uml: kconfig fixes Change some config text (hide CONFIG_MODVERSION which is broken on UML and fix a dummy prompt). Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.101, 2005-02-04 19:17:26-08:00, blaisorblade@yahoo.it [PATCH] uml: fix compilation for missing headers Re-add some needed headers inclusion deleted in http://linux.bkbits.net:8080/linux-2.5/cset@41e49628dGbOWX-bT9yZII4f19GT6A If you think it cannot make sense to include both and (as userspace process, i.e. host includes), go complaining with glibc, or follow the linux-abi includes idea. However, the compilation failure is possibly glibc-version (or better glibc includes version) related - what I now is that the failure happens on my system with a glibc 2.3.4 (from Gentoo). Also, fix the syscall table to both compile and have no empty slot (which could cause Oopses). Acked-by: Jeff Dike Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.100, 2005-02-04 19:17:12-08:00, blaisorblade@yahoo.it [PATCH] uml: makefile fix arch/um/Kconfig_arch is actually a symlink, so * Remove it from the tree. * Make sure it is removed during make mrproper. Signed-off-by: Paolo 'Blaisorblade' Giarrusso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.99, 2005-02-04 19:16:59-08:00, akpm@osdl.org [PATCH] nfsd needs exportfs With NFSD=y, EXPORTFS=m: fs/built-in.o(.text+0x7fff5): In function `fh_verify': /usr/src/25/fs/nfsd/nfsfh.c:221: undefined reference to `export_op_default' So it seems that nfsd requires exportfs. For consistency we should tidy up the definition of EXPORTFS too. Signed-off-by: Neil Brown Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.98, 2005-02-04 19:16:45-08:00, michal@logix.cz [PATCH] Update Michal Ludvig details Signed-off-by: Michal Ludvig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.97, 2005-02-04 19:16:31-08:00, nacc@us.ibm.com [PATCH] include/jiffies: fix usecs_to_jiffies()/jiffies_to_usecs() math Fixes the math of both jiffies_to_usecs() and usecs_to_jiffies() which improperly assume the same rounding point -- 1,000 -- as jiffies_to_msecs() and msecs_to_jiffies(), when in fact it should be 1,000,000. Furthermore, the actual math of both functions is actually wrong and will lead to more than just rounding errors. Signed-off-by: Nishanth Aravamudan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.96, 2005-02-04 19:16:18-08:00, jimix@watson.ibm.com [PATCH] Fix devfs name for the hvcs driver The hvcs driver does not register a devfs_name resulting in devfs creating /dev/* entries. The following one line patch remedies the problem. Signed-off-by: Jimi Xenidis Signed-off-by: Paul Mackerras Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.95, 2005-02-04 19:16:04-08:00, davej@redhat.com [PATCH] ibmveth inlining failure. Yet another ppc64 build failure.. Move the function before its first usage, and the failure goes away. Signed-off-by: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.94, 2005-02-04 19:15:50-08:00, nanhai.zou@intel.com [PATCH] fix an error in /proc/slabinfo print There is an obvious error in the header of /proc/slabinfo Signed-off-by: Zou Nan hai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.93, 2005-02-04 19:15:36-08:00, jgreen@users.sourceforge.net [PATCH] pcmcia: ds.c initialisation fix A wrong ordering of operators in pcmica_register_client() causes initialization problems with multiple PCMCIA cards. Signed-off-by: Josh Green Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.92, 2005-02-04 19:15:23-08:00, sds@tycho.nsa.gov [PATCH] SELinux: fix selinux_inode_setattr hook This fixes the selinux_inode_setattr hook function to honor the ATTR_FORCE flag, skipping any permission checking in that case. Otherwise, it is possible though unlikely for a denial from the hook to prevent proper updating, e.g. for remove_suid upon writing to a file. This would only occur if the process had write permission to a suid file but lacked setattr permission to it. Signed-off-by: Stephen Smalley Signed-off-by: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.5.2, 2005-02-05 01:59:27+01:00, marcel@holtmann.org [Bluetooth] Support for Digianswer BPA 100/105 sniffers This adds a driver for the Digianswer BPA 100/105 USB sniffer devices. These devices are using a H:4 over H:2 host transport protocol for the HCI communication. Signed-off-by: Marcel Holtmann ChangeSet@1.1998.5.1, 2005-02-05 01:55:56+01:00, marcel@holtmann.org [Bluetooth] Support Broadcom BCM92035 USB dongles This patch adds support for special initialization commands inside the Bluetooth core layer. It is used for the BCM92035 USB dongles from Broadcom to switch them from HID mode into HCI mode. Signed-off-by: Marcel Holtmann ChangeSet@1.1998.1.91, 2005-02-04 15:26:44-08:00, greg@kroah.com [PATCH] Update greg's email address I have a new job. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.90, 2005-02-04 15:26:30-08:00, dhowells@redhat.com [PATCH] FRV: vmlinux.lds.S comment cleanup This cleans up a comment in vmlinux.lds.S - emacs now has an LD script mode, so it shouldn't be forced into C mode. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.89, 2005-02-04 15:26:15-08:00, dhowells@redhat.com [PATCH] FRV: Make the bit finding functions take const pointers This makes the bit finding functions in asm/bitops.h take const pointers since they don't modify what they access. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.88, 2005-02-04 15:26:01-08:00, dhowells@redhat.com [PATCH] FRV: Add TIF_MEMDIE This adds TIF_MEMDIE for FRV. Could whoever added it to include/asm-i386/thread_info.h comment this flag there please? I've given it a comment here, but I'm not sure it's correct. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.87, 2005-02-04 15:25:47-08:00, dhowells@redhat.com [PATCH] FRV: Semaphore implementation race fix This fixes a race in the FRV arch's semaphore implementation. The same type of fixes were applied to the rw-semaphore implementations to fix the same races there. The race involved the on-stack record linked into the semaphore's queue by the down() executed by a process now sleeping on the semaphore going away and the sleeping task going away before the process that woke it up during up() processing had finished with those structures. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.86, 2005-02-04 15:25:33-08:00, dhowells@redhat.com [PATCH] FRV: cli/sti cleanup This cleans up the remaining references to the cli() and sti() functions from the FRV arch now they're deprecated. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.85, 2005-02-04 15:25:19-08:00, dhowells@redhat.com [PATCH] FRV: Make switch_to() return previous task This makes switch_to() on the FRV pass through and return the previous task pointer rather than trusting to luck that it'll be left in the correct register/variable. Signed-Off-By: David Howells Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.84, 2005-02-04 10:25:20-08:00, alan@lxorguk.ukuu.org.uk [PATCH] more fixes for the Moxa driver One user hit problems on SMP that are caused by long standing mxser violations of the tty rules. Another report including problems with request_irq being called with locks held (legal in 2.4 but not 2.6 due to procfs). This fixes both of them Signed-off-by: Alan Cox Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.83, 2005-02-04 10:01:31-08:00, nickpiggin@yahoo.com.au [PATCH] Fix kswapd spinning When a zone (usually DMA) has no active pages, pages_scanned (which triggers all_unreclaimable) is only incremented when scanning the active list. Make sure it's incremented for scanned cache entries too. Tested-by: Terje Fåberg Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.82, 2005-02-04 08:21:12-08:00, jdike@addtoit.com [PATCH] UML: remove not-yet-merged system calls This fixes UML's sys_call_table to delete some entries for system calls which have not yet made it into mainline from -mm. I also delete UML's __pud_alloc implementation since the memory.c one is now enabled. Signed-off-by: Jeff Dike Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.80, 2005-02-04 07:56:11-08:00, kraxel@bytesex.org [PATCH] tv-card tuner fixup disable + comment current secam tweak, will not work that way ... Signed-off-by: Gerd Knorr Signed-off-by: Linus Torvalds ChangeSet@1.2001, 2005-02-03 21:21:47-06:00, jejb@mulgrave.(none) megaraid_mbox 2.20.4.3 patch From: Ju, Seokmann - sysfs support for drive addition/removal - Tape drive timeout issue - Made some code static Signed-off-by: James Bottomley ChangeSet@1.1998.1.79, 2005-02-03 17:09:48-08:00, ralf@linux-mips.org [PATCH] mips: SGI IP22 updates o Remove old unused header files o Update the VINO video driver to something that's vaguely working o Bug fixes for the IP22 Zilog driver o Fix use of config.h Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.78, 2005-02-03 17:05:33-08:00, linux@dominikbrodowski.de [PATCH] pcmcia: m32 registration failure fixup The pseudo-unregistration of PCMCIA sockets in case the registration of any such socket failed causes lockups. See http://bugme.osdl.org/show_bug.cgi?id=4115 for details (same problem, Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.77, 2005-02-03 17:05:20-08:00, linux@dominikbrodowski.de [PATCH] pcmcia: i82365 registration failure fixup Fix a bug which was diagnosed by David Howard . The pseudo-unregistration of PCMCIA sockets in case the registration of any such socket failed causes lockups. See http://bugme.osdl.org/show_bug.cgi?id=4115 for details Signed-off-by: Dominik Brodowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.76, 2005-02-03 17:05:05-08:00, sripathik@in.ibm.com [PATCH] s390: compat_sys_old_readdir and compat_sys_getdents s390 should use the generic compat functions for compat_sys_old_readdir and compat_sys_getdents. The s390 specific ones are buggy and superflous. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.75, 2005-02-03 17:04:51-08:00, hare@suse.de [PATCH] s390: compat SI_TIMER conversion tst-timer4 from the glibc fails in the 32bit compat execution environment. This is due to a incomplete siginfo structure for POSIX.1b timers in compat_signal.c. Signed-off-by: Hannes Reinecke Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.74, 2005-02-03 17:04:37-08:00, schwidefsky@de.ibm.com [PATCH] s390: qeth network driver From: Steffen Thoss From: Frank Pavlic qeth network driver changes: - Improve performance by omitting svs. - Use function callback mechanism to set layer 2 parameters when getting a reply for a Layer 2 command. - dev->hard_header must not be NULL when fake_ll is no set since IPv6 and Layer2 needs the default function set by network stack. - ping6 works now when running in layer 2 mode. - Save original dev->hard_header to restore it when the user doesn't want to use fake_ll anymore. - Fake ethernet header in outgoing packets. This currently works only if qeth is compiled without ipv6 support. - Add more debug information in case of failures in qeth_set_offline. - Using fake_ll with HiperSockets devices results in misaligned ip packets and thus no traffic over HiperSockets. - Start qeth_remove_device only after the qeth recovery completed. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.73, 2005-02-03 17:04:23-08:00, tspat@de.ibm.com [PATCH] s390: key protected i/o Add interface for key protected i/o. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.72, 2005-02-03 17:04:09-08:00, cohuck@de.ibm.com [PATCH] s390: common i/o layer Common i/o layer changes: - Allow ccw_device_halt() and ccw_device_clear() in state WAIT4IO. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.71, 2005-02-03 17:03:54-08:00, horst.hummel@de.ibm.com [PATCH] s390: dasd i/o scheduler & debug logs dasd driver change: - Set default i/o scheduler to 'deadline'. Latest performance results indicate that this works fastest. - Set default debug feature level to DBF_EMERG. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.70, 2005-02-03 17:03:40-08:00, cborntra@de.ibm.com [PATCH] s390: cpcmd interface - Diagnose 8 needs a response buffer below 2GB real storage. As the caller cannot always allocate the buffer with GFP_DMA the best solution is to rewrite cpcmd to use a bounce buffer if necessary. The old function was renamed to __cpcmd and can be called if appropriate. The early boot code does not provide kmalloc but need cpcmd functionality. These places have been converted to use __cpcmd, as the init code and data are below 2GB. - In case of an 31 bit system, cpcmd is defined as __cpcmd. - EXPORT_SYMBOL(cpcmd) moved into cpcmd.c - some whitespace fixes in cpcmd.[c/h] Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.69, 2005-02-03 17:03:26-08:00, jlamanna@gmail.com [PATCH] s390: vfree checking cleanup arch/s390/kernel/module.c vfree() checking cleanup. Signed-off-by: James Lamanna Signed-off-by: Domen Puncer Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.68, 2005-02-03 17:03:12-08:00, schwidefsky@de.ibm.com [PATCH] s390: core changes From: Christian Bornträger From: Heiko Carstens From: Michael Holzheu From: Martin Schwidefsky s390 core changes: - Export arch_pick_mmap_layout as GPL symbol for binfmt_elf32. - Remove unnecessary include from cmm. - Allow only root to read the debug feature logs. - Register all RAM resources, this fixes output of /proc/iomem. - Add read_can_lock and write_can_lock primitives. - Regenerate default configuration. Signed-off-by: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.67, 2005-02-03 17:02:57-08:00, mgreer@mvista.com [PATCH] ppc32: fix locking bugs in mv64x60 code This patch fixes 2 SMP deadlocks. The first is that mv64x60_read() was returning before the unlock. The second was mv64x60_modify() locks the spin lock and calls mv64x60_read() and mv64x60_write() which also lock the same spin lock. Signed-Off-By: Brian Waite Signed-off-by: Mark A. Greer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.66, 2005-02-03 17:02:43-08:00, mgreer@mvista.com [PATCH] ppc32: include/asm-ppc/rwsem.h RWSEM_DEBUG usage include/asm-ppc/rwsem.h has '#ifdef RWSEM_DEBUG' but RWSEM_DEBUG is always defined (as 0) in include/linux/rwsem.h. The #ifdef's should be #if's. This also brings the ppc usage in line with the the other architectures. Signed-off-by: Mark A. Greer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.65, 2005-02-03 17:02:28-08:00, mporter@kernel.crashing.org [PATCH] ppc32: add PPC440SP and Luan ref board support Adds support for the IBM/AMCC PPC440SP SoC. Also adds support for the Luan reference board that has a 440SP on it. Signed-off-by: Matt Porter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.64, 2005-02-03 17:02:13-08:00, mporter@kernel.crashing.org [PATCH] ppc32: PPC4xx DMA fixes, burst, and sg improvements This fixes several issues with the PPC4xx DMA library as well as adding support for bursting and some improvements to SG handling. Signed-off-by: Colin Wernham Signed-off-by: Matt Porter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.63, 2005-02-03 17:02:00-08:00, sds@tycho.nsa.gov [PATCH] SELinux: audit any unmapped permissions This patch changes SELinux to display any permission values that could not be mapped to names as a hex value when generating an audit message. Signed-off-by: Stephen Smalley Signed-off-by: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.62, 2005-02-03 17:01:47-08:00, sds@tycho.nsa.gov [PATCH] SELinux: define execmod permission for character devices This patch regenerates the SELinux module headers to define the execmod permission for character device files in order to provide proper auditing of such checks on /dev/zero. Signed-off-by: Stephen Smalley Signed-off-by: James Morris Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.61, 2005-02-03 17:01:33-08:00, dilinger@voxel.net [PATCH] cpufreq_resume() fix Since acpi_cpufreq_resume and speedstep_resume appear to return 0 upon success, it seems like the attached patch is what the desired behavior would be. Otherwise, cpufreq_resume() always prints an error and exits early if using a cpufreq_driver that supports resume. Signed-off-by: Dominik Brodowski Signed-off-by: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.60, 2005-02-03 17:01:20-08:00, arnd@arndb.de [PATCH] SERIAL_TXX9 fix The earlier patch forgot to add the Makefile change. Signed-off-by: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.59, 2005-02-03 17:01:06-08:00, fanny.wakizaka@cyclades.com [PATCH] avma1_cs: Inverted parameter order in outb avma1_cs detect routine for AVM A1 based PCMCIA cards has its "outb" parameters inverted - switch to "byteout" define to be conformant with the rest of the driver, fixing the order. This was noticed on PPC, which triggers an MCE in case of invalid IO port access, which is not the case on x86. Signed-off-by: Marcelo Tosatti Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.58, 2005-02-03 17:00:52-08:00, trini@kernel.crashing.org [PATCH] Move down in is unsafe for inclusion by userland apps, but it is in the userland-exposed portion of . It's only needed in the __KERNEL__ protected portion of the file, so move the #include down to there. lmbench-2.0.4 runs into this issue in 'flushdisk'. Signed-off-by: Tom Rini Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.57, 2005-02-03 17:00:39-08:00, jack@suse.cz [PATCH] Fix reiserfs quota SMP locks From: Vladimir Saveliev , Jan Kara Add missing SMP locking and one lock_buffer() to the reiserfs quota code. Signed-off-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.56, 2005-02-03 17:00:26-08:00, agk@redhat.com [PATCH] device-mapper: Fixes for 64-bit sector_t Fix some bugs in device-mapper handling of 64-bit values, replacing dm_div_up() and dm_round_up() inlines with macros and removing some avoidable divisions of 64-bit numbers. The mirror region size is the granularity used to manage and monitor the data copying, typically 512KB, so 32 bits (of sectors) should be plenty to hold this. Taken together with the two earlier patches: "fix TB stripe data corruption" (a missing cast) and "stripe_width should be sector_t", I've now had 3 independent reports that this fixes device-mapper for devices with large stripes. Still awaiting test results for dm-crypt and dm-raid1. Signed-Off-By: Alasdair G Kergon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.55, 2005-02-03 17:00:10-08:00, agk@redhat.com [PATCH] device-mapper: stripe_width should be sector_t stripe_width should be sector_t to support large devices. Signed-Off-By: Alasdair G Kergon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.54, 2005-02-03 16:59:56-08:00, davej@redhat.com [PATCH] ppc32: unbreak perfctr build Signed-off-by: Dave Jones Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.53, 2005-02-03 16:59:43-08:00, mst@mellanox.co.il [PATCH] InfiniBand: remove unbalance refcnt decrement Fix unbalanced QP reference count decrement (introduced with QP lock optimization patch) Signed-off-by: Michael S. Tsirkin Signed-off-by: Roland Dreier Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.52, 2005-02-03 16:59:28-08:00, libor@topspin.com [PATCH] InfiniBand: add missing break between cases Add a missing break statement between RC and UD cases in mthca_post_send(). This fixes a possible oops for protocols that use the RC transport. Signed-off-by: Libor Michalek Signed-off-by: Roland Dreier Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1998.1.51, 2005-02-03 16:59:15-08:00, akpm@osdl.org [PATCH] pnpacpi build fix - Fix it for older C compilers. - Extern decls always, always, always go in header files, please. Cc: "Brown, Len" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ChangeSet@1.1992.10.5, 2005-02-03 15:18:37-08:00, herbert@gondor.apana.org.au [XFRM]: Fix inverted strcmp() test in xfrm_get_byname(). Signed-off-by: Herbert Xu Signed-off-by: David S. Miller ChangeSet@1.1983.1.23, 2005-02-03 23:01:36+00:00, nico@org.rmk.(none) [ARM PATCH] 2456/1: fix futex syscall argument passing Patch from Nicolas Pitre sys_futex wrapper to store its sixth argument on the stack. Also fix a typo with sys_clone_wapper. Signed-off-by: Nicolas Pitre Signed-off-by: Russell King ChangeSet@1.1983.1.22, 2005-02-03 22:19:58+00:00, rmk@flint.arm.linux.org.uk [ARM] Fix sys_syscall Signed-off-by: Russell King ChangeSet@1.1998.2.7, 2005-02-03 10:31:07-08:00, torvalds@ppc970.osdl.org Merge bk://kernel.bkbits.net/gregkh/linux/2.6.11-rc3/pci into ppc970.osdl.org:/home/torvalds/v2.6/linux ChangeSet@1.1998.4.9, 2005-02-03 10:18:57-08:00, torvalds@ppc970.osdl.org Make generic rw_verify_area check against file offset overflows. Not that low-level code really tends to care, but since loff_t is a signed 64-bit entity and size_t is unsigned (and potentially 64-bit), mixing the two isn't very well-defined.. ChangeSet@1.1998.4.8, 2005-02-03 09:37:45-08:00, torvalds@ppc970.osdl.org Make read/write always do the full "access_ok()" tests. The actual user copy will do them too, but only for the range that ends up being actually copied. That hides bugs when the range has been clamped by file size or other issues. ChangeSet@1.1998.4.6, 2005-02-03 08:44:37-08:00, viro@parcelfarce.linux.theplanet.co.uk [PATCH] via82cxxx: fix ppc32 multiplatform config test PPC_MULTIPLATFORM exists both for ppc32 and ppc64; chrp and pegasos, OTOH, are ppc32-only. The ifdef in via82cxxx should be for PPC_MULTIPLATFORM and PPC32 - it makes no sense for ppc64 multiplatform and, as the matter of fact, simply won't compile there. Signed-off-by: Al Viro Signed-off-by: Linus Torvalds ChangeSet@1.1998.4.5, 2005-02-03 08:44:22-08:00, viro@parcelfarce.linux.theplanet.co.uk [PATCH] sparc64: fix compile with strict mm types compile fix on sparc64 - missed pgd_val() bites now that we have STRICT_MM_TYPECHECKS set. Incidentally, shifting _by_ unsigned long is useless - type of result is determined by the type of first argument... Signed-off-by: Al Viro Signed-off-by: Linus Torvalds ChangeSet@1.1998.4.4, 2005-02-03 08:18:37-08:00, axboe@suse.de [PATCH] md sync_page_io bio leak I accidentally introduced a leak in there, because the end_io function doesn't do a bio_put() like most others. Fortunately it's not critical, as it only happens on the md super block read. So just drop the initial bio_get(), since it's sync we can just bio_put() safely at the end after it has completed. Signed-off-by: Jens Axboe Signed-off-by: Linus Torvalds ChangeSet@1.1998.4.3, 2005-02-03 08:18:23-08:00, kraxel@bytesex.org [PATCH] DVB: No signal with bt848/tda9887 Markus Trippelsdorf reported a non-working bt848 card with the recent DVB update. It's an initialization order bug which changes the default state of the tda9887 output ports. Verified to fix the problem by Markus Trippelsdorf Signed-off-by: Linus Torvalds ChangeSet@1.1998.4.2, 2005-02-03 08:18:09-08:00, oskar.senft@gmx.de [PATCH] Fix ISDN4Linux bug in isdnhdlc.c isdnhdlc_decode is called multiple times for bigger frames, so decrementing dsize is a bad idea and can cause a overflow of the dst buffer. Signed-off-by: Karsten Keil Signed-off-by: Linus Torvalds ChangeSet@1.1992.11.17, 2005-02-03 16:59:05+01:00, bzolnier@trik.(none) [ide] fix printk in ide_allocate_dma_engine() With Olaf Hering . Parameters were interchanged. Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.16, 2005-02-03 16:52:26+01:00, prarit@sgi.com [ide] fix error handling in probe_hwif_init() and sgiioc4 driver From: Prarit Bhargava I discovered an issue where a hwif_init() failure lead to /proc/ide files being created for devices that failed probes. This resulted in oops/WARN_ON/BUG_ON executions through the kernel depending on what actions were on going. slightly changed by me (bart) Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.15, 2005-02-03 16:50:28+01:00, tj@home-tj.org [ide] add ide_hwgroup_t.polling ide_hwgroup_t.polling field added. 0 in poll_timeout field used to indicate inactive polling but because 0 is a valid jiffy value, though slim, there's a chance that something weird can happen. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.14, 2005-02-03 16:48:42+01:00, tj@home-tj.org [ide] add ide_drive_t.sleeping ide_drive_t.sleeping field added. 0 in sleep field used to indicate inactive sleeping but because 0 is a valid jiffy value, though slim, there's a chance that something can go weird. And while at it, explicit jiffy comparisons are converted to use time_before() macros. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.13, 2005-02-03 16:47:16+01:00, tj@home-tj.org [ide] comment fixes Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.12, 2005-02-03 16:45:57+01:00, tj@home-tj.org [ide] remove NULL checking in ide_error() In ide_error(), drive cannot be NULL. ide_dump_status() can't handle NULL drive. From: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.11, 2005-02-03 16:44:41+01:00, tj@home-tj.org [ide] ide-tape: use time_after() macro Explicit jiffy comparision converted to time_after() macro. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.10, 2005-02-03 16:43:04+01:00, tj@home-tj.org [ide] __ide_do_rw_disk() return value fix In __ide_do_rw_disk(), ide_started used to be returned blindly after issusing PIO write. This can cause hang if pre_task_out_intr() returns ide_stopped due to failed ide_wait_stat() test. Fixed to pass the return value of pre_task_out_intr(). Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.9, 2005-02-03 16:41:20+01:00, tj@home-tj.org [ide] __ide_do_rw_disk() lba48 dma check fix In __ide_do_rw_disk(), the shifted block, instead of the original rq->sector, should be used when checking range for lba48 dma. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.8, 2005-02-03 16:39:36+01:00, tj@home-tj.org [ide] cleanup piix In drivers/ide/pci/piix.[hc], init_setup_piix() is defined and used but only one init_setup function is defined and no demultiplexing is done using init_setup callback. As other drivers call ide_setup_pci_device() directly in such cases, this patch removes init_setup_piix() and makes piix_init_one() call ide_setup_pci_device() directly. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.7, 2005-02-03 16:38:05+01:00, tj@home-tj.org [ide] cleanup opti621 In drivers/ide/pci/opti612.[hc], init_setup_opti621() is declared, defined and referenced but never actually used. This patch removes the function. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.6, 2005-02-03 16:36:41+01:00, bzolnier@trik.(none) [ide] fix it8172 build for real Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.5, 2005-02-03 16:35:12+01:00, tj@home-tj.org [ide] cleanup it8172 In drivers/ide/pci/it8172.h, it8172_ratefilter() and init_setup_it8172() are declared and the latter is referenced in it8172_chipsets. Both functions are not defined or used anywhere. This patch removes the prototypes and reference. it8172 should be compilable now. Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.4, 2005-02-03 16:33:36+01:00, tj@home-tj.org [ide] remove adma100 Removes drivers/ide/pci/adma100.[hc]. The driver isn't compilable (missing functions) and no Kconfig actually enables CONFIG_BLK_DEV_ADMA100. On Wed, 02 Feb 2005 03:31:59 -0500, Jeff Garzik wrote: > Also, the libata-dev-2.6 tree has an "ata_adma" driver which is > complete, but needs some testing (and I have h/w). Signed-off-by: Tejun Heo Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.3, 2005-02-03 16:29:50+01:00, bunk@stusta.de [ide] possible cleanups This patch contains the following possible cleanups: - make some needlessly global code static - ide-dma.c: remove the unneeded EXPORT_SYMBOL(__ide_dma_test_irq) slightly changed by me (bart) Signed-off-by: Adrian Bunk Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1992.11.2, 2005-02-03 16:21:14+01:00, arjan@infradead.org [ide] unexport atapi_*_bytes() and ide_read_24() From: Arjan van de Ven * make atapi_{input,output}_bytes() static, fix users to use drive->hwif * remove ide_read_24() export; it's unused since the ide-io.c reorganization * add a FIXME comment to the ide_fix_driveid() export slightly changed by me (bart) Signed-off-by: Bartlomiej Zolnierkiewicz ChangeSet@1.1998.3.12, 2005-02-03 01:42:08-08:00, hkneissel@gmx.de [PATCH] USB: garmin_gps tweak attached is a new patch for the garmin_gps driver. It only updates my email address in the header, as i am in the process of changing my isp and the listed address will be offline sometime soon. The second change makes the configuration entry look more like the other entries in the menu. Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.11, 2005-02-03 01:41:41-08:00, akpm@osdl.org [PATCH] USB: Logitech Cordeless Desktop Keyboard fails to report class descriptor From: Nico Huber The receiver of my Logitech Cordeless Desktop fails to report the keyboard's class descriptor most times I insert the usb-hid module since I changed to linux 2.6. The modell of the receiver is C-BD9-DUAL REV C. The request seems not to fail but the count of received characters is zero. As I said it only fails most times, I worked around making the following changes in drivers/usb/input/hid-core.c from linux-2.6.11-rc2: Following the good example of drivers/usb/core/message.c line 575, I initialized the buffer in hid_get_class_descriptor() to zero. In the loop of hid_get_class_descriptor() not waiting for any result but waiting for a result wich is lower the requested size of the class descriptor (line 1290). usb_hid_configure() should not try to parse the expected length but the received (line 1653). Attached is a patch with these changes Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.10, 2005-02-03 01:41:15-08:00, rddunlap@osdl.org [PATCH] USB: hid-core: possible buffer overflow in hid-core.c Peter Bartosch wrote: > Hello all, > > > i think i found a possible buffer overflow in hid-core (2.6.10-rc2): Agreed, and sorry it took so long to reply/patch this. (from 2004-DEC-01) > when i interpret this code right, the buffer (buf) will overflow when > the iManufacturer stringlength is 0 and the iProduct stringlength > is > 64! Thanks, here's a patch for it. Fix potential buffer overflow (by a device descriptor): buf size is only 64 bytes. Signed-off-by: Randy Dunlap Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.9, 2005-02-03 01:40:48-08:00, krautz@gmail.com [PATCH] TIGLUSB Cleanups 3/3 This removes the TIGLUSB-documentation, silverlink.txt. Signed-off-by: Mikkel Krautz Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.8, 2005-02-03 01:40:20-08:00, krautz@gmail.com [PATCH] TIGLUSB Cleanups 2/3 This removes the TIGLUSB-maintainers from the MAINTAINERS-file. Signed-off-by: Mikkel Krautz Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.7, 2005-02-03 01:39:53-08:00, krautz@gmail.com [PATCH] TIGLUSB Cleanups 1/3 This removes the tiusb boot-parameter from kernel-parameters.txt. Signed-off-by: Mikkel Krautz Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.6, 2005-02-03 01:39:27-08:00, stern@rowland.harvard.edu [PATCH] USB: unusual_devs.h update This patch updates the unusual_devs entry for the SCM multimedia card adapter. Apparently earlier versions of the device included wrong descriptors but later versions did not. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.5, 2005-02-03 01:39:00-08:00, oliver@neukum.org [PATCH] USB: fix for open/disconnect race in acm open takes the semaphore too late. This fixes it. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.4, 2005-02-03 01:38:33-08:00, david-b@pacbell.net [PATCH] USB: another usbnet ax8817x device (goodway docking station) Add support for another AX8817x network device, found in a docking station. T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=02(comm.) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1631 ProdID=6200 Rev= 0.01 S: Manufacturer=goodway corp usb S: Product=gwusb2e S: SerialNumber=01 C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=450mA I: If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=(none) E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=128ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Olaf Hering Signed-off-by: David Brownell Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.3, 2005-02-03 01:38:05-08:00, dwmw2@infradead.org [PATCH] USB: fix libusb endian issues On Wed, 2005-01-19 at 15:39 -0800, John Mock wrote: > New to 2.6.11-rc1 is that 'lsusb' exhibits 'endian' problems on the > PowerMac. Is that really new to 2.6.11-rc1? The kernel byte-swaps the bcdUSB, idVendor, idProduct, and bcdDevice fields in the device descriptor. It should probably swap them back before copying it up to userspace. From: David Woodhouse Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.2, 2005-02-03 01:37:39-08:00, stern@rowland.harvard.edu [PATCH] USB: Fix EHCI boot oops on AMD > > ----- Forwarded message from Andi Kleen ----- > > Someone added an test for AMD 8111 in EHCI, returning > > an error in reset. > > > > When triggered it would cause an NULL pointer oops because > > it would usb_hcd_put an half initialized hcd without > > initialized class. I added a new usb_hcd_free function > > to handle such half baked objects. Andi's diagnosis is correct -- the embedded class_device was not fully initialized -- but the solution is wrong. The correct patch is below. This was clearly my fault, an error in driver-model programming brought on by lack of documentation about which fields in the driver-model structures need to be set for which API calls. (Greg, long ago I sent you a documentation patch to try and help remedy this problem, but it seems to have fallen by the wayside.) Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.3.1, 2005-02-03 01:37:12-08:00, R.E.Wolff@harddisk-recovery.nl [PATCH] Re: Bug when using custom baud rates.... When using custom baud rates, the code does: if ((new_serial.baud_base != priv->baud_base) || (new_serial.baud_base < 9600)) return -EINVAL; Which translates to english as: If you changed the baud-base, OR the new one is invalid, return invalid. but it should be: If you changed the baud-base, OR the new one is invalid, return invalid. From: Rogier Wolff Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.2.6, 2005-02-03 00:42:00-08:00, tlnguyen@snoqualmie.dp.intel.com [PATCH] PCI: change sysfs representation of PCI-E devices Before changes: The patch makes the parent of the device pointing to the pci_dev structure. The parents portX devices are in /sys/devices which should be removed based on your suggestions. Below is /sys/devices before any changes made. /sys/devices | __ ide0 | __ pci0000:00 | __ pnp0 | __ port1 | | | __ port1.00 | | | __ port1.01 | . | . | . | __ port2 | __ port3 | __ system After changes: The parents portX devices are no longer necessary because port1.00 and port1.01 devices shoud have the parent of the pci_dev structure (based on your suggestion). The patch does the following changes: - remove code creating and handling the parent portX devices. - rename portX.YZ to pcieYZ (for example port1.00 renamed to pcie00) since portX is no longer needed. - make pcieYZ have the parent of the pci_dev structure. Below is /sys/devices after changes made to the patch. /sys/devices | __ ide0 | __ pci0000:00 | | | __ 0000:00:00.0 | | | __ 0000:00:04.0 | | | | . __ class | . | | . __ pcie00 | | | __ pcie01 | . | . | . | __ platform | __ pnp0 | __ system Signed-off-by: T. Long Nguyen Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.2.5, 2005-02-03 00:41:32-08:00, greg@kroah.com [PATCH] PCI: add linux-pci mailing list to PCI maintainers entry. Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.2.4, 2005-02-03 00:41:04-08:00, johnrose@austin.ibm.com [PATCH] PCI Hotplug: remove incorrect rpaphp firmware dependency The RPA PCI Hotplug module incorrectly uses a certain firmware property when determining the hotplug capabilities of a slot. Recent firmware changes have demonstrated that this property should not be referenced or depended upon by the OS. This patch removes the dependency, and implements a correct set of logic for determining hotplug capabilities. Signed-off-by: John Rose Signed-off-by: Greg Kroah-Hartman diff -puN drivers/pci/hotplug/rpadlpar_core.c~02_rpadebug drivers/pci/hotplug/rpadlpar_core.c ChangeSet@1.1998.2.3, 2005-02-03 00:40:37-08:00, kay.sievers@vrfy.org [PATCH] PCI: memset rom attribute before using it Initialize the allocated bin_attribute structure, otherwise unused fields are pointing to random places. Signed-off-by: Kay Sievers Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.2.2, 2005-02-03 00:40:09-08:00, brking@us.ibm.com [PATCH] pci: Add Citrine quirk The IBM Citrine chipset has a feature that if PCI config register 0xA0 is read while DMAs are being performed to it, there is the possiblity that the parity will be wrong on the PCI bus, causing a parity error and a master abort. On this chipset, this register is simply a debug register for the chip developers and the registers after it are not defined. Patch sets cfg_size to 0xA0 to prevent this problem from being seen. Signed-off-by: Brian King Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.2.1, 2005-02-03 00:39:41-08:00, akpm@osdl.org [PATCH] PCI: typo in pci_scan_bus_parented From: Olaf Hering printk format string misses a x Signed-off-by: Olaf Hering Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.49, 2005-02-03 00:31:16-08:00, khali@linux-fr.org [PATCH] I2C: Prevent buffer overflow on SMBus block read in Hi Greg, Linus, all, I just hit a buffer overflow while playing around with i2cdump and i2c-viapro through i2c-dev. This is caused by a missing length check on a buffer operation when doing a SMBus block read in the i2c-viapro driver. The problem was already known and had been fixed upon report by Sergey Vlasov back in August 2003 in lm_sensors (2.4 kernel version of the driver) but for some reason it was never ported to the 2.6 kernel version. I am not a security expert but I would guess that such a buffer overflow could possibly be used to run arbitrary code in kernel space from user space through i2c-dev. The severity obviously depends on the permisions set on the i2c device files in /dev. Maybe it wouldn't be a bad idea to push this patch upstream rather sooner than later. While I was at it, I also changed a similar size check (for SMBus block write this time) in the same driver to use the correct constant I2C_SMBUS_BLOCK_MAX instead of its current numerical value. This doesn't change a thing at the moment but prevents another potential buffer overflow in case the value of I2C_SMBUS_BLOCK_MAX were to be changed in the future (admittedly unlikely though). > Now if we have broken hardware, then we might have a problem here, but > otherwise I don't see it as a security issue right now. It doesn't take broken hardware. (Warning: I am going technical at this point, people not interested in the gory details of the I2C and SMBus protocols should better stop here ;)) It just depends on what part of the SMBus and I2C specifications a given client chip supports. SMBus block reads are no different from SMBus byte reads, except that the master (here the VIA Pro) goes on reading after the first byte sent by the slave (which could be about anything, from hardware monitoring chip to EEPROM). In that respect, it also doesn't much differ from the I2C block read, which also starts in the exact same way. The difference between SMBus block read and I2C block read is that the first byte returned by the slave on SMBus block read is supposed to be the remaining number of data byte to be sent, while this is simply the first data byte for I2C block reads. To make it clearer, here comes the detail of the byte read, SMBus block read and I2C block read commands (-> means from master to slave, <- means from slave to master). See the official specifications for I2C and SMBus for nicer graphics and additional details. Byte read: -> client address, write mode -> register address -> client address, read mode <- data byte SMBus block read: -> client address, write mode -> register address -> client address, read mode <- length byte (1 <=3D N <=3D 32) <- first byte <- next byte <- ... <- last (Nth) byte I2C block read: -> client address, write mode -> register address -> client address, read mode <- first byte <- next byte <- ... <- last byte In each case, the *master* decides when to stop the transfer, not the slave. There are two consequences for us here: 1* The client chip cannot differenciate between byte read and SMBus block read until after it sent a first byte - which basically means that a given register address is specified to be read with either command, not both, and not using the correct one returns bogus results. i2c-dev allows arbitrary commands so it is possible to ask for a SMBus block read on a register that expects a simple byte read. The client innocently will answer with the register value - which the master will interpret as a length, and the master will then request that many additional data bytes. If the client features autoincrement in this register address range, it will most likely provide the value of the next registers, if not it will dumbly return the same register value again and again. This illustrates the fact that it doesn't take a broken chip to cause a buffer overflow. It only takes a SMBus block read command on a register for which the client did not expect it (and almost no client actually supports SMBus block reads at the moment). If it happens that the register value was greater than 32, the buffer overflow will occur (without Sergey's fix, that is). So, with write access to the i2c device files, it is actually very easy to trigger the buffer overflow, providing there is at least one chip on the VIA Pro SMBus. 2* A client chip can obviously only implement SMBus block read or I2C block read for a given register address, since the sequence sent by the master is exactly the same. Not a big deal since a client chip is designed either as an I2C slave or as a SMBus slave. However the master doesn't know this, and i2c-dev allows arbitrary commands, so it is possible to use an SMBus block read on an I2C slave which expected instead an I2C block read, causing weird results. EEPROMs are such I2C slaves and they support I2C block reads. Now, imagine that a non-write-protected EEPROM hangs on my VIA Pro SMBus (a memory module SPD EEPROM would probably do), and for some reason i2c-dev gives me access to it. I can write arbitrary bytes to the EEPROM using simple byte writes. I could write the following bytes, in order, at some location: 0x80, 34 null bytes, 94 bytes of nasty code. Then, still through i2c-dev, I request a SMBus block read from the same location. The EEPROM will answer as if it were an I2C block read (it can't differenciate and doesn't support SMBus block reads anyway), i.e. it will return as many bytes as requested, in order. The VIA Pro master will however interpret the first byte (0x80) as a length, and will read 128 bytes from the EEPROM, 34 of which will fill the data buffer, and 94 will overflow. Providing I know how the kernel works, these 94 bytes could be used for doing presumably bad things. This illustrates the fact that the user may actually control the buffer overflow, indirectly, depending on what hardware is present on the bus. EEPROMs are the most obvious way to do it, but some hardware monitoring chips have RAM arrays that could presumably be used in a similar way. As a conclusion, I definitely agree that this buffer overflow isn't easy to exploit, as it takes a particular combination of hardware and non-standard permissions on i2c device files, and also requires very good knowledge of the I2C and SMBus protocols; it is not impossible though. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.48, 2005-02-03 00:30:49-08:00, khali@linux-fr.org [PATCH] I2C: Do not show disabled pc87360 fans The pc87360 driver create sysfs files even for disabled fans. Since data won't ever be updated, it doesn't make much sense. The following patch adds some tests to only create the interface files that are actually needed. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.47, 2005-02-03 00:30:21-08:00, khali@linux-fr.org [PATCH] I2C: Fix i2c-sis5595 pci configuration accesses The i2c-sis5595 bus driver has logic errors on pci configuration accesses. It returns an error on success and vice versa. The 2.4 kernel version of the driver, as found in the lm_sensors CVS repository, is correct, so the problem was introducted when the driver was ported to the 2.6 kernel tree (in 2.6.0-test6). As odd as it sounds, the driver has been sitting here broken and unusable for 17 months and nobody ever reported, until yesterday. Credits go to Sebastian Hesselbarth for discovering and analyzing the problem. Here is a patch that fixes the problem, succesfully tested by Aurelien Jarno and Sebastian Hesselbarth. Please apply. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.46, 2005-02-03 00:29:54-08:00, khali@linux-fr.org [PATCH] I2C: Reduce it87 i2c address range IT87xxF chips were never seen at any other I2C address than the default (0x2d) so I think that we could safely reduce the range of addresses the it87 drivers accepts. Currently it accepts 0x20-0x2f, I believe that 0x28-0x2f would already be more than sufficient. (In theory, any address is possible, so whatever range we choose is arbitrary anyway.) Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.45, 2005-02-03 00:29:27-08:00, khali@linux-fr.org [PATCH] I2C: Use standard temperature converters for as99127f When support for the Asus AS99127F chip was once added to the w83781d driver, it was decided that we would treat temp2 and temp3 as having a LSB of 0.25 degree C, as opposed to 0.5 degree C for the compatible Winbond chips. The reason why this was done seems to be a couple of users reporting that these temperatures were reading twice as high as it should for them in the first place. We had much more feedback about the A99127F chip since, and it turns out that the exact conversion required for temp2 and temp3 depends on the motherboard model. For some models (including my A7V133-C), we now have to multiply the readings by 2, effectively negating the change that was once done in the driver. For other models, a linear conversion formula is needed. The bottom line is that the raw readings from the driver are correct for no known board, while it would be for at least some of them if we had kept the same LSB as the Winbond chips are known to have. Thus I believe that the standard LSB of 0.5 degree C should be restored. There is no datasheet available for the AS99127F chip, so whatever was done was guess work (and still is). I see no reason why we would keep additional code in the w83781d driver to handle this former supposed difference, especially when the facts now tend to prove that this difference doesn't exist. The following patch drops the additional code and treats temp2 and temp3 the same way for all chips supported by the w83781d driver. A similar change will be made to the 2.4 version of this driver, and the default sensors.conf will be updated accordingly. Users will have to update their configuration file, or their readings will of course read twice as high as they should due to the old conversion formulae. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.44, 2005-02-03 00:29:01-08:00, khali@linux-fr.org [PATCH] I2C: Resolve resource conflict between i2c-viapro and via686a Here comes the finalized version of our patch solving the PCI device resource conflict between the i2c-viapro bus driver and and the via686a chip driver. It is based on your original work and the IRC conversation we had yesterday. The retained solution is to not permanently register the PCI device in either driver. This is legitimate since we only need it at init time to retrieve the ISA address of a sub-device (SMBus master or integrated sensors), and possibly change that address on user request. Once this is done we can safely release the PCI device for others to use. I am really glad to see this problem finally solved, as this was the last remaining annoying issue left from the Linux 2.6 migration (missing drivers left apart), and was generating many complaints both at our level and at the distributions' support. Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.43, 2005-02-03 00:28:34-08:00, aurelien@aurel32.net [PATCH] I2C: Fix DS1621 detection Dallas Semiconductors as recently changed the design of their DS1621 chips, including the bits that were checked in the kernel driver to detect it. The patch below fixes the detection by checking an other bit of the configuration register instead. Signed-off-by: Aurelien Jarno Signed-off-by: Greg Kroah-Hartman ChangeSet@1.1998.1.42, 2005-02-02 17:50:58-08:00, torvalds@ppc970.osdl.org Linux 2.6.11-rc3 TAG: v2.6.11-rc3