aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* [PATCH] x86/PAE: Fix pte_clear for the >4GB RAM caseZachary Amsden2006-04-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Proposed fix for ptep_get_and_clear_full PAE bug. Pte_clear had the same bug, so use the same fix for both. Turns out pmd_clear had it as well, but pgds are not affected. The problem is rather intricate. Page table entries in PAE mode are 64-bits wide, but the only atomic 8-byte write operation available in 32-bit mode is cmpxchg8b, which is expensive (at least on P4), and thus avoided. But it can happen that the processor may prefetch entries into the TLB in the middle of an operation which clears a page table entry. So one must always clear the P-bit in the low word of the page table entry first when clearing it. Since the sequence *ptep = __pte(0) leaves the order of the write dependent on the compiler, it must be coded explicitly as a clear of the low word followed by a clear of the high word. Further, there must be a write memory barrier here to enforce proper ordering by the compiler (and, in the future, by the processor as well). On > 4GB memory machines, the implementation of pte_clear for PAE was clearly deficient, as it could leave virtual mappings of physical memory above 4GB aliased to memory below 4GB in the TLB. The implementation of ptep_get_and_clear_full has a similar bug, although not nearly as likely to occur, since the mappings being cleared are in the process of being destroyed, and should never be dereferenced again. But, as luck would have it, it is possible to trigger bugs even without ever dereferencing these bogus TLB mappings, even if the clear is followed fairly soon after with a TLB flush or invalidation. The problem is that memory above 4GB may now be aliased into the first 4GB of memory, and in fact, may hit a region of memory with non-memory semantics. These regions include AGP and PCI space. As such, these memory regions are not cached by the processor. This introduces the bug. The processor can speculate memory operations, including memory writes, as long as they are committed with the proper ordering. Speculating a memory write to a linear address that has a bogus TLB mapping is possible. Normally, the speculation is harmless. But for cached memory, it does leave the falsely speculated cacheline unmodified, but in a dirty state. This cache line will be eventually written back. If this cacheline happens to intersect a region of memory that is not protected by the cache coherency protocol, it can corrupt data in I/O memory, which is generally a very bad thing to do, and can cause total system failure or just plain undefined behavior. These bugs are extremely unlikely, but the severity is of such magnitude, and the fix so simple that I think fixing them immediately is justified. Also, they are nearly impossible to debug. Signed-off-by: Zachary Amsden <zach@vmware.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* Linux v2.6.17-rc3v2.6.17-rc3Linus Torvalds2006-04-26
|
* Merge master.kernel.org:/home/rmk/linux-2.6-mmcLinus Torvalds2006-04-26
|\ | | | | | | | | * master.kernel.org:/home/rmk/linux-2.6-mmc: [MMC] pxamci: fix data timeout calculation
| * [MMC] pxamci: fix data timeout calculationRussell King2006-04-24
| | | | | | | | | | | | | | | | | | | | | | The MMC layer gives us two parts for the timeout calculation - a fixed timeout in nanoseconds, and a card clock-speed dependent part. The PXA MMC hardware allows for a timeout based on the fixed host clock speed only. This resulted in some cards being given a short timeout, and therefore failing to work. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* | Merge master.kernel.org:/home/rmk/linux-2.6-armLinus Torvalds2006-04-26
|\ \ | | | | | | | | | | | | | | | | | | * master.kernel.org:/home/rmk/linux-2.6-arm: [ARM] nommu: trivial fixups for head-nommu.S and the Makefile [ARM] vfp: fix leak of VFP_NAN_FLAG into FPSCR [ARM] 3484/1: Correct AEABI CFLAGS for correct enum handling
| * \ Merge nommu treeRussell King2006-04-26
| |\ \
| | * | [ARM] nommu: trivial fixups for head-nommu.S and the MakefileHyok S. Choi2006-04-24
| | |/ | | | | | | | | | | | | | | | | | | | | | This patch fix compilation problem of start-up codes. (head-nommu.S, arch/arm/kernel/Makefile) Signed-off-by: Hyok S. Choi <hyok.choi@samsung.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] vfp: fix leak of VFP_NAN_FLAG into FPSCRRussell King2006-04-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | The VFP code can leak VFP_NAN_FLAG into the FPSCR. It doesn't correspond to any real FPSCR bit (and overlaps one of the exception flags). Bug report from Daniel Jacobowitz Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
| * | [ARM] 3484/1: Correct AEABI CFLAGS for correct enum handlingRichard Purdie2006-04-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Patch from Richard Purdie The AAPCS says that enums can be variably sized depending on the range of valid values. This is not the accepted behaviour under linux so for compatibility gcc has an aapcs-linux target, the main difference being that enums are always of type int. Change the ARM Makefile to use this target. Signed-off-by: Richard Purdie <rpurdie@rpsys.net> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* | | [PATCH] Remove __devinit and __cpuinit from notifier_call definitionsChandra Seetharaman2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Few of the notifier_chain_register() callers use __init in the definition of notifier_call. It is incorrect as the function definition should be available after the initializations (they do not unregister them during initializations). This patch fixes all such usages to _not_ have the notifier_call __init section. Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] Remove __devinitdata from notifier block definitionsChandra Seetharaman2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Few of the notifier_chain_register() callers use __devinitdata in the definition of notifier_block data structure. It is incorrect as the data structure should be available after the initializations (they do not unregister them during initializations). This was leading to an oops when notifier_chain_register() call is invoked for those callback chains after initialization. This patch fixes all such usages to _not_ have the notifier_block data structure in the init data section. Signed-off-by: Chandra Seetharaman <sekharan@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] LSM: add missing hook to do_compat_readv_writev()James Morris2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch addresses a flaw in LSM, where there is no mediation of readv() and writev() in for 32-bit compatible apps using a 64-bit kernel. This bug was discovered and fixed initially in the native readv/writev code [1], but was not fixed in the compat code. Thanks to Al for spotting this one. [1] http://lwn.net/Articles/154282/ Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] protect ext3 ioctl modifying append_only, immutable, etc. with i_mutexAl Viro2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | All modifications of ->i_flags in inodes that might be visible to somebody else must be under ->i_mutex. That patch fixes ext3 ioctl() setting S_APPEND and friends. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] fix mips sys32_p{read,write}Al Viro2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switched to use of sys_pread64()/sys_pwrite64() rather than keep duplicating their guts; among the little things that had been missing there were such as ret = security_file_permission (file, MAY_READ); Gotta love the LSM robustness, right? Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] forgotten ->b_data in memcpy() call in ext3/resize.c (oopsable)Al Viro2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sbi->s_group_desc is an array of pointers to buffer_head. memcpy() of buffer size from address of buffer_head is a bad idea - it will generate junk in any case, may oops if buffer_head is close to the end of slab page and next page is not mapped and isn't what was intended there. IOW, ->b_data is missing in that call. Fortunately, result doesn't go into the primary on-disk data structures, so only backup ones get crap written to them; that had allowed this bug to remain unnoticed until now. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | [PATCH] fix leak in activate_ep_files()Al Viro2006-04-26
| | | | | | | | | | | | | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | Merge branch 'splice' of git://brick.kernel.dk/data/git/linux-2.6-blockLinus Torvalds2006-04-26
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 'splice' of git://brick.kernel.dk/data/git/linux-2.6-block: [PATCH] splice: add ->splice_write support for /dev/null [PATCH] splice: rearrange moving to/from pipe helpers [PATCH] Add support for the sys_vmsplice syscall [PATCH] splice: fix offset problems [PATCH] splice: fix min() warning
| * | | [PATCH] splice: add ->splice_write support for /dev/nullJens Axboe2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | Useful for testing. Signed-off-by: Jens Axboe <axboe@suse.de>
| * | | [PATCH] splice: rearrange moving to/from pipe helpersJens Axboe2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | We need these for people writing their own ->splice_read/write hooks. Signed-off-by: Jens Axboe <axboe@suse.de>
| * | | [PATCH] Add support for the sys_vmsplice syscallJens Axboe2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sys_splice() moves data to/from pipes with a file input/output. sys_vmsplice() moves data to a pipe, with the input being a user address range instead. This uses an approach suggested by Linus, where we can hold partial ranges inside the pages[] map. Hopefully this will be useful for network receive support as well. Signed-off-by: Jens Axboe <axboe@suse.de>
| * | | [PATCH] splice: fix offset problemsJens Axboe2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make the move_from_pipe() actors return number of bytes processed, then move_from_pipe() can decide more cleverly when to move on to the next buffer. This fixes problems with pipe offset and differing file offset. Signed-off-by: Jens Axboe <axboe@suse.de>
| * | | [PATCH] splice: fix min() warningAndrew Morton2006-04-26
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Jens Axboe <axboe@suse.de>
* | | | Merge branch 'upstream-linus' of ↵Linus Torvalds2006-04-26
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 * 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: [PATCH] forcedeth: fix initialization [PATCH] sky2: version 1.2 [PATCH] sky2: reset function can be devinit [PATCH] sky2: use ALIGN() macro [PATCH] sky2: add fake idle irq timer [PATCH] sky2: reschedule if irq still pending [PATCH] bcm43xx: make PIO mode usable [PATCH] bcm43xx: add to MAINTAINERS [PATCH] softmac: fix SIOCSIWAP [PATCH] Fix crash on big-endian systems during scan e1000: Update truesize with the length of the packet for packet split [PATCH] Fix locking in gianfar
| * | | | [PATCH] forcedeth: fix initializationAyaz Abdulla2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes the nic initialization. If the nic was in low power mode, it brings it back to normal power. Also, it utilizes a new hardware reset during the init. I am resending based on feedback, I corrected the register size mapping and delay after posted write. Signed-Off-By: Ayaz Abdulla <aabdulla@nvidia.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] sky2: version 1.2Stephen Hemminger2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update to version 1.2 Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] sky2: reset function can be devinitStephen Hemminger2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sky2_reset function only called from sky2_probe. Maybe the compiler was smart enough to figure this out already. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] sky2: use ALIGN() macroStephen Hemminger2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ALIGN() macro in kernel.h does the same math that the sky2 driver was using for padding. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] sky2: add fake idle irq timerStephen Hemminger2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add an fake NAPI schedule once a second. This is an attempt to work around for broken configurations with edge-triggered interrupts. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | [PATCH] sky2: reschedule if irq still pendingStephen Hemminger2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a workaround for the case edge-triggered irq's. Several users seem to have broken configurations sharing edge-triggered irq's. To avoid losing IRQ's, reshedule if more work arrives. The changes to netdevice.h are to extract the part that puts device back in list into separate inline. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
| * | | | Merge branch 'upstream-fixes' of ↵Jeff Garzik2006-04-26
| |\ \ \ \ | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes
| | * | | | [PATCH] bcm43xx: make PIO mode usableMichael Buesch2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes PIO mode on the softmac bcm43xx driver. (A dscape patch will follow). It mainly fixes endianess issues. This patch is tested on PowerPC32 and i386. Signed-off-by: Michael Buesch <mb@bu3sch.de> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | [PATCH] bcm43xx: add to MAINTAINERSMichael Buesch2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | [PATCH] softmac: fix SIOCSIWAPJohannes Berg2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are some bugs in the current implementation of the SIOCSIWAP wext, for example that when you do it twice and it fails, it may still try another access point for some reason. This patch fixes this by introducing a new flag that tells the association code that the bssid that is in use was fixed by the user and shouldn't be deviated from. Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * | | | [PATCH] Fix crash on big-endian systems during scanPavel Roskin2006-04-24
| | | |_|/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The original code was doing arithmetics on a little-endian value. Reported by Stelios Koroneos <stelios@stelioscellar.com> Signed-off-by: Pavel Roskin <proski@gnu.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * | | | Merge branch 'skb_truesize' of ↵Jeff Garzik2006-04-26
| |\ \ \ \ | | | | | | | | | | | | | | | | | | git://lost.foo-projects.org/~ahkok/git/linux-2.6 into upstream-fixes
| | * | | | e1000: Update truesize with the length of the packet for packet splitAuke Kok2006-04-26
| | | |/ / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update skb with the real packet size. Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com> Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com> Signed-off-by: John Ronciak <john.ronciak@intel.com>
| * | | | Merge branch 'master' into upstream-fixesJeff Garzik2006-04-26
| |\| | |
| * | | | [PATCH] Fix locking in gianfarAndy Fleming2006-04-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes several bugs in the gianfar driver, including a major one where spinlocks were horribly broken: * Split gianfar locks into two types: TX and RX * Made it so gfar_start() now clears RHALT * Fixed a bug where calling gfar_start_xmit() with interrupts off would corrupt the interrupt state * Fixed a bug where a frame could potentially arrive, and never be handled (if no more frames arrived * Fixed a bug where the rx_work_limit would never be observed by the rx completion code * Fixed a bug where the interrupt handlers were not actually protected by their spinlocks Signed-off-by: Andy Fleming <afleming@freescale.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
* | | | | Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds2006-04-26
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: [BRIDGE]: allow full size vlan packets
| * | | | | [BRIDGE]: allow full size vlan packetsStephen Hemminger2006-04-26
| | |/ / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | Need to allow for VLAN header when bridging. Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | | | [doc] add paragraph about 'fs' subsystem to sysfs.txtMiklos Szeredi2006-04-26
| | | | | | | | | | | | | | | | | | | | Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
* | | | | [fuse] fix race between checking and setting file->private_dataMiklos Szeredi2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | BKL does not protect against races if the task may sleep between checking and setting a value. So move checking of file->private_data near to setting it in fuse_fill_super(). Found by Al Viro. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
* | | | | [fuse] fix deadlock between fuse_put_super() and request_end(), try #2Miklos Szeredi2006-04-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A deadlock was possible, when the last reference to the superblock was held due to a background request containing a file reference. Releasing the file would release the vfsmount which in turn would release the superblock. Since sbput_sem is held during the fput() and fuse_put_super() tries to acquire this same semaphore, a deadlock results. The solution is to move the fput() outside the region protected by sbput_sem. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
* | | | | Revert "[fuse] fix deadlock between fuse_put_super() and request_end()"Miklos Szeredi2006-04-26
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts 73ce8355c243a434524a34c05cc417dd0467996e commit. It was wrong, because it didn't take into account the requirement, that iput() for background requests must be performed synchronously with ->put_super(), otherwise active inodes may remain after unmount. The right solution is to keep the sbput_sem and perform iput() within the locked region, but move fput() outside sbput_sem. Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
* | | / [PATCH] Alpha: strncpy() fixIvan Kokshaysky2006-04-25
| |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | As it turned out after recent SCSI changes, strncpy() was broken - it mixed up the return values from __stxncpy() in registers $24 and $27. Thanks to Mathieu Chouquet-Stringer for tracking down the problem and providing an excellent test case. Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
* | | Merge master.kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6-stableLinus Torvalds2006-04-24
|\ \ \ | | | | | | | | | | | | | | | | * master.kernel.org:/pub/scm/linux/kernel/git/sfrench/cifs-2.6-stable: [CIFS] Fix compile error when CONFIG_CIFS_EXPERIMENTAL is undefined
| * | | [CIFS] Fix compile error when CONFIG_CIFS_EXPERIMENTAL is undefinedSteve French2006-04-24
| | |/ | |/| | | | | | | | | | Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com> Signed-off-by: Steve French <sfrench@us.ibm.com>
* | | [NETFILTER]: ipt action: use xt_check_target for basic verificationPatrick McHardy2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | The targets don't do the basic verification themselves anymore so the ipt action needs to take care of it. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | [NETFILTER]: x_tables: move table->lock initializationDmitry Mishin2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xt_table->lock should be initialized before xt_replace_table() call, which uses it. This patch removes strict requirement that table should define lock before registering. Signed-off-by: Dmitry Mishin <dim@openvz.org> Signed-off-by: Kirill Korotaev <dev@openvz.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
* | | [NETFILTER]: ip6_tables: remove broken comefrom debuggingPatrick McHardy2006-04-24
| | | | | | | | | | | | | | | | | | | | | | | | The introduction of x_tables broke comefrom debugging, remove it from ip6_tables as well (ip_tables already got removed). Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-25 22:09:10 -0500