Andrew Morton [Sat, 22 Mar 2003 15:35:06 +0000 (07:35 -0800)]
[PATCH] ext3: fix use-after-free bug
ext3_writepage() calls ext3_journal_stop(), which dereferences the affected
inode.
It does this _after_ writing the page out, which is illegal. The IO can
complete, the page can be repeased from the inode and the inode can be freed
up.
It's a long-standing bug. It has been reported happening on preemptible
kernels, where the timing window is larger.
Fix that up by teaching ext3_journal_stop to locate the superblock via the
journal structure, not via the inode.
This means that ext3_journal_stop() does not need the inode argument at all.
Also uninline the affected functions. It saves 5.5 kbytes.
Also remove the setting of sb->s_dirt in ext3_journal_stop(). That was an
awkward way of telling sys_sync() that the filesystem needs a commit, and
with the ext3_sync_fs() that is no longer needed.
Andrew Morton [Sat, 22 Mar 2003 15:34:59 +0000 (07:34 -0800)]
[PATCH] pagecache accounting speedup
From: Alex Tomas <bzzz@tmi.comex.ru>
This is the second half of the vm_enough_memory() speedup.
When overcommit_memory != 1, vm_enough_memory() calls get_page_state() to
calculate the amount of used pagecache. It does this on every call to
sys_brk().
get_page_state() is really expensive on SMP.
So the patch arranges for pagecache accounting to be in a global atomic_t,
with per-cpu batching and approximate accounting to amortise the cost of the
global atomic.
The nr_pagecache field of /proc/vmstat is removed.
Andrew Morton [Sat, 22 Mar 2003 15:34:50 +0000 (07:34 -0800)]
[PATCH] simplify the timer lockup avoidance code
From: george anzinger <george@mvista.com>
The recently-added code which avoids a lockup when a timer handler re-adds
the timer right now can be simplified.
If we change __run_timers() to increment base->timer_jiffies _before_ running
the timers, then any re-additions will not be inserted in the list which
__run_timers is presently walking.
Andrew Morton [Sat, 22 Mar 2003 15:34:35 +0000 (07:34 -0800)]
[PATCH] dev_t [3/3]: major.h cleanups
Patch from Andries.Brouwer@cwi.nl
The third patch removes the last occurrences of MAX_BLKDEV and MAX_CHRDEV and
sorts the majors in major.h. It also updates the definition of
SCSI_DISK_MAJOR.
so that the old register_chrdev registers a single major and 256 minors.
Later this can be changed (but see my letter to Al last week).
The only driver that is tricky is the tty driver. Here some major cleanup
happened - all tty specific stuff disappeared from char_dev.c, and tty uses
the actual register_chrdev_region() call.
There is a race in register_chrdev_region() that I did not worry about: when
two dynamic majors 0 are registered simultaneously, one of them will be first
and the other one gets -EBUSY. If this is a problem, the code there will
have to be uglified a little. I didn't do that because it disappears again
in a subsequent patch.
Andrew Morton [Sat, 22 Mar 2003 15:34:20 +0000 (07:34 -0800)]
[PATCH] dev_t [1/3]: kill cdev
Patch from Andries.Brouwer@cwi.nl
Now that 2.5.65 is out, the next dev_t patch. It was a bit large and
unreadable, so I split it into three clean pieces. Afterwards, since many
people ask for this, a fourth patch that actually changes the type of dev_t
(not to be applied yet, that is just for playing).
The first patch is the cdev-kill patch that I sent out earlier. It is no use
having two forms of chardev registration in the source, and my version of the
path of small modifications does not pass through this version, although the
final result will not be that different. So, kill cdev_cachep,
cdev_cache_init, cdfind, cdget, cdput, inode->i_cdev, struct char_device.
All of this is dead code today.
Andrew Morton [Sat, 22 Mar 2003 15:34:13 +0000 (07:34 -0800)]
[PATCH] mwave oops fixes
The mwave driver oopses if you do not have the hardware installed. It is
running device_unregister() and device_remove_file() against things whch were
never created.
Andrew Morton [Sat, 22 Mar 2003 15:33:43 +0000 (07:33 -0800)]
[PATCH] remove lock_kernel() from readdir implementations.
Filesystems which are using generic_file_llseek() do not need lock_kernel()
in their readir implementations. All operations (including llseek) are
serialised by the directory's i_sem.
Just fix ext2 and ext3 for now. Others may need locking between readdir and
who-knows-what.
Andrew Morton [Sat, 22 Mar 2003 15:33:34 +0000 (07:33 -0800)]
[PATCH] speed up vm_enough_memory()
This function is called a lot. Every brk(). The atomic_add() against a
global counter hurts on large SMP machines.
The patch simply reduces the rate at which that atomic operation is
performed, by accumulating a per-cpu count which is spilled into the global
counter when the local counter overflows.
It trades off efficiency for a little inaccuracy.
I tried various implementations involving kmalloc_percpu() and open-coded
per-cpu arrays in a generic "per-cpu counter" thing. They all were
surprisingly sucky - the additional cache misses involved in walking the more
complex data structures really showed up.
Andrew Morton [Sat, 22 Mar 2003 15:33:13 +0000 (07:33 -0800)]
[PATCH] inode a/c/mtime modification speedup
For some filesystems (ext3, reiserfs at least), ->dirty_inode() is very
expensive. The kernel is currently calling mark_inode_dirty() at up to 1000
times/sec/inode. But there is no need to do this if the filesystem cannot
store high-resolution times on-disk.
This patch restores the optimisation of only dirtying the filesystem inode
when its on-disk representation has actually changed.
The filesystem will set the MS_ONE_SECOND flag in sb->s_flags to indicate
that it wishes to receive this treatment.
The patch does reduce the call rate to ext3_mark_inode_dirty() from 1000/sec
to 1/sec, but it doesn't make much difference at all to performance because
we're calling ext3_mark_inode_dirty() from other callsites as well. Those
can be optimised too.
Andrew Morton [Sat, 22 Mar 2003 15:32:49 +0000 (07:32 -0800)]
[PATCH] filemap_populate speedup
filemap_populate() is currently doing page-at-a-time synchronous I/O. Add a
call to do_page_cache_readahead() in there so we do a big slurp of IO first.
This is minimal - a lot of the filemap_populate() code can be
rationalised yet.
the attached patch, against BK-curr, is a preparation to make
remap_file_pages() usable on swappable vmas as well. When 'swapping out'
shared-named mappings the page offset is written into the pte.
it takes one bit from the swap-type bits, otherwise it does not change the
pte layout - so it should be easy to adapt any other architecture to this
change as well. (this patch does not introduce the protection-bits-in-pte
approach used in my previous patch.)
On 32-bit pte sizes with an effective usable pte range of 29 bits, this
limits mmap()-able file size to 4096 * 2^29 == 2 TBs. If the usable range is
smaller, then the maximum mmap() size is reduced as well. The worst-case i
found (PPC) was 2 hw-reserved bits in the swap-case, which limits us to 1 TB
filesize. Is there any other hw that has an even worse ratio of sw-usable
pte bits?
this mmap() limit can be eliminated by simply not converting the swapped out
pte to a file-pte, but clearning it and falling back to the linear mapping
upon swapin. This puts the limit into remap_file_pages() alone, but i really
hope no-one wants to use remap_file_pages() on a 32-bit platform, on a larger
than 1-2 TB file.
sys_remap_file_pages() is now enforcing the 'prot' parameter to be zero.
This restriction might be lifted in the future - i really hope we can have
more flexible remapping once 64-bit platforms are commonplace - eg. things
like memory debuggers could just use the permission bits directly, instead of
creating many small vmas.
i've tested swappable nonlinear ptes and they are swapped out/in
correctly.
some other changes in -A0 relative to 2.5.63-BK:
- slightly smarter TLB flushing in install_page(). This is still only a
stupid helper functions - a more efficient 'walk the pagecache tree
and pagetable at once and use TLB-gather' implementation is preferred.
- cleanup: pass on pgprot_t instead of unsigned long prot.
- some sanity checks to make sure file_pte() rules are followed.
- do not reduce the vma's default protection to PROT_NONE when using
remap_file_pages() on it. With swappable ptes this is now safe.
Paul Mackerras [Sat, 22 Mar 2003 13:34:35 +0000 (05:34 -0800)]
[PATCH] fix powerbook media bay
This patch fixes a couple of bugs and compile errors in the powerbook
media bay driver. It was getting initialized after the IDE subsystem,
whereas it needs to be initialized before so that the IDE subsystem
can see the CD-ROM drive in the bay.
Paul Mackerras [Sat, 22 Mar 2003 13:34:28 +0000 (05:34 -0800)]
[PATCH] update mac53c94 scsi driver
This patch updates the mac53c94 scsi HBA driver, used on older
powermacs, to correspond with the recent scsi subsystem changes, to
use the PCI DMA API, to not panic, and to use a spinlock instead of
save_flags/restore_flags/cli/sti.
Paul Mackerras [Sat, 22 Mar 2003 13:34:21 +0000 (05:34 -0800)]
[PATCH] update MESH scsi driver
This patch updates the `mesh' scsi driver used on older powermacs to
correspond with recent changes in the scsi subsystem (things like
using cmd->device->id instead of cmd->target).
Paul Mackerras [Sat, 22 Mar 2003 13:34:14 +0000 (05:34 -0800)]
[PATCH] update via-pmu driver
This patch forward-ports various fixes to the driver for the PMU
(power manager unit) on powermacs and powerbooks from 2.4, and in
particular, some improvements to the battery charge calculations.
Paul Mackerras [Sat, 22 Mar 2003 13:33:58 +0000 (05:33 -0800)]
[PATCH] update via-cuda driver
This patch updates the CUDA driver (the power/reset/ADB controller on
older powermacs) to fix some SMP issues and to match the 2.4 version
of the driver.
Register all pcmcia drivers with the pcmcia bus within the old
register_pccard_driver() function. Alternatively, a new
registration function "pcmcia_register_driver()" (and its
counterpart, "pcmcia_unregister_driver()") can be used.
Register a bus_type pcmcia_bus_type. This means the initialization of
the ds module needs to be done in two levels: one quite early
(subsys_initcall) so that drivers may use the bus_type; the other one
must stay that late (late_initcall). As only one initcall can be
specified within one module, some tweaking is needed.
Alan Cox [Sat, 22 Mar 2003 11:15:54 +0000 (03:15 -0800)]
[PATCH] ide typo fixes #3
I'm looking into the other IDE problem from the merge - several people
see hangs. Bartolomiej has found one suspicious looking candidate. I'll
try and pin it down ASAP.
Alan Cox [Sat, 22 Mar 2003 11:15:08 +0000 (03:15 -0800)]
[PATCH] redo the n_tty fix
Two problems with the original change
1. We should return bytes actually processed on an error according to
SuS/POSIX. Technically the EFAULT path is outside the spec but its best
we follow
2. We need to fix most of this anyway because the final section of the
change was wrong. If retval was set we retried and got an efault again
in some cases
I think this way of doing it is right but it could do with further
review
Ivan Kokshaysky [Sat, 22 Mar 2003 15:19:18 +0000 (15:19 +0000)]
[PCI] Make setup-bus.c aware of cardbus bridges.
Comments from rmk:
Make setup-bus.c properly aware of cardbus bridges. We treat the
bus behind a cardbus bridge more or less like any other bus, except
we don't explicitly descend below. We do, however, explicitly
reserve IO and memory space as we have done in the past. Memory
space is doubed to 32MB as a measure to allow the Mobility
cardbus-pci stuff to work. The amount of space reserved is now
specified by a couple of #defines at the top of the file.
This allows pci_bus_assign_resources() and pci_bus_size_bridges()
to be called for both root buses as well as cardbus secondary buses.
Comments from Ivan follows:
This patch combines your(rmk) cardbus changes (formerly pci-11)
and my "arbitrary resource layout" stuff. This + current bk works
on nautilus.
Most interesting feature: this can be used on partially
allocated PCI tree. For instance, i386 PCI code has always been
absolutely helpless wrt incorrectly initialized p2p bridges.
Now it can just call pci_assign_unassigned_resources() in the
end of PCI init and it would fix following problems:
- completely uninitialized bridge windows (with base and limit 0);
- erroneously "closed" windows;
- windows overlapping with something else.
Petr Vandrovec [Fri, 21 Mar 2003 11:08:34 +0000 (03:08 -0800)]
[PATCH] Fix ncpfs and rpcgss order in fs/Kconfig
RPCSEC_GSS options are related to (only) nfs/nfsd, so it is
more logical to ask RPCSEC_GSS questions immediately after
nfs/nfsd, not after half of screen more questions.
NCPFS related options should appear immediately below
ncpfs question, not after Coda and RPCSEC...
[PATCH] get rid of __MOD_INC_USE_COUNT/__MOD_DEC_USE_COUNT
As the netfilter folks don't seem to have any interest in 2.5 currently
I decided to fix their last uses of those old module interfaces myself.
The implementation (get a reference first and release it again when
not actually needed) might be slightly suboptimial but the netfilter
team should just fix it if/when they get any interest in Linux 2.5/2.6.
Also fix the MOD_INC_USE_COUNT/MOD_DEC_USE_COUNT to give more accurate
deprecation warnings.
Devfs tries to be super smart and rereads partition tables at all
kinds of wierd points. This breaks a bunch of stuff were you
can't get the right disk changed information (i.e. CompactFlash).
If people actually need this kind of stuff they should just call partx
from devfsd instead of relying on the kernel doing something like this.
Cleans up the devfs code significatnly (aka removes tons of junk)
[PATCH] fix waitqueue leak in devfs_d_revalidate_wait
devfs_d_revalidate_wait adds to a waitqueue but never removes from it
again so we there's one entry full of reused stack space added on
each call (I wonder how this ever worked).
The function has a few more bugs (it effectivly does a sleep_on instead
of checking for the actual even and can't deal with negative dentries
at all), but I just had breakfast and don't want to poke into devfs
internals deeper - I still hope Adam's smalldevfs will get merged
anyway..