The purpose of this release is primarily to update the copyright years
in each module, thus causing a huge number of diffs. There are a few
small functional changes, however.
Improved error messages when there is a problem finding one or more of
the required base ACPI tables
Reintroduced the definition of APIC_HEADER in actbl.h
Changed definition of MADT_ADDRESS_OVERRIDE to 64 bits (actbl.h)
Removed extraneous reference to NewObj in dsmthdat.c
Jes Sorensen [Wed, 17 Dec 2003 00:26:43 +0000 (16:26 -0800)]
[PATCH] qla1280 crash fix in error handling
This fixes a bug in the qla1280 driver where it would leave a pointer to
an on the stack completion event in a command structure if
qla1280_mailbox_command fails. The result is that the interrupt handler
later tries to complete() garbage on the stack. The mailbox command can
fail if a device on the bus decides to lock up etc.
Jens Axboe [Wed, 17 Dec 2003 00:12:29 +0000 (16:12 -0800)]
[PATCH] CDROM_SEND_PACKET bug
I just found Yet Another Bug in scsi_ioctl - CDROM_SEND_PACKET puts a
kernel pointer in hdr->cmdp, where sg_io() expects to find user address.
This worked up until recently because of the memcpy bug, but now it
doesn't because we do the proper copy_from_user().
This fix undoes the user copy code from sg_io, and instead makes the
SG_IO ioctl copy it locally. This makes SG_IO and CDROM_SEND_PACKET
agree on the calling convention, and everybody is happy.
I've tested that both
cdrecord -dev=/dev/hdc -inq
and
cdrecord -dev=ATAPI:/dev/hdc -inq
works now. The former will use SG_IO, the latter CDROM_SEND_PACKET (and
incidentally would work in both 2.4 and 2.6, if it wasn't for
CDROM_SEND_PACKET sucking badly in 2.4).
Jens Axboe [Mon, 15 Dec 2003 23:51:55 +0000 (15:51 -0800)]
[PATCH] Fix IDE bus reset and DMA disable when reading blank DVD-R
From Jon Burgess:
There is a problems with blank DVD media using the ide-cd driver.
When we attempt to read the blank disk, the drive responds to the read
request by returning a "blank media" error. The kernel doesn't have
any special case handling for this sense value and retries the request
a couple of times, then gives up and does a bus reset and disables DMA
to the device.
Which obviously doesn't help the situation.
The sense key value of 8 isn't listed in ide-cd.h, but it is listed in
scsi.h as a "BLANK_CHECK" error.
This trivial patch treats this error condition as a reason to abort
the request. This behaviour is the same as what we do with a blank CD-R.
It looks like the same fix might be desired for 2.4 as well, although
is perhaps not so important since scsi-ide is normally used instead.
Len Brown [Mon, 15 Dec 2003 14:47:09 +0000 (09:47 -0500)]
[ACPI] delete old _TRA code formerly used just by IA64. (Bjorn Helgaas)
The current approach is to walk the _CRS in pcibios_scan_root()
using acpi_walk_resources().
Neil Brown [Mon, 15 Dec 2003 08:35:56 +0000 (00:35 -0800)]
[PATCH] Fix possible bio corruption with RAID5
1/ make sure raid5 doesn't try to handle multiple overlaping
requests at the same time as this would confuse things badly.
Currently it justs BUGs if this is attempted.
2/ Fix a possible data-loss-on-write problem. If two or
more bio's that write to the same page are processed at the
same time, only the first was actually commited to storage.
3/ Fix a use-after-free bug. raid5 keeps the bio's it is given
in linked lists when more than one bio touch a single page.
In some cases the tail of this list can be freed, and
the current test for 'are we at the end' isn't reliable.
This patch strengths the test to make it reliable.
Linus Torvalds [Sun, 14 Dec 2003 10:28:27 +0000 (02:28 -0800)]
Fix thread group leader zombie leak
Petr Vandrovec noticed a problem where the thread group leader
would not be properly reaped if the parent of the thread group
was ignoring SIGCHLD, and the thread group leader had exited
before the last sub-thread.
Linus Torvalds [Sat, 13 Dec 2003 13:36:30 +0000 (05:36 -0800)]
More subtle SMP bugs in prepare_to_wait()/finish_wait().
This time we have a SMP memory ordering issue in prepare_to_wait(),
where we really need to make sure that subsequent tests for the
event we are waiting for can not migrate up to before the wait
queue has been set up.
[PATCH] HPFS: missing lock_kernel() in hpfs_readdir()
In 2.5.x, the BKL was pushed from vfs_readdir() into the filesystem
specific functions. But only the unlock_kernel() made it into the HPFS
code, lock_kernel() got lost on the way. This rendered the filesystem
unusable.
This adds the missing lock_kernel(). It's been tested by Timo Maier who
also reported the problem earlier today.
Linus Torvalds [Fri, 12 Dec 2003 06:20:08 +0000 (22:20 -0800)]
Fix subtle bug in "finish_wait()", which can cause kernel stack
corruption on SMP because of another CPU still accessing a waitqueue
even after it was de-allocated.
Use a careful version of the list emptiness check to make sure we
don't de-allocate the stack frame before the waitqueue is all done.
Len Brown [Thu, 11 Dec 2003 18:15:27 +0000 (13:15 -0500)]
[ACPI] Update Linux to ACPICA 20031203 (Bob Moore)
Changed the initialization of Operation Regions during subsystem init to
perform two entire walks of the ACPI namespace; The first to initialize
the regions themselves, the second to execute the _REG methods. This
fixed some interdependencies across _REG methods found on some machines.
Fixed a problem where a Store(Local0, Local1) could simply update the
object reference count, and not create a new copy of the object if the
Local1 is uninitialized.
Implemented support for the _SST reserved method during sleep
transitions.
Implemented support to clear the SLP_TYP and SLP_EN bits when waking up,
this is apparently required by some machines.
When sleeping, clear the wake status only if SleepState is not S5.
Fixed a problem in AcpiRsExtendedIrqResource() where an incorrect
pointer arithmetic advanced a string pointer too far.
Fixed a problem in AcpiTbGetTablePtr() where a garbage pointer could be
returned if the requested table has not been loaded.
Within the support for IRQ resources, restructured the handling of the
active and edge/level bits.
Fixed a few problems in AcpiPsxExecute() where memory could be leaked
under certain error conditions.
Improved error messages for the cases where the ACPI mode could not be
entered.
Len Brown [Thu, 11 Dec 2003 17:48:32 +0000 (12:48 -0500)]
[ACPI] update Linux to ACPICA 20031029 (Bob Moore)
Fixed a problem where a level-triggered GPE with an associated _Lxx
control method was incorrectly cleared twice.
Fixed a problem with the Field support code where an access can occur
beyond the end-of-region if the field is non-aligned but extends to the
very end of the parent region (resulted in an AE_AML_REGION_LIMIT
exception.)
Fixed a problem with ACPI Fixed Events where an RT Clock handler would
not get invoked on an RTC event. The RTC event bitmasks for the PM1
registers were not being initialized properly.
Implemented support for executing _STA and _INI methods for Processor
objects. Although this is currently not part of the ACPI specification,
there is existing ASL code that depends on the init-time execution of
these methods.
Implemented and deployed a GetDescriptorName function to decode the
various types of internal descriptors. Guards against null descriptors
during debug output also.
Implemented and deployed a GetNodeName function to extract the
4-character namespace node name. This function simplifies the debug and
error output, as well as guarding against null pointers during output.
Implemented and deployed the ACPI_FORMAT_UINT64 helper macro to simplify
the debug and error output of 64-bit integers. This macro replaces the
HIDWORD and LODWORD macros for dumping these integers.
Updated the implementation of the Stall() operator to only call
AcpiOsStall(), and also return an error if the operand is larger than
255. This preserves the required behavior of not relinquishing the
processor, as would happen if AcpiOsSleep() was called for "long
stalls".
Constructs of the form "Store(LocalX,LocalX)" where LocalX is not
initialized are now treated as NOOPs.
Cleaned up a handful of warnings during 64-bit generation.
Fixed a reported error where and incorrect GPE number was passed to the
GPE dispatch handler. This value is only used for error output,
however. Used this opportunity to clean up and streamline the GPE
dispatch code.
Herbert Xu [Tue, 9 Dec 2003 09:40:44 +0000 (01:40 -0800)]
[PATCH] USB: Fix connect/disconnect race
This patch was integrated by you in 2.4 six months ago. Unfortunately
it never got into 2.5. Without it you can end up with crashes such
as http://bugs.debian.org/218670
Tom Rini [Tue, 9 Dec 2003 01:42:34 +0000 (17:42 -0800)]
[PATCH] USB: mark the scanner driver as obsolete
On Mon, Dec 01, 2003 at 11:21:58AM -0800, Greg KH wrote:
> Can't you use xsane without the scanner kernel driver? I thought the
> latest versions used libusb/usbfs to talk directly to the hardware.
> Because of this, the USB scanner driver is marked to be removed from the
> kernel sometime in the near future.
After a bit of mucking around (and possibly finding a bug with debian's
libusb/xsane/hotplug interaction, nothing seems to run
/etc/hotplug/usb/libusbscanner and thus only root can scan, anyone whose
got this working please let me know), the problem does not exist if I
only use libusb xsane.
Matthew Dharm [Tue, 9 Dec 2003 01:35:37 +0000 (17:35 -0800)]
[PATCH] USB storage: fix for jumpshot and datafab devices
This patch fixes some obvious errors in the jumpshot and datafab drivers.
This should close out Bugzilla bug #1408
> Date: Mon, 1 Dec 2003 12:14:53 -0500 (EST)
> From: Alan Stern <stern@rowland.harvard.edu>
> Subject: Patch from Eduard Hasenleithner
> To: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
> cc: USB Storage List <usb-storage@one-eyed-alien.net>
>
> Matt:
>
> Did you see this patch? It was posted to the usb-development mailing list
> about a week ago, before I started making all my changes. It is clearly
> correct and necessary.
>
> Alan Stern
Jens Axboe [Tue, 9 Dec 2003 01:03:05 +0000 (17:03 -0800)]
[PATCH] scsi_ioctl memcpy'ing user address
James reported a bug in scsi_ioctl.c where it mem copies a user pointer
instead of using copy_from_user(). I inadvertently introduced this one
when getting rid of CDROM_SEND_PACKET. Here's a trivial patch to fix it.
David Brownell [Mon, 8 Dec 2003 05:28:46 +0000 (21:28 -0800)]
[PATCH] USB: fix remove device after set_configuration
If a device can't be configured, the current test9 code forgets
to clean it out of sysfs. This resolves that issue, so the retry
in usb_new_device() stands a chance of working.
The enumeration code still doesn't handle such errors well, but
at least this way that hub port can be used for another device.
James McMechan [Sun, 7 Dec 2003 13:57:40 +0000 (05:57 -0800)]
[PATCH] tmpfs oops fix
The problem was that the cursor was in the list being walked, and when
the pointer pointed to the cursor the list_del/list_add_tail pair would
oops trying to find the entry pointed to by the prev pointer of the
deleted cursor element.
The solution I found was to move the list_del earlier, before the
beginning of the list walk. since it is not used during the list walk and
should not count in the list enumeration it can be deleted, then the
list pointer cannot point to it so it can be added safely with the
list_add_tail without oopsing, and everything works as expected.
I am unable to oops this version with any of my test programs.
Jeff Garzik [Fri, 5 Dec 2003 15:34:00 +0000 (07:34 -0800)]
[PATCH] fix oops on unload in pcnet32
The driver was calling pci_unregister_driver for each _device_, and then
again at the end of the module unload routine. Remove the call that's
inside the loop, pci_unregister_driver should only be called once.
Ulrich Drepper [Thu, 4 Dec 2003 14:26:06 +0000 (06:26 -0800)]
[PATCH] Fix 'noexec' behaviour
We should not allow mmap() with PROT_EXEC on mounts marked "noexec",
since otherwise there is no way for user-supplied executable loaders
(like ld.so and emulator environments) to properly honour the
"noexec"ness of the target.
Jean Delvare [Thu, 4 Dec 2003 06:14:33 +0000 (22:14 -0800)]
[PATCH] I2C: fix i2c_smbus_write_byte() for i2c-nforce2
This patch fixes i2c_smbus_write_byte() being broken for i2c-nforce2.
This causes trouble when that module is used together with eeprom (which
is also in 2.6). We have had three user reports about the problem.
Credits go to Mark D. Studebaker for finding and fixing the problem.
Jens Axboe [Wed, 3 Dec 2003 23:53:31 +0000 (15:53 -0800)]
[PATCH] fix broken x86_64 rdtscll
The scheduler is completed b0rked on x86_64, and I finally found out
why. sched_clock() always returned 0, because rdtscll() always returned
0. The 'a' in the macro doesn't agree with the 'a' in the function,
yippe :-)
Ingo Molnar [Wed, 3 Dec 2003 04:59:12 +0000 (20:59 -0800)]
[PATCH] Fix /proc access to dead thread group list oops
The pid_alive() check within the loop is incorrect. If we are within
the tasklist lock and the thread group leader is valid then the thread
chain will be fully intact.
Instead, the check should be _outside_ the loop, since if the group
leader no longer exists, the whole list is gone and we must not try
to access it.
Hirofumi Ogawa [Mon, 1 Dec 2003 02:40:47 +0000 (18:40 -0800)]
[PATCH] Missing initialization of /proc/net/tcp seq_file
We need to initialize st->state in tcp_seq_start(). Otherwise
tcp_seq_stop() is run with previous st->state, and it calls the unneeded
unlock etc, causing a kernel crash.
Ben Collins [Wed, 26 Nov 2003 04:15:46 +0000 (20:15 -0800)]
[PATCH] Lastminute IEEE-1394 fixes
I've got a lot more changes than what's included here. I've put this
down to the bear minimum to get things working sanely.
Mainly, I just want to get all the people hit by this a chance to use
2.6.0 without having to get our tree. Changes itemized:
- Fix deadlock possibility in csr.c:read_maps()
- Fix kmalloc to use ATOMIC in highlevel.c.
- s/in_interrupt/irqs_disabled/ in ieee1394_transactions.c to fix
warnings when transactions occured.
- Introduce a release callback for the host driver and use it correctly.
- Reorganize the nodemgr probe so we do an initial scan to discover
devices, check IRM/CycleMaster, then do a final full probe when things
are kosher. Fixes a problem where device registration and hotplug
would cause some serious problems when a bus reset was forced in the
middle of the probe.
[PATCH] prevent oops from read of proc entry for tty drivers
There are /proc handles there setup by proc_tty_register_driver, but there is
no module ownership association, so anything that reads after module unload
will blow.
The trivial fix is to propagate the owner of tty_driver to proc entry.
David S. Miller [Mon, 24 Nov 2003 11:44:51 +0000 (03:44 -0800)]
[NET]: In sock_queue_rcv_skb(), do not deref skb->len after it is queued to the socket.
In implementations that use no socket locking, such as RAW sockets,
once we queue the SKB to the socket another cpu can remove the SKB
from the socket queue and free up the SKB making the skb->len access
touch freed memory.
Based upon a report from Burton Windle, kernel bugzilla #937
James Bottomley [Mon, 24 Nov 2003 04:02:15 +0000 (22:02 -0600)]
Fix locking problems in scsi_report_bus_reset() causing aic7xxx to hang
All the users of this function in the SCSI tree call it with the host
lock held. With the new list traversal code, it was trying to take
the lock again to traverse the list.
Fix it to use the unlocked version of list traversal and modify the
header comments to make it clear that the lock is expected to be held
on calling it.
projects / linux / log