Patrick McHardy [Tue, 10 Jan 2006 00:44:00 +0000 (16:44 -0800)]
[NETFILTER]: Fix another crash in ip_nat_pptp
The PPTP NAT helper calculates the offset at which the packet needs
to be mangled as difference between two pointers to the header. With
non-linear skbs however the pointers may point to two seperate buffers
on the stack and the calculation results in a wrong offset beeing
used.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Tue, 10 Jan 2006 00:43:43 +0000 (16:43 -0800)]
[NETFILTER]: Fix crash in ip_nat_pptp
When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to
calculate the offset in the packet which needs to be mangled
and corrupts random memory or crashes.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
The congestion ops and af_ops in the inet_connection_sock
can be const.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Greg Ungerer [Tue, 10 Jan 2006 07:00:39 +0000 (17:00 +1000)]
[PATCH] m68knommu: fix find_next_zero_bit in bitops.h
We're starting a number of big applications (memory footprint app.
1MByte) on our Arcturus uC5272. Therefore memory fragmentation is a
real pain for us. We've switched to uClinux-2.4.27-uc1 and found that
page_alloc2 fragments the memory heavily.
Digging into it we found a bug in the find_next_zero_bit function in the
m68knommu/bitops.h file. if the size isn't a multiple of 32 than the
upper bits of the last word to be searched should be masked. But the
functions masks the lower bits of the last word because it uses a right
shift instead of a left shift operator.
Patch submitted by Sascha Smejkal <s.smejkal@centersystems.at>
Greg Ungerer [Tue, 10 Jan 2006 06:59:37 +0000 (16:59 +1000)]
[PATCH] uclinux: delay binfmt_flat trace
Modify the initial trace output (which is based on flags in the binary
header) so that it is not done until after the magic number check. This
may well not be a flat format binary, so the flags could be invalid.
(Prime example, running a script).
Greg Ungerer [Tue, 10 Jan 2006 06:59:04 +0000 (16:59 +1000)]
[PATCH] m68knommu: set irq priority/level different for each ColdFire serial port
Set the hardware interrupt priority to a different value for each
attached ColdFire serial port. According to the CPU documentation you
should not use the same combination of level/priority on more than one
device. People have reported odd serial port behavior with them set the
same.
Greg Ungerer [Tue, 10 Jan 2006 06:42:59 +0000 (16:42 +1000)]
[PATCH] m68knommu: fix a5 reg corruption in signal handlers
This is a patch adapted from a posting by Andrea Tarani which was
pointed out to me by Bernardo Innocenti. Thanks to both of them for
their help and patience.
The original posting is here:
http://mailman.uclinux.org/pipermail/uclinux-dev/2005-July/033543.html
The problem first manifest itself as busybox ping terminating with an
"Illegal instruction". I reduced this to a test case and found that
variable size arrays allocated on the stack could lead to stacks not
aligned on 32 bit boundaries. For the Coldfire this proved fatal.
Having been pointed out this patch by Bernardo, I applied it and it
fixed the first test case. I then went back to busybox's ping. This
still failed with "Illegal instruction", but in a different way. Before
it depended on the size allocated for the ping buffer, now it happened
every time. I also found it depended on optimisation level (gcc-3.4.0)
-Os was okay but not -O2.
After a lot of looking, it turned out that register a5 was being
corrupted by the signal handler (after applying the patch). I re-worked
the patch a bit to save/restore a5 and now all seems well.
Patch submitted by Stuart Hughs <stuarth@freescale.com>
Linus Torvalds [Tue, 10 Jan 2006 16:56:39 +0000 (08:56 -0800)]
Fix rpc shutdown event condition bug
We want to wait for the cl_users to go down to zero, not for it to stay
positive. Quoth Trond (who wasn't even the author, but acked the wrong
version): "Argh! I need to increase my daily caffeine dosages."
Oleg Nesterov [Tue, 10 Jan 2006 13:48:02 +0000 (16:48 +0300)]
[PATCH] rcu: join rcu_ctrlblk and rcu_state
This patch moves rcu_state into the rcu_ctrlblk. I think there
are no reasons why we should have 2 different variables to control
rcu state. Every user of rcu_state has also "rcu_ctrlblk *rcp" in
the parameter list.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Acked-by: Paul E. McKenney <paulmck@us.ibm.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jens Axboe [Tue, 10 Jan 2006 09:48:02 +0000 (10:48 +0100)]
[PATCH] dm: don't enable bouncing by default
DM doesn't need to bounce bio's on its own, but the block layer defaults
to that in blk_queue_make_request(). The lower level drivers should
bounce ios themselves, that is what they need to do if not layered below
dm anyways.
Anton Blanchard [Tue, 10 Jan 2006 07:21:20 +0000 (18:21 +1100)]
[PATCH] Work around ppc64 compiler bug
In the process of optimising our per cpu data code, I found a ppc64
compiler bug that has been around forever. Basically the current
RELOC_HIDE can end up trashing r30. Details of the bug can be found at
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=25572
This bug is present in all compilers before 4.1. It is masked by the
fact that our current per cpu data code is inefficient and causes
other loads that end up marking r30 as used.
A workaround identified by Alan Modra is to use the =r asm constraint
instead of =g.
Signed-off-by: Anton Blanchard <anton@samba.org>
[ Verified that this makes no real difference on x86[-64] */ Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jiri Slaby [Tue, 10 Jan 2006 04:54:24 +0000 (20:54 -0800)]
[PATCH] char/isicom: Pci probing added
Pci probing functions added, most of functions rewrited because of it (some
for loops were redundant). Used PCI_DEVICE macro. dev_* used for printing
wherever possible. Renamed some functions to have isicom_ in the name.
Jiri Slaby [Tue, 10 Jan 2006 04:54:23 +0000 (20:54 -0800)]
[PATCH] char/isicom: Other little changes
Move some code from one place to another. Get rid of ugly ifdefs in code in
next p[patches, so here create functions and macros to enable it. Rename some
functions and align some code to 80 chars.
Alan Cox [Tue, 10 Jan 2006 04:54:13 +0000 (20:54 -0800)]
[PATCH] TTY layer buffering revamp
The API and code have been through various bits of initial review by
serial driver people but they definitely need to live somewhere for a
while so the unconverted drivers can get knocked into shape, existing
drivers that have been updated can be better tuned and bugs whacked out.
This replaces the tty flip buffers with kmalloc objects in rings. In the
normal situation for an IRQ driven serial port at typical speeds the
behaviour is pretty much the same, two buffers end up allocated and the
kernel cycles between them as before.
When there are delays or at high speed we now behave far better as the
buffer pool can grow a bit rather than lose characters. This also means
that we can operate at higher speeds reliably.
For drivers that receive characters in blocks (DMA based, USB and
especially virtualisation) the layer allows a lot of driver specific
code that works around the tty layer with private secondary queues to be
removed. The IBM folks need this sort of layer, the smart serial port
people do, the virtualisers do (because a virtualised tty typically
operates at infinite speed rather than emulating 9600 baud).
Finally many drivers had invalid and unsafe attempts to avoid buffer
overflows by directly invoking tty methods extracted out of the innards
of work queue structs. These are no longer needed and all go away. That
fixes various random hangs with serial ports on overflow.
The other change in here is to optimise the receive_room path that is
used by some callers. It turns out that only one ldisc uses receive room
except asa constant and it updates it far far less than the value is
read. We thus make it a variable not a function call.
I expect the code to contain bugs due to the size alone but I'll be
watching and squashing them and feeding out new patches as it goes.
Because the buffers now dynamically expand you should only run out of
buffering when the kernel runs out of memory for real. That means a lot of
the horrible hacks high performance drivers used to do just aren't needed any
more.
Description:
tty_insert_flip_char is an old API and continues to work as before, as does
tty_flip_buffer_push() [this is why many drivers dont need modification]. It
does now also return the number of chars inserted
There are also
tty_buffer_request_room(tty, len)
which asks for a buffer block of the length requested and returns the space
found. This improves efficiency with hardware that knows how much to
transfer.
and tty_insert_flip_string_flags(tty, str, flags, len)
to insert a string of characters and flags
For a smart interface the usual code is
len = tty_request_buffer_room(tty, amount_hardware_says);
tty_insert_flip_string(tty, buffer_from_card, len);
More description!
At the moment tty buffers are attached directly to the tty. This is causing a
lot of the problems related to tty layer locking, also problems at high speed
and also with bursty data (such as occurs in virtualised environments)
I'm working on ripping out the flip buffers and replacing them with a pool of
dynamically allocated buffers. This allows both for old style "byte I/O"
devices and also helps virtualisation and smart devices where large blocks of
data suddenely materialise and need storing.
So far so good. Lots of drivers reference tty->flip.*. Several of them also
call directly and unsafely into function pointers it provides. This will all
break. Most drivers can use tty_insert_flip_char which can be kept as an API
but others need more.
At the moment I've added the following interfaces, if people think more will
be needed now is a good time to say
int tty_buffer_request_room(tty, size)
Try and ensure at least size bytes are available, returns actual room (may be
zero). At the moment it just uses the flipbuf space but that will change.
Repeated calls without characters being added are not cumulative. (ie if you
call it with 1, 1, 1, and then 4 you'll have four characters of space. The
other functions will also try and grow buffers in future but this will be a
more efficient way when you know block sizes.
int tty_insert_flip_char(tty, ch, flag)
As before insert a character if there is room. Now returns 1 for success, 0
for failure.
int tty_insert_flip_string(tty, str, len)
Insert a block of non error characters. Returns the number inserted.
int tty_prepare_flip_string(tty, strptr, len)
Adjust the buffer to allow len characters to be added. Returns a buffer
pointer in strptr and the length available. This allows for hardware that
needs to use functions like insl or mencpy_fromio.
Signed-off-by: Alan Cox <alan@redhat.com> Cc: Paul Fulghum <paulkf@microgate.com> Signed-off-by: Hirokazu Takata <takata@linux-m32r.org> Signed-off-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: Jeff Dike <jdike@addtoit.com> Signed-off-by: John Hawkes <hawkes@sgi.com> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Paul Jackson [Tue, 10 Jan 2006 04:54:08 +0000 (20:54 -0800)]
[PATCH] Serial: disable jsm in ppc64 defconfig
Changes to the serial driver to remove flip buffers have broken the serial
jsm driver. It doesn't even compile anymore. The jsm driver was enabled
in only one defconfig - ppc64. In order to keep defconfigs building,
disable CONFIG_SERIAL_JSM for the time being.
Signed-off-by: Paul Jackson <pj@sgi.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Adrian Bunk [Tue, 10 Jan 2006 04:54:06 +0000 (20:54 -0800)]
[PATCH] fs/ext3/: small cleanups
This patch contains the following cleanups:
- there's no need for ext3_count_free() #ifndef EXT3FS_DEBUG
- having prototypes for ext3_count_free() in two different headers is
nonsense
Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Adrian Bunk [Tue, 10 Jan 2006 04:54:04 +0000 (20:54 -0800)]
[PATCH] drivers/video/: possible cleanups
This patch contains the possible cleanups including the following:
- every file should #include the headers containing the prototypes for
it's global functions
- make needlessly global functions static
- kyro/STG4000Interface.h: #include video/kyro.h and linux/pci.h
instead of a manual "struct pci_dev"
- i810_main.{c,h}: prototypes for static functions belong to the
C file
Signed-off-by: Adrian Bunk <bunk@stusta.de> Acked-by: "Antonino A. Daplas" <adaplas@hotpop.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Jesper Juhl [Tue, 10 Jan 2006 04:54:01 +0000 (20:54 -0800)]
[PATCH] turn "const static" into "static const"
ICC likes to complain about storage class not being first, GCC doesn't
care much (except for cases like "inline static").
have a hard time seeing how it could break anything.
Thanks to Gabriel A. Devenyi for pointing out
http://linuxicc.sourceforge.net/ which is what made me create this patch.
Martin Waitz [Tue, 10 Jan 2006 04:53:55 +0000 (20:53 -0800)]
[PATCH] DocBook: warn for missing macro parameters
Previously kernel-doc silently ignored missing parameter descriptions for
preprocessor macros. Now that all such omissions are fixed up we can warn
about them in kernel-doc to be able to keep it that way.
Signed-off-by: Martin Waitz <tali@admingilde.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Ville Syrjala [Tue, 10 Jan 2006 04:53:49 +0000 (20:53 -0800)]
[PATCH] Fix console blanking
Current console blanking code is broken. It will first do a normal blank,
then start the VESA blank timer if vesa_off_interval != 0, and then proceed
to do the VESA blanking directly. After the timer expires it will do the
VESA blanking a second time. Also the vesa_powerdown() function doesn't
allow all VESA modes to be used.
With this patch the behaviour is:
1. Blank: vesa_off_interval != 0 -> Do normal blank
vesa_off_interval == 0 -> Do VESA blank
2. Start the VESA blank timer if vesa_off_interval != 0 and
vesa_power_mode != 0.
It also gets rid of the limiting vesa_powerdown() function.
Signed-off-by: Ville Syrjala <syrjala@sci.fi> Cc: "Antonino A. Daplas" <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Thomas Koeller [Tue, 10 Jan 2006 04:53:48 +0000 (20:53 -0800)]
[PATCH] non-linear frame buffer read/write access
While the code in fbmem.c allows for hooking read/write access to
non-linear frame buffers by means of fb_read and fb_write in struct fb_ops,
I could not find a way tho access the actual frame buffer memory from
within these routines. I therefore had to patch fbmem.c, to be able to
retrieve a pointer to struct fb_info from the 'file' argument to these
functions.
The second hunk of the patch is not strictly required, I only did that for
symmetry reasons (and the code is somewhat shorter).
Signed-off-by: Thomas Koeller <thomas@koeller.dyndns.org> Acked-by: "Antonino A. Daplas" <adaplas@gmail.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
- replace kmalloc with kzalloc
- remove repeated define (FONTCHHCNT)
- remove unneeded local variable (redraw) in ypan_{up|down}_redraw
- add and delete cursor timer in fbcon_switch() if old_info != info
Arnaud Patard [Tue, 10 Jan 2006 04:53:41 +0000 (20:53 -0800)]
[PATCH] s3c2410fb: cleanup and fix
Here are some cleanups for the s3c2410fb drivers. It :
* Removes a buggy call to s3c2410fb_init_registers. There was two calls
to this function but the first was done without all initialisations
done. No oops but it may confuse some LCDs.
* Makes two functions static.
[PATCH] fbdev: Fix return code of fb_read and fb_write
Make fb_read() and fb_write() return 0 (EOF) instead of -ENOSPC if reading at
or past the end of the framebuffer. This fixes user space apps hanging if
info->fix.smem_len == 0.
Knut Petersen [Tue, 10 Jan 2006 04:53:36 +0000 (20:53 -0800)]
[PATCH] fbcon: disable ywrap if not supported by fbcon scrolling code
updatescrollmode() must not select ywrap scrolling if
divides(vc->vc_font.height, yres) is not true as this is not supported by
the actual ywrap scrolling code.
The bug is triggered with e.g. mode 800x600, vxres 1024, vyres 8192, bpp
8, font dimensions 8x16, 8Mb video ram and FBINFO_HWACCEL_YWRAP set. If
those conditions are met, scrolling is broken and garbage is permanently
displayed at the bottom of the screen.
No regression, no possible side effects.
Definitely needed by cyblafb and probably needed by amifb.
Ville Syrjälä [Tue, 10 Jan 2006 04:53:32 +0000 (20:53 -0800)]
[PATCH] atyfb: LT/LG cleanup
Clean up LT and LG chip descriptions.
"Mach64 LG" is called 3D Rage LT in the specs and ATI press releases.
"Mach64 LT" is unclear. XFree86 driver doesn't know this chip at all.
Windows display.inf calls it just "mach64 LT" and it uses the same driver as
VT-A/GT-A and older chips. VT-B/GT-B and better use another driver and all of
those chips have a more descriptive name in the display.inf file. That makes
me think this chip is not a 3D Rage chip.
Signed-off-by: Ville Syrjälä <syrjala@sci.fi> Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
- remove unneeded casts
- make setcolreg return success if regno > 15, but don't do anything
- use framebuffer_alloc/framebuffer_release to allocate/free memory
projects / linux-beck.git / log