Linas Vepstas [Mon, 19 Mar 2007 19:53:22 +0000 (14:53 -0500)]
[POWERPC] EEH: Tolerate high mmio
Some drivers will attempt to perform a lot of mmio even after
an EEH event was detected. This is especially the case for fast cpu's
and PCI-E slots. Be a bit more lenient in allowing this.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Linas Vepstas [Mon, 19 Mar 2007 19:52:04 +0000 (14:52 -0500)]
[POWERPC] EEH: Add clarifying messages.
There are multiple code patchs tht resuls in a "permanent
failure"; when examining rare events, it can be hard to see
which was taken. This patch adds printk's to assist.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Stephen Rothwell [Fri, 16 Mar 2007 06:47:07 +0000 (17:47 +1100)]
[POWERPC] Minor paca optimisation
Move the slb_shadow_ptr field into the first cache line since it is
(like everything there) read-only after boot. It is in fact statically
initialised and thereafter only read.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Acked-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Fri, 16 Mar 2007 17:28:49 +0000 (12:28 -0500)]
[POWERPC] bootwrapper: Make setprop accept a const buffer.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Fri, 16 Mar 2007 17:28:46 +0000 (12:28 -0500)]
[POWERPC] Document the linux,network-index property.
To allow more robust association of each network device node with an
index (such as is used by the firmware or an EEPROM to indicate MAC
addresses), a network device's node may specify the index explicitly.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Fri, 16 Mar 2007 17:27:59 +0000 (12:27 -0500)]
[POWERPC] bootwrapper: Make compression of the kernel image optional.
The --no-gzip option can be passed to the wrapper so that the kernel
image is included uncompressed into the zImage. This is intended for
bootloaders where the zImage itself can be compressed, or where boot time
is considered more important than kernel image size.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Fri, 16 Mar 2007 17:27:54 +0000 (12:27 -0500)]
[POWERPC] bootwrapper: Add dt_ops methods.
Add get_parent, create_node, and find_node_by_prop_value to dt_ops.
Currently only implemented by flatdevtree_misc.
Also, add a _str convenience wrapper for setprop.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Wed, 14 Mar 2007 05:32:17 +0000 (16:32 +1100)]
[POWERPC] Add documentation for the zImage's gunzip convenience functions
This patch adds documenting comments to the gunzip convenience
functions added in commit ad9d2716cfc1cda5a7e0d7bc0db45e3af8a4adbb.
It also removes a stray newline, and an unused global variable.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Wed, 14 Mar 2007 00:50:40 +0000 (11:50 +1100)]
[POWERPC] Update documentation for flat device tree format v17
This patch updates booting-without-of.txt to describe version 17 of
the flattened device tree format. Version 17 is a small, backwards
compatible change from version 16, adding an extra field giving the
size of the device tree's structure block. At this time, the kernel
has no use for the extra information, however its presence can make
life easier for bootloaders or other software manipulating the tree.
In addition this patch adds information on the size_dt_strings field
of the device tree header, present since version 3 of the flattened
tree format, but omitted from the documentation. It also makes
changes to consistently refer to versions 16 and 17 as versions 16 and
17 in decimal, rather than version 0x10 which was occasionally used
for version 16 previously.
Finally, we also add the new field to the definition of the device
tree header structure in prom.h
Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Jon Loeliger <jdl@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Joachim Fenkes [Fri, 9 Mar 2007 18:00:32 +0000 (19:00 +0100)]
[POWERPC] ibmebus: dynamic addition/removal of adapters, some code cleanup
This adds two sysfs attributes to /sys/bus/ibmebus which can be used to
notify the ebus driver of added / removed ebus devices in the OF device
tree.
Echoing the device's location code (as found in the OFDT "ibm,loc-code"
property) into the "probe" attribute will notify ebus of addition of the
device and cause the appropriate device driver's probe function to be called
on the device.
Likewise, echoing the location code into the "remove" attribute will cause
the device to be removed from the system.
The writes will block until the respective operation has finished and return
an error code if the operation failed.
In addition, two minor tidbits are fixed:
- The fake root device used to provide a common parent for all ebus devices
is now based on device instead of of_device - it had no associated devtree
node. This saves several checks throughout the ebus driver.
- The sysfs attributes are now generated automagically by device_register()
instead of by the ibmebus code, which saves a few compiler warnings about
unused return codes.
Signed-off-by: Joachim Fenkes <fenkes@de.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Mark A. Greer [Wed, 25 Oct 2006 23:36:49 +0000 (16:36 -0700)]
[POWERPC] 32-bit early_init() should zero from __bss_start to __bss_stop only
Currently, early_init() in setup_32.c zeroes from '_bss_start' to '_end'.
It should only zero from '__bss_start' to '__bss_stop'. This patch does that.
Signed-off-by: Mark A. Greer <mgreer@mvista.com> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:59 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Make ft_create_node() pay attention to the parent parameter.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:56 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Make ft_get_parent() return a phandle, and NULL if already top-level.
Most of ft_get_parent() is factored out into __ft_get_parent(), which
deals only in internal node pointers. The ft_get_parent() wrapper
handles phandle conversion in both directions (previously,
ft_get_parent() did not convert its return value).
It also now returns NULL as the parent of the toplevel node, rather than
just returning the toplevel node again (which made it rather useless in
loops).
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:54 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Refactor ft_get_prop() into internal and external functions.
The property searching part of ft_get_prop is factored out into an
internal __ft_get_prop() which does not deal with phandles and does not
copy the property data. ft_get_prop() is then a wrapper that does the
phandle translation and copying.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:51 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Use map_string() instead of lookup_string() in ft_prop().
When adding a property, the property name should be added to the string
table if it doesn't already exist. map_string() does that;
lookup_string() will fail instead.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:47 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Preserve the pp pointer in ft_make_space() when calling ft_reorder().
The ft_reorder() function may change the start of the region of interest,
so the pointer provided by the caller into that region must be fixed up
to still point to the same datum.
Signed-off-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:45 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Make ft_get_phandle() accept and return NULL.
Currently, if ft_get_phandle() is passed NULL it will allocate an entry
for it and return a non-NULL phandle. This patch makes it simply pass
the NULL through.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:44 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Rename ft_node_add() to ft_get_phandle().
This name better reflects what the function does, which is to
look up the phandle for an internal node pointer, and add it to the
internal pointer to phandle table if not found.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:42 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Add ft_root_node().
Clean up some of the open-coded data structure references by providing a
function to return a pointer to the tree's root node. This is only used
in high-level functions trying to access the root of the tree, not in
low-level code that is actually manipulating the data structure.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
Scott Wood [Mon, 12 Mar 2007 20:41:38 +0000 (14:41 -0600)]
[POWERPC] bootwrapper: Add stddef.h to ops.h
ops.h references NULL, so include stddef.h, so files including ops.h
don't have to.
Signed-off-by: Scott Wood <scottwood@freescale.com> Acked-by: Mark A. Greer <mgreer@mvista.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Mon, 5 Mar 2007 03:24:52 +0000 (14:24 +1100)]
[POWERPC] zImage: Cleanup and improve zImage entry point
This patch re-organises the way the zImage wrapper code is entered, to
allow more flexibility on platforms with unusual entry conditions.
After this patch, a platform .o file has two options:
1) It can define a _zimage_start, in which case the platform code gets
control from the very beginning of execution. In this case the
platform code is responsible for relocating the zImage if necessary,
clearing the BSS, performing any platform specific initialization, and
finally calling start() to load and enter the kernel.
2) It can define platform_init(). In this case the generic crt0.S
handles initial entry, and calls platform_init() before calling
start(). The signature of platform_init() is changed, however, to
take up to 5 parameters (in r3..r7) as they come from the platform's
initial loader, instead of a fixed set of parameters based on OF's
usage.
When using the generic crt0.S, the platform .o can optionally
supply a custom stack to use, using the BSS_STACK() macro. If this
is not supplied, the crt0.S will assume that the loader has
supplied a usable stack.
In either case, the platform code communicates information to the
generic code (specifically, a PROM pointer for OF systems, and/or an
initrd image address supplied by the bootloader) via a global
structure "loader_info".
In addition the wrapper script is rearranged to ensure that the
platform .o is always linked first. This means that platforms where
the zImage entry point is at a fixed address or offset, rather than
being encoded in the binary header can be supported using option (1).
Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Mon, 5 Mar 2007 03:24:52 +0000 (14:24 +1100)]
[POWERPC] zImage: Cleanup and improve prep_kernel()
This patch rewrites prep_kernel() in the zImage wrapper code to be
clearer and more flexible. Notable changes:
- Handling of the initrd image from prep_kernel() has moved
into a new prep_initrd() function.
- The address of the initrd image is now added as device tree
properties, as the kernel expects.
- We only copy a packaged initrd image to a new location if it
is in danger of being clobbered when the kernel moves to its final
location, instead of always.
- By default we decompress the kernel directly to address 0,
instead of requiring it to relocate itself. Platforms (such as OF)
where doing this could clobber still-live firmware data structures can
override the vmlinux_alloc hook to provide an alternate place to
decompress the kernel.
- We no longer pass lots of information between functions in
global variables.
Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Mon, 5 Mar 2007 03:24:52 +0000 (14:24 +1100)]
[POWERPC] zImage: Add more flexible gunzip convenience functions
At present, arch/powerpc/boot/main.c includes a gunzip() function
which is a convenient wrapper around zlib. However, it doesn't
conveniently allow decompressing part of an image to one location,
then the remainder to a different address.
This patch adds a new set of more flexible convenience wrappers around
zlib, moving them to their own file, gunzip_util.c, in the process.
These wrappers allow decompressing sections of the compressed image to
different locations. In addition, they transparently handle
uncompressed data, avoiding special case code to handle uncompressed
vmlinux images.
The patch also converts main.c to use the new wrappers, using the new
flexibility to avoid decompressing the vmlinux's ELF header twice as
we did previously. That in turn means we avoid extending our
allocations for the vmlinux to allow space for the extra copy of the
ELF header.
Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Zang Roy-r61911 [Tue, 6 Mar 2007 06:10:36 +0000 (14:10 +0800)]
[POWERPC] Remove fixed setting of ROOT_DEV for 7448HPC2 platforms
Remove fixed setting of ROOT_DEV for 7448HPC2 platforms. Signed-off-by: Roy Zang <tie-fei.zang@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Jake Moilanen [Fri, 2 Mar 2007 21:49:43 +0000 (15:49 -0600)]
[POWERPC] DMA 4GB boundary protection
There are many adapters which can not handle DMAing acrosss any 4 GB
boundary. For instance the latest Emulex adapters.
This normally is not an issue as firmware gives us dma-windows under
4gigs. However, some of the new System-P boxes have dma-windows above
4gigs, and this present a problem.
I propose fixing it in the IOMMU allocation instead of making each
driver protect against it as it is more efficient, and won't require
changing every driver which has not considered this issue.
This patch checks to see if the mapping spans a 4 gig boundary, and if
it does, retries the allocation. It tries the next allocation at the
start of the crossed 4 gig boundary.
Signed-off-by: Jake Moilanen <moilanen@austin.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Dave Jiang [Fri, 2 Mar 2007 20:36:21 +0000 (13:36 -0700)]
[POWERPC] EDAC ECC software scrubber
Implements the per arch atomic_scrub() that EDAC uses for software
ECC scrubbing. It reads memory and then writes back the original
value, allowing the hardware to detect and correct memory errors.
Signed-off-by: Dave Jiang <djiang@mvista.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Stuart Yoder [Tue, 27 Feb 2007 16:14:14 +0000 (10:14 -0600)]
[POWERPC] Remove unused, undocumented #cpus property from cpus node
The #cpus property is unused and undocumented and is therefore
being removed.
Signed-off-by: Stuart Yoder <stuart.yoder@freescale.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org>
CC [M] drivers/media/video/pwc/pwc-uncompress.o
In file included from /home/olaf/kernel/linux-2.6.18.8/drivers/media/video/pwc/pwc-uncompress.c:29:
include2/asm/current.h: In function 'get_current':
include2/asm/current.h:23: warning: implicit declaration of function 'offsetof'
include2/asm/current.h:23: error: expected expression before 'struct'
make[5]: *** [drivers/media/video/pwc/pwc-uncompress.o] Error 1
Signed-off-by: Olaf Hering <olaf@aepfle.de> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Wed, 28 Feb 2007 03:12:29 +0000 (14:12 +1100)]
[POWERPC] Automatically lmb_reserve() initrd
At present, when an initrd is passed to the kernel used flat device
tree properties, the memory the initrd occupies must also be reserved
in the flat tree's reserve map, or the kernel may overwrite it. That
makes life more complicated than it could be for the bootwrapper.
This patch makes the kernel automatically reserve the initrd's space.
That in turn requires parsing the initrd parameters earlier than they
are currently, in early_init_dt_scan_chosen() instead of
check_for_initrd().
Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
David Gibson [Wed, 28 Feb 2007 03:12:29 +0000 (14:12 +1100)]
[POWERPC] Allow duplicate lmb_reserve() calls
At present calling lmb_reserve() (and hence lmb_add_region()) twice
for exactly the same memory region will cause strange behaviour.
This makes life difficult when booting from a flat device tree with
memory reserve map. Which regions are automatically reserved by the
kernel has changed over time, so it's quite possible a newer kernel
could attempt to auto-reserve a region which is also explicitly listed
in the device tree's reserve map, leading to trouble.
This patch avoids the problem by making lmb_reserve() ignore a call to
reserve a previously reserved region. It also removes a now redundant
test designed to avoid one specific case of the problem noted above.
At present, this patch deals only with duplicate reservations of an
identical region. Attempting to reserve two different, but
overlapping regions will still cause problems. I might post another
patch later dealing with this case, but I'm avoiding it now since it
is substantially more complicated to deal with, less likely to occur
and more likely to indicate a genuine bug elsewhere if it does occur.
Signed-off-by: David Gibson <dwg@au1.ibm.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Stuart Yoder [Mon, 19 Feb 2007 17:25:05 +0000 (11:25 -0600)]
[POWERPC] Remove interrupt-controller as a property under /chosen
Remove interrupt-controller as a valid property under /chosen in
the documentation. There is a consensus that an
interrupt-controller property does not belong under /chosen.
/chosen is specifically for dynamic properties set at runtime.
Signed-off-by: Stuart Yoder <stuart.yoder@freescale.com> Signed-off-by: Paul Mackerras <paulus@samba.org>
Paul Mackerras [Mon, 19 Feb 2007 00:42:42 +0000 (11:42 +1100)]
[POWERPC] Harden validate_sp against stack corruption
If something has overflowed or corrupted the stack and causes an oops,
and we try to print a stack trace, that will call validate_sp, which
can itself cause an oops if the cpu field of the thread_info struct at
the bottom of the stack has been corrupted (if CONFIG_IRQSTACKS is
set). This makes debugging harder.
To avoid the second oops, this adds a check to make sure that the cpu
number is reasonable before using it to check whether the stack is on
the softirq or hardirq stack.
Andrew Morton [Sun, 18 Feb 2007 01:17:16 +0000 (18:17 -0700)]
[POWERPC] Fix compile error in prom.h
In file included from include/asm/pci.h:20,
from include/linux/pci.h:751,
from arch/powerpc/sysdev/dart_iommu.c:36:
include/asm/prom.h: In function `of_irq_to_resource':
include/asm/prom.h:341: warning: implicit declaration of function `irq_of_parse_and_map'
include/asm/prom.h:345: error: `NO_IRQ' undeclared (first use in this function)
include/asm/prom.h:345: error: (Each undeclared identifier is reported only once
include/asm/prom.h:345: error: for each function it appears in.)
Seems that prom.h has always wanted irq.h.
Cc: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
[POWERPC] Fix warning in prom_parse.c of_irq_map_oldworld()
This function spews a warning due to possible use of an uninitialized
variable. This can happen on broken device-trees or when called with
a NULL argument. Makes ure we properly fail instead.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
hose->cfg_addr type is "volatile unsigned int __iomem *", so
"hose->cfg_addr + X" will not make an intended address.
This patch also adds comments for usage of cfg_addr and cfg_data in
pci_controller structure. We use them in irregular way, and the
original code is short of explanations about them.
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp> Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <paulus@samba.org>
Olof Johansson [Mon, 26 Feb 2007 06:35:14 +0000 (00:35 -0600)]
[POWERPC] No DEEPNAP on 970MP 1.0
970MP rev 1.0 is reported to have nonworking DEEPNAP support, we've had
bug reports of lockups on those machines. Appearantly Apple used them
on some dual-core dual-cpu systems. Rev 1.1 is OK, and that's the one
that all 4-way systems seem to use.
Signed-off-by: Olof Johansson <olof@lixom.net> Signed-off-by: Paul Mackerras <paulus@samba.org>
Linus Torvalds [Wed, 7 Mar 2007 03:52:50 +0000 (19:52 -0800)]
Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
[S390] cio: Call cancel_halt_clear even when actl == 0.
[S390] cio: Use path verification to check for path state.
[S390] cio: Fix locking when calling notify function.
[S390] Fixed handling of access register mode faults.
[S390] dasd: Use default recovery for SNSS requests
[S390] check_bugs() should be inline.
[S390] tape: Compression overwrites crypto setting
[S390] nss: disable kexec.
[S390] reipl: move dump_prefix_page out of text section.
[S390] smp: disable preemption in smp_call_function/smp_call_function_on
[S390] kprobes breaks BUG_ON
Linus Torvalds [Wed, 7 Mar 2007 03:44:13 +0000 (19:44 -0800)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
pata_pdc202xx_old: fix data corruption and other problems
pata_legacy: fix io/irq mismatch
ahci: RAID mode SATA patch for Intel ICH9M
The commit was buggy in multiple ways:
- the conversion to ilog2() was incorrect to begin with
- it tested the wrong #defines, so on all architectures but FRV you'd
never see the bug except for constant arguments.
- the new "get_order()" macro used its arguments multiple times, and
didn't even parenthesize them properly
- despite the comments, it was not true that you could use it for
constant initializers, since not all architectures even use the
generic page.h header file.
All of the problems are individually fixable, but it all boils down to:
better just revert it, and re-do it from scratch.
Cc: David Howells <dhowells@redhat.com> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org> Cc: Paul Mackerras <paulus@samba.org> Cc: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds [Wed, 7 Mar 2007 02:05:10 +0000 (18:05 -0800)]
Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
[IA64] kexec: Use EFI_LOADER_DATA for ELF core header
[IA64] permon use-after-free fix
[IA64] sync compat getdents
[IA64] always build arch/ia64/lib/xor.o
[IA64] Remove stack hard limit on ia64
[IA64] point saved_max_pfn to the max_pfn of the entire system
Revert "[IA64] swiotlb abstraction (e.g. for Xen)"
Marcel Holtmann [Tue, 6 Mar 2007 21:12:00 +0000 (22:12 +0100)]
[PATCH] Fix buffer overflow in Omnikey CardMan 4040 driver (CVE-2007-0005)
Based on a patch from Don Howard <dhoward@redhat.com>
When calling write() with a buffer larger than 512 bytes, the
driver's write buffer overflows, allowing to overwrite the EIP and
execute arbitrary code with kernel privileges.
In read(), there exists a similar problem, but coming from the device.
A malicous or buggy device sending more than 512 bytes can overflow
of the driver's read buffer, with the same effects as above.
sysfs_write_file downs buffer->sem while calling flush_write_buffer, and
flushing that particular write buffer entails downing buffer->sem in
orphan_all_buffers, resulting in the obvious self-deadlock.
* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
[CIFS] cifs_prepare_write was incorrectly rereading page in some cases
[CIFS] Fix set file size to zero when doing chmod to Samba 3.0.26pre
[CIFS] Remove some unused functions/declarations
[CIFS] New file for previous commit
[CIFS] cifs export operations
[CIFS] small piece missing from previous patch
[CIFS] Fix locking problem around some cifs uses of i_size write
Linus Torvalds [Wed, 7 Mar 2007 01:31:29 +0000 (17:31 -0800)]
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
sdhci: release irq during suspend
sdhci: make isr tolerant of read errors
mmc: require explicit support for high-speed
ncpfs: make sure server connection survives a kill
Linus Torvalds [Wed, 7 Mar 2007 01:30:59 +0000 (17:30 -0800)]
Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6
* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
sis900 warning fixes
mv643xx_eth: Place explicit port number in mv643xx_eth_platform_data
pcnet32: Fix PCnet32 performance bug on non-coherent architecutres
__devinit & __devexit cleanups for de2104x driver
3c59x: Handle pci_enable_device() failure while resuming
dmfe: Fix link detection
dmfe: fix two bugs
dmfe: trivial/spelling fixes
revert "drivers/net/tulip/dmfe: support basic carrier detection"
ucc_geth: returns NETDEV_TX_BUSY when BD ring is full
ucc_geth: Fix BD processing
natsemi: netpoll fixes
bonding: Improve IGMP join processing
bonding: only receive ARPs for us
bonding: fix double dev_add_pack
Magnus Damm [Tue, 6 Mar 2007 10:34:26 +0000 (02:34 -0800)]
[IA64] kexec: Use EFI_LOADER_DATA for ELF core header
The address where the ELF core header is stored is passed to the secondary
kernel as a kernel command line option. The memory area for this header is
also marked as a separate EFI memory descriptor on ia64.
The separate EFI memory descriptor is at the moment of the type
EFI_UNUSABLE_MEMORY. With such a type the secondary kernel skips over the
entire memory granule (config option, 16M or 64M) when detecting memory.
If we are lucky we will just lose some memory, but if we happen to have
data in the same granule (such as an initramfs image), then this data will
never get mapped and the kernel bombs out when trying to access it.
So this is an attempt to fix this by changing the EFI memory descriptor
type into EFI_LOADER_DATA. This type is the same type used for the kernel
data and for initramfs. In the secondary kernel we then handle the ELF
core header data the same way as we handle the initramfs image.
This patch contains the kernel changes to make this happen. Pretty
straightforward, we reserve the area in reserve_memory(). The address for
the area comes from the kernel command line and the size comes from the
specialized EFI parsing function vmcore_find_descriptor_size().
The kexec-tools-testing code for this can be found here:
http://lists.osdl.org/pipermail/fastboot/2007-February/005983.html
Signed-off-by: Magnus Damm <magnus@valinux.co.jp> Cc: Simon Horman <horms@verge.net.au> Cc: Vivek Goyal <vgoyal@in.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Tony Luck <tony.luck@intel.com>
Nick Piggin [Tue, 6 Mar 2007 10:34:25 +0000 (02:34 -0800)]
[IA64] permon use-after-free fix
Perfmon associates vmalloc()ed memory with a file descriptor, and installs
a vma mapping that memory. Unfortunately, the vm_file field is not filled
in, so processes with mappings to that memory do not prevent the file from
being closed and the memory freed. This results in use-after-free bugs and
multiple freeing of pages, etc.
I saw this bug on an Altix on SLES9. Haven't reproduced upstream but it
looks like the same issue is there.
Signed-off-by: Nick Piggin <npiggin@suse.de> Cc: Stephane Eranian <eranian@hpl.hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Tony Luck <tony.luck@intel.com>
projects / linux-beck.git / log