Andrew Morton [Thu, 14 Aug 2003 17:23:22 +0000 (10:23 -0700)]
[PATCH] ipmi_kcs_intf.c compile warning
From: Zwane Mwaikambo <zwane@linuxpower.ca>
drivers/char/ipmi/ipmi_kcs_intf.c: In function `acpi_find_bmc':
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)
Andrew Morton [Thu, 14 Aug 2003 17:23:06 +0000 (10:23 -0700)]
[PATCH] keyboard.c warning fix
drivers/char/keyboard.c: In function `k_fn':
drivers/char/keyboard.c:665: warning: comparison is always true due
to limited range of data type
I didn't want to just delete the code because one day the size of func_table
may get smaller, or the type of `value' may get larger. When that happens,
the test becomes valid again.
Andrew Morton [Thu, 14 Aug 2003 17:22:44 +0000 (10:22 -0700)]
[PATCH] request_firmware fix
From: Manuel Estrada Sainz <ranty@debian.org>
- undo recent change, made in the believe that "buffer" was the size of
the whole file, it is just PAGE_SIZE in size. This was causing kernel
memory corruption.
- Since files are allowed to have unknown sizes, by setting their
size to 0, we can't preallocate a buffer of their size on open.
- Adapt request_firmware() to the sysfs change.
- Adapt drivers/pci/pci-sysfs.c to the sysfs change.
Andrew Morton [Thu, 14 Aug 2003 17:22:37 +0000 (10:22 -0700)]
[PATCH] loop oops fix
loop-on-file oopses during unmount. This is because lo_queue is now freed
during lo_ioctl(LOOP_CLR_FD). I think the scenario is:
1: umount(8) opens /dev/loop0
2: umount(8) runs lo_ioctl(LOOP_CLR_FD) (this frees the queue)
3: umount(8) closes the /dev/loop0 handle. The blockdev layer syncs the
blockdev, but its mapping->backing_dev_info now points into la-la-land.
We shouldn't be freeing the queue until all refs to it have gone away. This
patch gives the queue the same lifetime as the controlling loop_device
itself. It also makes the loop driver's queue appear in sysfs again.
It would be better to free the queue when the device is not in use, but I'm
not sure how we can hook into the blockdev layer to do that.
Andrew Morton [Thu, 14 Aug 2003 17:22:18 +0000 (10:22 -0700)]
[PATCH] fix hugetlbfs slab corruption on umount
From: Zwane Mwaikambo <zwane@linuxpower.ca>
hugetlbfs was accessing super_block->s_fs_info after free'ing it. This was
because it was being free'd prematurely. I have deferred free until
->put_super(). I have also removed hugetlbfs_kill_super since it now is
simply a kill_litter_super.
Andrew Morton [Thu, 14 Aug 2003 17:21:45 +0000 (10:21 -0700)]
[PATCH] Make MTRR init conform with recommended procedure
From: Zwane Mwaikambo <zwane@linuxpower.ca>
This is a patch to make the MTRR initialisation more conformant with what
is stated in volume 3 of (10-36 Memory Cache Control). The most notable
change is entering the no-fill cache mode before clearing the PGE bit in
cr4. Intel also states that we should do the cache flush via the cr3
register shuffle. If there is a problem with the patch please don't
hesitate to beat me vigorously with a clue-by-four.
It has been tested on a 3x Pentium 133, 8x PIII Xeon 700, 1x Celeron 550 and 32x
PIII 500 NUMAQ (hardware courtesy of OSDL)
Andrew Morton [Thu, 14 Aug 2003 17:21:10 +0000 (10:21 -0700)]
[PATCH] _devfs_walk_path fix
From: Andrey Borzenkov <arvidjaar@mail.ru>
_devfs_walk_path does not check if de it is about to scan is a directory.
Next step is spinlock on non-spinlock memory. It requires either artificial
setup or really broken driver but fairly easy to reproduce once you know how.
Andrew Morton [Thu, 14 Aug 2003 17:18:53 +0000 (10:18 -0700)]
[PATCH] BUG fix for drivers/bluetooth/hci_usb.c
From: Vinay K Nallamothu <vinay-rc@naturesoft.net>
The patch below fixes two pointer reference bugs (shows up as compile
time warnings given below) which wrongly take the address of "struct
usb_interface*".
drivers/bluetooth/hci_usb.c: In function `hci_usb_probe':
drivers/bluetooth/hci_usb.c:786: warning: assignment from incompatible pointer type
drivers/bluetooth/hci_usb.c:810: warning: assignment from incompatible pointer type
Andrew Morton [Thu, 14 Aug 2003 17:18:13 +0000 (10:18 -0700)]
[PATCH] fix ide-scsi for ide_drive_t->queue change
From: Mikael Pettersson <mikpe@csd.uu.se>
This patch fixes ide-scsi.c for the ide_drive_t->queue type change
in 2.6.0-test3.
Without the patch you'll get these new warnings in -test3:
drivers/scsi/ide-scsi.c: In function `idescsi_abort':
drivers/scsi/ide-scsi.c:875: warning: passing arg 1 of `elv_queue_empty' from incompatible pointer type
drivers/scsi/ide-scsi.c: In function `idescsi_reset':
drivers/scsi/ide-scsi.c:902: warning: passing arg 1 of `elv_next_request' from incompatible pointer type
Andrew Morton [Thu, 14 Aug 2003 17:17:34 +0000 (10:17 -0700)]
[PATCH] probe UDF after reiserfs
Bug 1065 (http://bugme.osdl.org/show_bug.cgi?id=1065) points out that there
is a risk that UDF will accidentally mount a reiserfs partition, which would
prevent a successful boot.
Andries points out that probing is unreliable and that users/admins should
always specify the root filesystem type on the kernel boot command line with
"rootfstype=resierfs".
But nobody does that, so we should be trying reiserfs before UDF.
Andrew Morton [Thu, 14 Aug 2003 17:16:41 +0000 (10:16 -0700)]
[PATCH] fix task struct refcount bug
From: Manfred Spraul <manfred@colorfullife.com>
(We think this might be the mystery bug which has been hanging about for
months)
We found a [the?] task struct refcount error: A task that dies sets
tsk->state to TASK_ZOMBIE. The next scheduled task checks prev->state, and
if it's ZOMBIE, then it decrements the reference count of prev. The
prev->state & _ZOMBIE test is not atomic with schedule, thus if prev is
scheduled again and dies between dropping the runqueue lock and checking
prev->state, then the reference it dropped twice.
This is possible with either preemption [schedule_tail is called by
ret_from_fork with preemption count 1, finish_arch_switch drops it to 0] or
profiling [profile_exit_mmap can sleep on profile_rwsem, called by
mmdrop()] enabled.
Here's the updated patch to fix several race conditions in nbd. It
requires reverting the already included (but incomplete)
nbd-race-fix.patch that's in -mm5.
This patch fixes the following race conditions:
1) adds an increment of req->ref_count to eliminate races between
do_nbd_request and nbd_end_request, which resulted in the freeing of
in-use requests -- there were races between send/receive, send/shutdown
(killall -9 nbd-client), and send/disconnect (nbd-client -d), which are
now all fixed
2) adds locking and properly orders the code in NBD_CLEAR_SOCK to
eliminate races with other code
3) adds an lo->sock check to nbd_clear_que to eliminate races between
do_nbd_request and nbd_clear_que, which resulted in the dequeuing of
active requests
4) adds an lo->sock check to NBD_DO_IT to eliminate races with
NBD_CLEAR_SOCK, which caused an Oops when "nbd-client -d" was called
Andrew Morton [Thu, 14 Aug 2003 17:11:42 +0000 (10:11 -0700)]
[PATCH] reiserfs: Fix handling of some extended inode
From: Oleg Drokin <green@namesys.com>
This patch fixes a problem in reiserfs' handling of immutable attribute,
where every user (not just root) can unset it. Also it adds "append-only"
attribute "support" (all the support is in VFS anyway, we only recognise the
bit now). Also misleading comment in reiserfs_fs.h is removed.
Andrew Morton [Thu, 14 Aug 2003 17:10:37 +0000 (10:10 -0700)]
[PATCH] reiserfs: remove unneeded kunmap
From: Oleg Drokin <green@namesys.com>
There is a leftover kunmap in reiserfs_unprepare_pages() which was not
deleted after conversion to kmap_atomic. This path is virtually never
executed, that's why it was not caught earlier. Please apply.
Andrew Morton [Thu, 14 Aug 2003 17:07:26 +0000 (10:07 -0700)]
[PATCH] AS: remove hash valid stuff
From: Nick Piggin <piggin@cyberone.com.au>
The crazy HASH_VALID stuff now makes no difference now. It was there to
try to enforce no merging over a barrier, but it turned out that requests
can just be reordered. Jens picked this up a a while ago and fixed
deadline (and I AS) by simply dispatching all reqs on the queue on
encountering a barrier. The hash valid stuff didn't get cleaned up.
Andrew Morton [Thu, 14 Aug 2003 17:07:00 +0000 (10:07 -0700)]
[PATCH] timer race fixes
From: Ingo Molnar <mingo@elte.hu>
It unifies the functionality of add_timer() and mod_timer(), and makes any
combination of the timer API calls completely SMP-safe. del_timer() is still
not using the timer lock.
this patch fixes the only timer bug in 2.6 i'm aware of: the del_timer_sync()
+ add_timer() combination in kernel/itimer.c is buggy. This was correct code
in 2.4, because there it was safe to do an add_timer() from the timer handler
itself, parallel to a del_timer_sync().
If we want to make this safe in 2.6 too (which i think we want to) then we
have to make add_timer() almost equivalent to mod_timer(), locking-wise. And
once we are at this point i think it's much cleaner to actually make
add_timer() a variant of mod_timer(). (There's no locking cost for
add_timer(), only the cost of an extra branch. And we've removed another
commonly used function from the icache.)
Andrew Morton [Thu, 14 Aug 2003 17:06:03 +0000 (10:06 -0700)]
[PATCH] sys_fadvise64_64
Alas, both POSIX and I got the fadvise() interface wrong. It needs to take a
64-bit length, not a 32-bit one. Because fadvise(POSIX_FADV_DONTNEED) on a
4TB file will require 1000 syscalls. Silly.
There are glibc's in the wild which use the existing syscall, so we must
make a new one.
Linus Torvalds [Thu, 14 Aug 2003 05:58:18 +0000 (22:58 -0700)]
DRI CVS update: bump i810 driver to 1.4.
This fixes the DMA interface to be backwards compatible with older
XFree86 versions, by looking at the I810_INIT_DMA parameters and
figuring out old version semantics.
Linus Torvalds [Thu, 14 Aug 2003 04:11:39 +0000 (21:11 -0700)]
Mark CLONE_DETACHED as being irrelevant: it must match CLONE_THREAD.
CLONE_THREAD without CLONE_DETACHED will now return -EINVAL, and
for a while we will warn about anything that uses it (there are no
known users, but this will help pinpoint any problems if somebody
used to care about the invalid combination).
A part of the 64 bit kdev_t patch already got merged, and it changes the
format of /sys/block/<dev>/dev from %02x%02x to %u:%u. The partition
could must also be changed.
e.g. cat /sys/block/hda/hda5/dev should return 3:5 instead of 0305
Russell King [Thu, 14 Aug 2003 02:21:40 +0000 (19:21 -0700)]
[PATCH] Make modules work on ARM
This patch allows modules to work for ARM, and is the one thing which
prevents the standard tree from building for any ARM machine.
After reviewing the /proc/kcore and kclist issues, I've decided that I'm
no longer prepared to even _think_ about supporting /proc/kcore on ARM -
it just gets too ugly, and adds too much code to make it worth the effort,
the time or the energy to implement a solution to that problem.
/proc/kcore should probably go away, but in the meantime this just allows
ARM to ignore the issues.
- kill redundant, never executed code in lba_capacity_is_ok()
- add idedisk_supports_{hpa,lba48}() helpers
- don't recalculate drive->cyl for drives using LBA addressing,
we never fall-back to CHS, so its useless and confusing
- remove wrong drive->head and drive->sect assignments for LBA-48
- don't overwrite id->lba_capacity and id->lba_capacity_2
HDIO_GETGEO_BIG_RAW is an ide specific hack introduced in 2.3.99-pre3.
There are no known programs using this ioctl.
Its aim was to provide current CHS translation to the user-space,
but very often it provides what driver thinks is a current translation
(drive with LBA have to support only one physical translation, also
drive may not support chosen translation and there is no return value check).
hdparm -I can be used instead, it provides correct information
(and bogus data is still accessible through /proc/ide/hdX/geometry).
Nathan Scott [Thu, 14 Aug 2003 03:45:48 +0000 (22:45 -0500)]
[XFS] Fix a race condition in async pagebuf IO completion,
by moving blk queue manipulation down into pagebuf.
Fix some busted comments in page_buf.h, use a more
descriptive name for __pagebuf_iorequest.
Michael Plump [Thu, 14 Aug 2003 01:56:53 +0000 (18:56 -0700)]
[PATCH] Correct DEVPTS config help
The help for CONFIG_DEVPTS_FS claims that devfs "is a more general
facility". But that apparently hasn't been true since 2.5.68. This patch
removes that claim, and adds a warning to the DEVFS_FS help.
Corey Minyard [Wed, 13 Aug 2003 16:47:17 +0000 (09:47 -0700)]
[PATCH] IPMI updates for 2.6.0-test3
Here are some minor updates to the IPMI driver. They fix the following:
* A missing check for copy_to_user() in the watchdog driver.
* Removal of unnecessary check_region() calls.
* Fixes for the ACPI configuration. The previous one would only work
with memory addresses, this will work with memory addresses,
ports, and hadle checking that the type is correct.
Neil Brown [Wed, 13 Aug 2003 16:38:25 +0000 (09:38 -0700)]
[PATCH] Fix bug in sunrpc/server code.
When a socket has a request ready it notifies a server thread.
When the thread has 'received' the request it calls svc_sock_received
to confirm the fact.
In some cases, svc_sock_received would be called an extra time and
this could lead to linked-list corruption and bad problems.
Andi Kleen [Wed, 13 Aug 2003 16:38:10 +0000 (09:38 -0700)]
[PATCH] x86-64 merge for 2.6.0test3
Without these changes an x86-64 NUMA kernel won't boot in many
configurations.
The main change is the improved IOMMU code which supports merging of
mappings and has various bugfixes.
- Update defconfig
- Use argument ptregs in 32bit elf_core_copy_task_fpregs
- Harden aperture fixup code: read aperture from the AGP bridge if needed,
better error checking.
- Support nmi_watchdog=panic to panic on watchdog trigger
- IOMMU: Support panic on IOMMU overflow (iommu=panic)
- IOMMU: Force SAC for mappings >40bits when iommu=force is active
(this can potentially give better performance)
- IOMMU: Cache northbridges for faster TLB flush
- IOMMU: Fix SMP race in TLB flush
- IOMMU: Merge pci_alloc_consistent and pci_map_single
- IOMMU: Clean up leak tracing
- IOMMU: Rewrite pci_map_sg, support merging of mappings
On overflow fall back to piece-by-piece mapping.
- IOMMU: Tell block layer to assume merging when iommu force is active
(this gives better performance with MTP fusion, drawback is that the
overflow/fragmentation handling of the IOMMU area is still a big
dubious with that)
- Fix/clean up per cpu data
- Add 64bit clean time(2)
- Export cpu_callout_map for IPv6
- Handle nodes with no own memory in NUMA discovery.
This fixes boot on various newer Opteron motherboards where the memory
is only connected to a single CPU.
- Fix fallback path for failed NUMA discovery. numnodes has to be reset.
- Check for enabled nodes in NUMA discovery (Eric Biederman)
- Remove NUMA emunodes support. Has badly bitrotted.
- Add __clear_bit_string for IOMMU code
- Add new 32bit system calls to ia32_unistd.h
- Remove duplicate default_do_nmi prototype
- Make PCI_DMA_BUS_IS_PHYS dependent on no_iommu
- Fix padding length of siginfo_t to match glibc
- More pci direct access functions.
Muli Ben-Yehuda [Wed, 13 Aug 2003 16:37:54 +0000 (09:37 -0700)]
[PATCH] fix trident.c lockup on module load 2.6.0-test2
This patch fixes a kernel lockup with 2.6.0-test2 when the trident.c
OSS driver is loaded and the driver attempts to initialize the
card. The problem is that in ali_ac97_get() we lock the card->lock
spinlock, but never release it on the good path, only on the error
path. This patch adds the missing spin_unlock_irqrestore().
This bug snuck in in a 2.4 sync from Alan, and 2.4 appears to suffer
from the same problem. A patch for that will be send to Marcelo
momentarily.
Jamie Lokier [Wed, 13 Aug 2003 16:37:46 +0000 (09:37 -0700)]
[PATCH] Fix protocol bugs with NFS and nanoseconds
NFS with 2.5.75 as both client and server is broken with GNU Make.
The nanosecond field of timestamps of newly touched files is often
negative on the client, which is probably why Make fails. The value
also bears no relation to the file's nanosecond field on the server.
The culprit is htons() used where htonl() should be:
The rest of this patch corrects nfsd to use microseconds in NFSv2, not
nanoseconds. (The client already gets this right, but I have
optimised it slightly to avoid division when possible).
Matt Wilson [Wed, 13 Aug 2003 16:37:38 +0000 (09:37 -0700)]
[PATCH] zap_other_threads() detaches thread group leader
The change to detach the threads in zap_other_threads() broke the case
where the non-thread-group-leader is the cause of de_thread().
In this case the group leader will be detached and freed before
switch_exec_pids() is complete and invalid data will be used. This is a
patch that makes sure that the group leader does not get detached and
reaped.
This disables the local APIC before reboot. This fixes BIOS reboot
problems reported by a few people.
disable_local_APIC() now checks if detect_init_APIC() enabled the
local APIC via the APIC_BASE MSR, and if so it now disables APIC_BASE.
Previously we would leave APIC_BASE enabled, and that made some
BIOSen unhappy.
The SMP reboot code calls disable_local_APIC(). On SMP HW there is
no change since detect_init_APIC() isn't called and APIC_BASE isn't
enabled by us. An SMP kernel on UP HW behaves just like an UP_APIC
kernel, so it disables APIC_BASE if we enabled it at boot.
The UP_APIC disable-before-suspend code is simplified since the existing
code to disable APIC_BASE is moved into disable_local_APIC().
(Felix Kühling originally reported the BIOS reboot problem. This is a
fixed-up version of his preliminary patch.)