Maxim Levitsky [Fri, 15 Oct 2010 15:20:43 +0000 (17:20 +0200)]
mtd: allow to unload the mtdtrans module if its block devices aren't open
Now it once again possible to remove mtdtrans module.
You still need to ensure that block devices of that module aren't mounted.
This is due to the fact that as long as a block device is open, it still exists,
therefore if we were to allow module removal, this block device might became used again.
This time in addition to code review, I also made the code
pass some torture tests like module reload in a loop + read in a loop +
card insert/removal all at same time.
The blktrans_open/blktrans_release don't take the mtd table lock because:
While device is added (that includes execution of add_mtd_blktrans_dev)
the lock is already taken
Now suppose the device will never be removed. In this case even if we have changes
in mtd table, the entry that we need will stay exactly the same. (Note that we don't
look at table at all, just following private pointer of block device).
Now suppose that someone tries to remove the mtd device.
This will be propagated to trans driver which _ought_ to call del_mtd_blktrans_dev
which will take the per device lock, release the mtd device and set trans->mtd = NULL.
>From this point on, following opens won't even be able to know anything about that mtd device
(which at that point is likely not to exist)
Also the same care is taken not to trip over NULL mtd pointer in blktrans_dev_release.
Mike Frysinger [Sat, 16 Oct 2010 22:31:14 +0000 (18:31 -0400)]
mtd: maps: gpio-addr-flash: fix warnings and make more portable
As reported on lkml, building this module for HIMEM systems spews warnings
about mismatch in pointer types. Further, we need to use ioremap() in order
to properly access the flash memory on most systems rather than just doing
it directly.
Reported-by: Alan Cox <alan@linux.intel.com> Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Mike Frysinger [Sat, 16 Oct 2010 22:26:59 +0000 (18:26 -0400)]
mtd: Blackfin NFC: fix badblock location with BootROM OOB
The bbt structure isn't actually used, just the badblockpos. This lets
the driver correctly handle badblocks with the different OOB layout with
certain sized flashes. Previously, the blocks would all be reported as
bad and be completely unusable.
Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Wolfram Sang [Sat, 16 Oct 2010 12:56:22 +0000 (14:56 +0200)]
mtd: cfi_cmdset_0002: code cleanups
- remove disabled code (hasn't been touched since the beginning of git
and should be reimplemented if really needed)
- convert remaining c++-comments to plain c-style
Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Acked-by: Guillaume LECERF <glecerf@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
For 4Gib non-DDP chip it does not follow that it is always 4KiB page chip.
The number of data buffers is checked and if it is equal to 1
we suppose that it is 4KiB page onenand chip.
Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com> Acked-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Stefan Roese [Fri, 8 Oct 2010 12:41:27 +0000 (14:41 +0200)]
mtd: physmap_of: Loop through all "reg" tuples for mapping
This patch changes the loop over the "reg" tuples to not exit
directly upon of_address_to_resource() failure but to continue
with the next "reg" tuple instead. This failure could be due to
size = 0, which might be passed via the device-tree.
This is needed for boards, where a "reg" tuple might have size 0
(of_address_to_resource() returns with EINVAL when size = 0).
This could be the case on boards with runtime detection of
multiple NOR flash configurations where the detected flash size
is inserted into the dtb in U-Boot.
Signed-off-by: Stefan Roese <sr@denx.de> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Daniel Drake [Thu, 7 Oct 2010 18:14:02 +0000 (19:14 +0100)]
jffs2: Dynamically choose inocache hash size
When JFFS2 is used for large volumes, the mount times are quite long.
Increasing the hash size provides a significant speed boost on the OLPC
XO-1 laptop.
Add logic that dynamically selects a hash size based on the size of
the medium. A 64mb medium will result in a hash size of 128, and a 512mb
medium will result in a hash size of 1024.
Signed-off-by: Daniel Drake <dsd@laptop.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
- *var instead of * var
- proper multiline comment
- func(args) instead of func (args)
- 80 lines
So from
|total: 2 errors, 37 warnings, 654 lines checked
we got to one warning.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Ian Munsie [Fri, 1 Oct 2010 07:06:08 +0000 (17:06 +1000)]
mtd: Fix endianness issues from device tree
This patch adds the appropriate conversions to correct the endianness
issues in the MTD driver whenever it accesses the device tree (which is
always big endian).
Signed-off-by: Ian Munsie <imunsie@au1.ibm.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
I used this to check the BBT on flash together with a hack in mtdchar in
order to read bad blocks.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
it will create an empty BBT table without considering vendor's BBT
information. Vendor's information may be unavailable if the NAND
controller has a different DATA & OOB layout or this information may be
allready purged.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
The first (sixt) byte in the OOB area contains vendor's bad block
information. During identification of the NAND chip this information is
collected by scanning the complete chip.
The option NAND_USE_FLASH_BBT is used to store this information in a sector so
we don't have to scan the complete flash. Unfortunately the code stores
a marker in order to recognize the BBT in the OOB area. This will fail
if the OOB area is completely used for ECC.
This patch introduces the option NAND_USE_FLASH_BBT_NO_OOB which has to be
used with NAND_USE_FLASH_BBT. It will then store BBT on flash without
touching the OOB area. The BBT format on flash remains same except the
first page starts with the recognition pattern followed by the version byte.
This change was tested in nandsim and it looks good so far :)
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
MLC NAND Flash has a different cell structure and differs in
functioning than the SLC NAND Flash. Hence we are considering it as
a different Flash type.
Mike Frysinger [Thu, 23 Sep 2010 02:52:33 +0000 (22:52 -0400)]
jffs2: drop unused model argument
The jffs2 compression framework provides a "model" argument when
compressing and decompressing, but the caller always passes in NULL
and the callees never use it. So punt this useless overhead.
Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Add support for mtd repartition based on the block
device BLKPG interface:
BLKPG_ADD_PARTITION - for partition creation;
BLKPG_DEL_PARTITION - for partition delete
The usage is based on BLKPG ioctl called with
struct blkpg_ioctl_arg argument which includes the
reference to struct blkpg_partition discribing the
partition offset and length.
Disadvantage: there is no implementation for mtd
flags control. The flags are always borrowed from
the master device.
Signed-off-by: Roman Tereshonkov <roman.tereshonkov@nokia.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
This is the same driver submitted by ST Micros SPEAr team but
generalized and tested on the ST-Ericsson U300. It probably
easily works on the NHK8815 too.
mtd: nand_base: do not cache pages with uncorrectable ECC errors
Currently MTD caches the last read NAND page, even if there was an uncorrectable ECC
error. This patch prevents caching in case of uncorrectable ECC errors. The reason
is that we want to allow the user to re-read the NAND page several times. In case of
unstable bits re-trying may help.
Moreover, current behavior is wrong because the first read returns -EBADMSG (correctly)
but the second read succeeds and incorrectly returns 0 (because we read from the cache).
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
mtd: add Broadcom BCM63xx image tag partition parser
This patch adds support for parsing Broadcom BCM63xx image tag format and
creating MTD partitions accordingly. This driver is a platform_device which
can be instantiated accordingly by bcm63xx board support code.
Signed-off-by: Daniel Dickinson <cshore@csolve.net> Signed-off-by: Mike Albon <malbon@openwrt.org> Signed-off-by: Florian Fainelli <florian@openwrt.org> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Dan Carpenter [Wed, 8 Sep 2010 19:39:56 +0000 (21:39 +0200)]
mtd: sanity check ioctl input
If "ur_idx" is wrong we could go past the end of the array. The
"ur_idx" comes from root so it's not a huge deal, but adding a sanity
check makes the code more robust.
Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Roy Zang [Wed, 8 Sep 2010 08:47:55 +0000 (16:47 +0800)]
mtd: fix the build warning for fsl_upm.c
Fix the build warning:
drivers/mtd/nand/fsl_upm.c: In function 'fun_chip_init':
drivers/mtd/nand/fsl_upm.c:190: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'resource_size_t'
Signed-off-by: Roy Zang <tie-fei.zang@freescale.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
mtd: fix almost all checkpatch warnings in nand_base.c
Only 3 warnings are left, one is off by one character, but splitting the line
would reduce the readability. One is for a for loop statement, which would also
not improve readability. The last one is a false positive on a test.
Artem: it is much easier to verify patches against nand_base.c with
checkpatch.pl when nand_base.c itself does not have so many
checkpatch.pl warnings.
Artem: it is much easier to verify patches against nand_base.c with
checkpatch.pl when nand_base.c itself does not have so many
checkpatch.pl warnings.
mtd: m25p80: Add support for two new Spansion SPI devices (S25FL-K)
This patch adds support for Spansion S25FL016K and S25FL064K SPI flash.
It has been tested with physical devices. Note that both parts exhibit
a Winbond manufacturer ID so they might also be added to that section.
Signed-off-by: Gernot Hoyler <Gernot.Hoyler@spansion.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
mtd: nand: split ONFI detection logic to its own function
In order to reduce the indentation and improve the readability of nand_get_
flash_type, split the ONFI detection logic to its own function. The detection
logic inside nand_flash_detect_onfi is also rewritten to allow for less
indentation.
Florian Fainelli [Mon, 30 Aug 2010 16:32:24 +0000 (18:32 +0200)]
mtd: nand: add support for reading ONFI parameters from NAND device
This patch adds support for reading NAND device ONFI parameters and use
the ONFI informations to define its geometry. In case the device supports
ONFI, the onfi_version field in struct nand_chip contains the version (BCD)
and the onfi_params structure can be used by drivers to set up timings and
such. We currently only support ONFI 1.0 parameters.
Signed-off-by: Brian Norris <norris@broadcom.com> Signed-off-by: Matthieu Castet <matthieu.castet@parrot.com> Signed-off-by: Maxime Bizon <mbizon@freebox.fr> Signed-off-by: Florian Fainelli <ffainelli@freebox.fr> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Brian Norris [Fri, 20 Aug 2010 17:50:43 +0000 (10:50 -0700)]
mtd: nand: Samsung MLC - new OOB sizes
There are some additions to the detection scheme used by Samsung
MLC NAND. These simple changes to support the 400- and 436-byte OOB
are found in the following data sheet:
Samsung K9GBG08U0M (p.40)
Signed-off-by: Brian Norris <norris@broadcom.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Dan Carpenter [Tue, 24 Aug 2010 11:56:27 +0000 (13:56 +0200)]
mtd: pcmciamtd: remove dead code
This code isn't reachable. I looked through the git history and it
hasn't been reachable for years. Someone removed the label to silence
gcc's unused label warning but these few lines accidentally got left
behind.
Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Lei Wen [Tue, 17 Aug 2010 09:25:57 +0000 (17:25 +0800)]
mtd: pxa3xx_nand: remove the flash info in driver structure
After probe, all info already transfer to driver structure.
There is no need to keep the original flash info.
So that we could safely free the flash info in memory, which may grows
larger when more flash is suported.
Signed-off-by: Lei Wen <leiwen@marvell.com> Signed-off-by: Haojian Zhuang <haojian.zhuang@marvell.com> Acked-by: Eric Miao <eric.y.miao@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Lei Wen [Wed, 18 Aug 2010 10:00:03 +0000 (18:00 +0800)]
mtd: pxa3xx_nand: introduce default timing to reduce read id times
We certainly don't need to send read id command times by times, since
we already know what the id is after the first read id...
So create a default timing which could ensure it would successfully read
id out all supported chip. Then follow the build-in table to reconfigure
the timing.
Signed-off-by: Lei Wen <leiwen@marvell.com> Signed-off-by: Haojian Zhuang <haojian.zhuang@marvell.com> Acked-by: Eric Miao <eric.y.miao@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Lei Wen [Tue, 17 Aug 2010 05:50:23 +0000 (13:50 +0800)]
mtd: pxa3xx_nand: condense the flash definition
Adding a new flash definition would need less code.
Keep the platform passing flash definition method.
If one flash is both defined in platform data and builtin table,
driver would select the one from platform data first.
By this way, platform could select the timing most suit for itself,
not need to follow the common settings.
Signed-off-by: Lei Wen <leiwen@marvell.com> Signed-off-by: Haojian Zhuang <haojian.zhuang@marvell.com> Acked-by: Eric Miao <eric.y.miao@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Brian Norris [Fri, 20 Aug 2010 19:36:12 +0000 (12:36 -0700)]
mtd: nand: support new Toshiba SLC
Toshiba does not use ONFI for their NAND flash. So we have to continue
to add new IDs used by Toshiba devices as well as heuristic detection
for scanning the 2nd page for a BBM. This is a relatively harmless
start at supporting many of them.
These chips mostly follow the same ID fields of previous generations,
but there is a need for a tweak.
These chips introduce a strange 576 byte OOB (that's 36 bytes per
512 bytes of page). In the preliminary data, Toshiba has not
defined exactly how their ID strings should decode. In the future,
a new tweak must be added.
Data is taken from, among others, Toshiba TC58TxG4S2FBAxx
Signed-off-by: Brian Norris <norris@broadcom.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Remove the MTD!=n dependency since that is handled by drivers/mtd/Kconfig.
Simplify the dependency checks for mtd/chips by using if/endif blocks. Remove
all default n since that is the Kconfig default.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Brian Norris [Mon, 20 Sep 2010 06:57:12 +0000 (23:57 -0700)]
mtd: edit comments on deprecation of ioctl ECCGETLAYOUT
There were some improvements and additions necessary in the
comments explaining of the expansion of nand_ecclayout, the
introduction of nand_ecclayout_user, and the deprecation of the
ioctl ECCGETLAYOUT.
Also, I found a better placement for the macro MTD_MAX_ECCPOS_ENTRIES;
next to the definition of MTD_MAX_OOBFREE_ENTRIES in mtd-abi.h. The macro
is really only important for the ioctl code (found in drivers/mtd/mtdchar.c)
but since there are small edits being made to the user-space header, I
figured this is a better location.
Signed-off-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
struct nand_ecclayout is too small for many new chips; OOB regions can be as
large as 448 bytes and may increase more in the future. Thus, copying that
struct to user-space with the ECCGETLAYOUT ioctl is not a good idea; the ioctl
would have to be updated every time there's a change to the current largest
size.
Instead, the old nand_ecclayout is renamed to nand_ecclayout_user and a
new struct nand_ecclayout is created that can accomodate larger sizes and
expand without affecting the user-space. struct nand_ecclayout can still
be used in board drivers without modification -- at least for now.
A new function is provided to convert from the new to the old in order to
allow the deprecated ioctl to continue to work with truncated data. Perhaps
the ioctl, the conversion process, and the struct nand_ecclayout_user can be
removed altogether in the future.
Note: There are comments in nand/davinci_nand.c::nand_davinci_probe()
regarding this issue; this driver (and maybe others) can be updated to
account for extra space. All kernel drivers can use the expanded
nand_ecclayout as a drop-in replacement and ignore its benefits.
Signed-off-by: Brian Norris <computersforpeace@gmail.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Brian Norris [Thu, 19 Aug 2010 15:11:02 +0000 (08:11 -0700)]
mtd: nand: spansion S30MLxxxP support
Some Spansion chips have a method for determining eraseblock size that
is incompatible with similar ID chips of other sizes. This implements
some heuristic detection of these differences.
This patch checks for a 5-byte ID with trailing zeros as well as a
512-byte page size to ensure that chips are not misdetected as the
S30MLxxxP ORNAND series.
[Tweaked by Artem a bit]
Signed-off-by: Brian Norris <norris@broadcom.com> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
David Howells [Wed, 29 Sep 2010 00:57:02 +0000 (01:57 +0100)]
MN10300: Handle missing sys_cacheflush() when caching disabled
When caching is disabled on the MN10300 arch, the sys_cacheflush()
function is removed by conditional stuff in the makefiles, but is still
referred to by the syscall table.
Provide a null version that just returns 0 when caching is disabled (or
-EINVAL if the arguments are silly).
Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
ahci: fix module refcount breakage introduced by libahci split
libata depends on scsi_host_template for module reference counting and
sht's should be owned by each low level driver. During libahci split,
the sht was left with libahci.ko leaving the actual low level drivers
not reference counted. This made ahci and ahci_platform always
unloadable even while they're being actively used.
Fix it by defining AHCI_SHT() macro in ahci.h and defining a sht for
each low level ahci driver.
stable: only applicable to 2.6.35.
Signed-off-by: Tejun Heo <tj@kernel.org> Reported-by: Pedro Francisco <pedrogfrancisco@gmail.com> Tested-by: Michael Tokarev <mjt@tls.msk.ru> Cc: stable@kernel.org Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (47 commits)
tcp: Fix >4GB writes on 64-bit.
net/9p: Mount only matching virtio channels
de2104x: fix ethtool
tproxy: check for transparent flag in ip_route_newports
ipv6: add IPv6 to neighbour table overflow warning
tcp: fix TSO FACK loss marking in tcp_mark_head_lost
3c59x: fix regression from patch "Add ethtool WOL support"
ipv6: add a missing unregister_pernet_subsys call
s390: use free_netdev(netdev) instead of kfree()
sgiseeq: use free_netdev(netdev) instead of kfree()
rionet: use free_netdev(netdev) instead of kfree()
ibm_newemac: use free_netdev(netdev) instead of kfree()
smsc911x: Add MODULE_ALIAS()
net: reset skb queue mapping when rx'ing over tunnel
br2684: fix scheduling while atomic
de2104x: fix TP link detection
de2104x: fix power management
de2104x: disable autonegotiation on broken hardware
net: fix a lockdep splat
e1000e: 82579 do not gate auto config of PHY by hardware during nominal use
...
This fix is only a workaround. For a real fix, cpu_sibling_mask() should
be defined in UP include code, eg in linux/smp.h, and asm/smp.h should not be
included directly. This fix is currently not possible because asm/smp.h defines
cpu_sibling_mask() unconditionally and is included directly from many source
files.
Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86: Avoid 'constant_test_bit()' misoptimization due to cast to non-volatile
David S. Miller [Tue, 28 Sep 2010 03:24:54 +0000 (20:24 -0700)]
tcp: Fix >4GB writes on 64-bit.
Fixes kernel bugzilla #16603
tcp_sendmsg() truncates iov_len to an 'int' which a 4GB write to write
zero bytes, for example.
There is also the problem higher up of how verify_iovec() works. It
wants to prevent the total length from looking like an error return
value.
However it does this using 'int', but syscalls return 'long' (and
thus signed 64-bit on 64-bit machines). So it could trigger
false-positives on 64-bit as written. So fix it to use 'long'.
Reported-by: Olaf Bonorden <bono@onlinehome.de> Reported-by: Daniel Büse <dbuese@gmx.de> Reported-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Dan Rosenberg [Mon, 27 Sep 2010 16:30:28 +0000 (12:30 -0400)]
Fix pktcdvd ioctl dev_minor range check
The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a
pktcdvd_device from the global pkt_devs array. The index into this
array is provided directly by the user and is a signed integer, so the
comparison to ensure that it falls within the bounds of this array will
fail when provided with a negative index.
This can be used to read arbitrary kernel memory or cause a crash due to
an invalid pointer dereference. This can be exploited by users with
permission to open /dev/pktcdvd/control (on many distributions, this is
readable by group "cdrom").
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
[ Rather than add a cast, just make the function take the right type -Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Howells [Mon, 27 Sep 2010 12:12:33 +0000 (13:12 +0100)]
MN10300: Default config choice GDBSTUB_TTYSM0 should be GDBSTUB_ON_TTYSM0
The configuration choice for the port on which the GDB stub listens has
a default of GDBSTUB_TTYSM0, but this should be GDBSTUB_ON_TTYSM0 to
match the option.
Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Sven Eckelmann [Mon, 27 Sep 2010 22:54:44 +0000 (15:54 -0700)]
net/9p: Mount only matching virtio channels
p9_virtio_create will only compare the the channel's tag characters
against the device name till the end of the channel's tag but not till
the end of the device name. This means that if a user defines channels
with the tags foo and foobar then he would mount foo when he requested
foonot and may mount foo when he requested foobar.
Thus it is necessary to check both string lengths against each other in
case of a successful partial string match.
Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Ondrej Zary [Mon, 27 Sep 2010 11:41:45 +0000 (11:41 +0000)]
de2104x: fix ethtool
When the interface is up, using ethtool breaks it because:
a) link is put down but media_timer interval is not shortened to NO_LINK
b) rxtx is stopped but not restarted
Also manual 10baseT-HD (and probably FD too - untested) mode does not work -
the link is forced up, packets are transmitted but nothing is received.
Changing CSR14 value to match documentation (not disabling link check) fixes this.
Signed-off-by: Ondrej Zary <linux@rainbow-software.org> Acked-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
tcp: fix TSO FACK loss marking in tcp_mark_head_lost
When TCP uses FACK algorithm to mark lost packets in
tcp_mark_head_lost(), if the number of packets in the (TSO) skb is
greater than the number of packets that should be marked lost, TCP
incorrectly exits the loop and marks no packets lost in the skb. This
underestimates tp->lost_out and affects the recovery/retransmission.
This patch fargments the skb and marks the correct amount of packets
lost.
Signed-off-by: Yuchung Cheng <ycheng@google.com> Acked-by: Ilpo Järvinen <ilpo.jarvinen@helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
* master.kernel.org:/home/rmk/linux-2.6-arm: (28 commits)
ARM: 6411/1: vexpress: set RAM latencies to 1 cycle for PL310 on ct-ca9x4 tile
ARM: 6409/1: davinci: map sram using MT_MEMORY_NONCACHED instead of MT_DEVICE
ARM: 6408/1: omap: Map only available sram memory
ARM: 6407/1: mmu: Setup MT_MEMORY and MT_MEMORY_NONCACHED L1 entries
ARM: pxa: remove pr_<level> uses of KERN_<level>
ARM: pxa168fb: clear enable bit when not active
ARM: pxa: fix cpu_is_pxa*() not expanding to zero when not configured
ARM: pxa168: fix corrected reset vector
ARM: pxa: Use PIO for PI2C communication on Palm27x
ARM: pxa: Fix Vpac270 gpio_power for MMC
ARM: 6401/1: plug a race in the alignment trap handler
ARM: 6406/1: at91sam9g45: fix i2c bus speed
leds: leds-ns2: fix locking
ARM: dove: fix __io() definition to use bus based offset
dmaengine: fix interrupt clearing for mv_xor
ARM: kirkwood: Unbreak PCIe I/O port
ARM: Fix build error when using KCONFIG_CONFIG
ARM: 6383/1: Implement phys_mem_access_prot() to avoid attributes aliasing
ARM: 6400/1: at91: fix arch_gettimeoffset fallout
ARM: 6398/1: add proc info for ARM11MPCore/Cortex-A9 from ARM
...
* git://git.infradead.org/iommu-2.6:
intel-iommu: Use symbolic values instead of magic numbers in Lenovo w/a
intel-iommu: Abort IOMMU setup for igfx if BIOS gave no shadow GTT space
Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
x86/amd-iommu: Fix rounding-bug in __unmap_single
x86/amd-iommu: Work around S3 BIOS bug
x86/amd-iommu: Set iommu configuration flags in enable-loop
x86, setup: Fix earlyprintk=serial,0x3f8,115200
x86, setup: Fix earlyprintk=serial,ttyS0,115200
Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
perf, x86: Catch spurious interrupts after disabling counters
tracing/x86: Don't use mcount in kvmclock.c
tracing/x86: Don't use mcount in pvclock.c
Al Viro [Sun, 26 Sep 2010 18:29:02 +0000 (19:29 +0100)]
mn10300: get rid of set_fs(USER_DS) in sigframe setup
It really has no business being there; short of a serious kernel bug
we should already have USER_DS at that point. It shouldn't have been
done on x86 either...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
projects / linux-beck.git / log