Tejun Heo [Fri, 4 Jan 2008 09:42:21 +0000 (18:42 +0900)]
libata: use dev_driver_string() instead of "libata" in libata-sff.c
libata-sff code used DRV_NAME which is hardcoded to "libata" when
requesting resources. Use dev_driver_string() such that low level
driver names are used in resource listing.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Alan Cox [Thu, 25 Oct 2007 13:21:16 +0000 (14:21 +0100)]
libata/pata_it821x: Improve handling of poorly compatible emulations
Some it821x RAID firmwares return 0 for the err return off both devices.
A similar issue occurs with the slave returning 0 not 1 if you plug a
gigabyte sata ramdisk into a controller that fakes two SATA ports as
master/slave on an SFF channel.
The patch does the following
- Allow the 'failed diagnostics' case on both master and slave
- Move the HORKAGE_DIAGNOSTIC check after ->dev_config
This second change also allows IT821x to fix up a problem where we report
drive diagnostic failures when in fact the drive is fine but the
microcontroller firmware doesn't appear to get it right. IT821x clears
the flag again to avoid giving the user bogus warnings about their disk.
The other IT821x change is a bit ugly, we slightly abuse the cable type
hook to fiddle with the identify data for the devices. We could add a new
hook for this but as we have only one offender and no more seeming likely
it seems better to keep libata-core clean.
Please let this sit in -mm briefly, just in case the relaxed checking
breaks some other emulated interface.
Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Tejun Heo [Wed, 5 Dec 2007 07:43:12 +0000 (16:43 +0900)]
libata: make qc->nbytes include extra buffers
qc->nbytes didn't use to include extra buffers setup by libata core
layer and my be odd. This patch makes qc->nbytes include any extra
buffers setup by libata core layer and guaranteed to be aligned on 4
byte boundary.
This value is to be used to program the host controller. As this
represents the actual length of buffer available to the controller and
the controller must be able to deal with short transfers for ATAPI
commands which can transfer variable length, this shouldn't break any
controllers while making problems like rounding-down and controllers
choking up on odd transfer bytes much less likely.
The unmodified value is stored in new field qc->raw_nbytes.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Wed, 5 Dec 2007 07:43:11 +0000 (16:43 +0900)]
libata: convert to chained sg
libata used private sg iterator to handle padding sg. Now that sg can
be chained, padding can be handled using standard sg ops. Convert to
chained sg.
* s/qc->__sg/qc->sg/
* s/qc->pad_sgent/qc->extra_sg[]/. Because chaining consumes one sg
entry. There need to be two extra sg entries. The renaming is also
for future addition of other extra sg entries.
* Padding setup is moved into ata_sg_setup_extra() which is organized
in a way that future addition of other extra sg entries is easy.
* qc->orig_n_elem is unused and removed.
* qc->n_elem now contains the number of sg entries that LLDs should
map. qc->mapped_n_elem is added to carry the original number of
mapped sgs for unmapping.
* The last sg of the original sg list is used to chain to extra sg
list. The original last sg is pointed to by qc->last_sg and the
content is stored in qc->saved_last_sg. It's restored during
ata_sg_clean().
* All sg walking code has been updated. Unnecessary assertions and
checks for conditions the core layer already guarantees are removed.
Tejun Heo [Wed, 5 Dec 2007 07:43:10 +0000 (16:43 +0900)]
libata: change ATA_QCFLAG_DMAMAP semantics
ATA_QCFLAG_DMAMAP was a bit peculiar in that it got set during qc
initialization and cleared if DMA mapping wasn't necessary. Make it
more straight forward by making the following changes.
* Don't set it during initialization. Set it after DMA is actually
mapped.
* Add BUG_ON() to guarantee that there is data to transfer if DMAMAP
is set. This always holds for the current code. The BUG_ON() is
for docummentation and sanity check.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Wed, 5 Dec 2007 07:43:07 +0000 (16:43 +0900)]
libata: update ->data_xfer hook for ATAPI
Depending on how many bytes are transferred as a unit, PIO data
transfer may consume more bytes than requested. Knowing how much
data is consumed is necessary to determine how much is left for
draining. This patch update ->data_xfer such that it returns the
number of consumed bytes.
While at it, it also makes the following changes.
* s/adev/dev/
* use READ/WRITE constants for rw indication
* misc clean ups
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Wed, 5 Dec 2007 07:43:06 +0000 (16:43 +0900)]
libata: add ATAPI_* cmd types and implement atapi_cmd_type()
Add ATAPI command types - ATAPI_READ, WRITE, RW_BUF, READ_CD and MISC,
and implement atapi_cmd_type() which takes SCSI opcode and returns to
which class the opcode belongs. This will be used later to improve
ATAPI handling.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 18 Dec 2007 21:34:43 +0000 (16:34 -0500)]
libata: rename ATA_PROT_ATAPI_* to ATAPI_PROT_*
ATA_PROT_ATAPI_* are ugly and naming schemes between ATA_PROT_* and
ATA_PROT_ATAPI_* are inconsistent causing confusion. Rename them to
ATAPI_PROT_* and make them consistent with ATA counterpart.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Andrew Morton [Fri, 14 Dec 2007 00:01:38 +0000 (16:01 -0800)]
pata_hpt37x: checkpatch fixes
WARNING: line over 80 characters
#70: FILE: drivers/ata/pata_hpt37x.c:850:
+ struct pci_dev *pdev_0 = pci_get_slot(pdev->bus, pdev->devfn - 1);
ERROR: else should follow close brace '}'
#78: FILE: drivers/ata/pata_hpt37x.c:858:
+ }
+ else
total: 1 errors, 1 warnings, 100 lines checked
Your patch has style problems, please review. If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.
Please run checkpatch prior to sending patches
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Andrew Morton [Fri, 14 Dec 2007 00:01:37 +0000 (16:01 -0800)]
drivers/ata/libata-eh.c: fix printk warning
drivers/ata/libata-eh.c: In function `ata_port_pbar_desc':
drivers/ata/libata-eh.c:215: warning: long long unsigned int format, long unsigned int arg (arg 4)
Cc: Jeff Garzik <jeff@garzik.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 18 Dec 2007 07:33:07 +0000 (16:33 +0900)]
pata_amd: update mode selection for NV PATAs
Cable detection on NV PATA hosts isn't implemented and the CBLID-
cable isn't wired according to the sepc either, so both host-side and
generic drive-side cable detections are broken. Till now,
nv_cable_detect() relied on peeking BIOS and ACPI configurations to
upgrade to 80C but this often results in misdetection of 40C cable as
80C. Also, the original implementation was broken in that by the time
BIOS configuration is read it has already been cleared by programming
PIO0 during reset.
This patch reimplements NV mode selection such that...
* BIOS configuration value is stored during driver attach and restored
on detach.
* Cable type is fixed to ATA_CBL_PATA_IGN and mode selection is soley
done by nv_mode_filter() which peeks both BIOS and ACPI
configurations and filter accordingly.
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 18 Dec 2007 07:33:06 +0000 (16:33 +0900)]
libata: reimplement ata_acpi_cbl_80wire() using ata_acpi_gtm_xfermask()
Reimplement ata_acpi_cbl_80wire() using ata_acpi_gtm_xfermask() and
while at it relocate the function below ata_acpi_gtm_xfermask().
New ata_acpi_cbl_80wire() implementation takes @gtm, in both pata_via
and pata_amd, use the initial GTM value. Both are trying to peek
initial BIOS configuration, so using initial caching value makes
sense. This fixes ACPI part of cable detection in pata_amd which
previously always returned 0 because configuring PIO0 during reset
clears DMA configuration.
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 18 Dec 2007 07:33:05 +0000 (16:33 +0900)]
libata: implement ata_timing_cycle2mode() and use it in libata-acpi and pata_acpi
libata-acpi is using separate timing tables for transfer modes
although libata-core has the complete ata_timing table. Implement
ata_timing_cycle2mode() to look for matching mode given transfer type
and cycle duration and use it in libata-acpi and pata_acpi to replace
private timing tables.
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 18 Dec 2007 07:33:03 +0000 (16:33 +0900)]
libata: separate out ata_acpi_gtm_xfermask() from pacpi_discover_modes()
Finding out matching transfer mode from ACPI GTM values is useful for
other purposes too. Separate out the function and timing tables from
pata_acpi::pacpi_discover_modes().
Other than checking shared-configuration bit after doing
ata_acpi_gtm() in pacpi_discover_modes() which should be safe, this
patch doesn't introduce any behavior change.
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:43:48 +0000 (19:43 +0900)]
libata: add ATA_CBL_PATA_IGN
ATA_CBL_PATA_UNK indicates that the cable type can't be determined
from the host side and might be either 80c or 40c. libata applies
drive or other generic limit in this case. However, there are
controllers where both host and drive side detections are
misimplemented and the driver has to rely solely on private method -
peeking BIOS or ACPI configuration or using some other private
mechanism.
This patch adds ATA_CBL_PATA_IGN which tells libata to ignore the
cable type completely and just let the LLD determine the transfer mode
via host transfer mode masks and ->mode_filter().
Signed-off-by: Tejun Heo <htejun@gmail.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:43:41 +0000 (19:43 +0900)]
libata: kill ata_id_to_dma_mode()
ata_id_to_dma_mode() isn't quite generic. The function is basically
privately implemented ata_id_xfermask() combined with hardcoded mode
printing and configuration which are specific to ata_generic.
Kill the function and open code it in generic_set_mode() using generic
xfermode handling functions.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
These functions will be used later by LLD updates. While at it,
change unsigned short @speed to u8 @xfer_mode in
ata_timing_find_mode() for consistency.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:28:59 +0000 (19:28 +0900)]
libata: implement fast speed down for unverified data transfer mode
It's very likely that the configured data transfer mode is the wrong
one if device fails data transfers right after initial data transfer
mode configuration (including NCQ on/off and xfermode). libata EH
needs to speed down fast before upper layers give up on probing.
This patch implement fast speed down rules to handle such cases
better. Error occured while data transfer hasn't been verified
trigger fast back-to-back speed down actions until data transfer
works.
This change will make cable mis-detection and other initial
configuration problems corrected before partition scanning code gives
up.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:28:58 +0000 (19:28 +0900)]
libata: implement ATA_DFLAG_DUBIOUS_XFER
ATA_DFLAG_DUBIOUS_XFER is set whenever data transfer speed or method
changes and gets cleared when data transfer command succeeds in the
newly configured transfer mode.
This will be used to improve speed down logic.
Signed-off-by: Tejun Heo <htejun@gmail.com< Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:28:55 +0000 (19:28 +0900)]
libata: move ata_set_mode() to libata-eh.c
Move ata_set_mode() to libata-eh.c. ata_set_mode() is surely an EH
action and will be more tightly coupled with the rest of error
handling. Move it to libata-eh.c.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Tue, 27 Nov 2007 10:28:54 +0000 (19:28 +0900)]
libata: factor out ata_eh_schedule_probe()
Factor out ata_eh_schedule_probe() from ata_eh_handle_dev_fail() and
ata_eh_recover(). This is to improve maintainability and make future
changes easier.
In the previous revision, ata_dev_enabled() test was accidentally
dropped while factoring out. This problem was spotted by Bartlomiej.
Tejun Heo [Tue, 27 Nov 2007 10:28:53 +0000 (19:28 +0900)]
libata: implement protocol tests
Implement protocol tests - ata_is_atapi(), ata_is_nodata(),
ata_is_pio(), ata_is_dma(), ata_is_ncq() and ata_is_data() and use
them to replace is_atapi_taskfile() and hard coded protocol tests.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Tejun Heo [Mon, 19 Nov 2007 07:03:44 +0000 (16:03 +0900)]
ahci: update PCS programming
For intel ones, ahci unconditionally OR'd 0xf to PCS. This isn't
correct for the following cases.
* ich6/7m's which only implement P0 and P2 (0xf works fine tho)
* ich8/9's which have six ports and needs 0x3f to enable all ports
This patch updates PCS programming such that...
* port_map determined by ahci_save_initial_config() is OR'd instead of 0xf
* PCS is updated only if necessary (there are turned off enable bits)
port_map is determined from PORTS_IMPL PCI register which is
implemented as write or write-once register. If the register isn't
programmed, ahci automatically generates it from number of ports,
which is good enough for PCS programming. ICH6/7M are probably the
only ones where non-contiguous enable bits are necessary && PORTS_IMPL
isn't programmed properly but they're proven to work reliably with 0xf
anyway.
Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Alan Cox [Mon, 19 Nov 2007 14:45:53 +0000 (14:45 +0000)]
pata_ninja32: Cardbus ATA initial support
Lots of work needed to bring it up to scratch but it does work so you can
now use the card. That makes it at least useful, especially as the other
cardbus cards are usually INIC162x which aren't yet supported well.
Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Alan Cox [Mon, 19 Nov 2007 14:34:56 +0000 (14:34 +0000)]
libata-sff: tf_load
Jeff said he preferred that the SFF tf_load followed the spec and we
documented that anyone who needed different overrode it, rather than it
using the ->check_status methods. No driver relies on the current behaviour.
Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Alan Cox [Mon, 19 Nov 2007 14:33:11 +0000 (14:33 +0000)]
libata: IORDY handling
I believe this version meets all Sergei's objections
Correct the logic for when we issue a set features for transfer mode
- If the device has IORDY and the controller has IORDY - set the mode
- If the device has IORDY and the controller does not - turn IORDY off
- If neither has IORDY do nothing
Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Jeff Garzik <jeff@garzik.org>
Shaohua Li [Fri, 2 Nov 2007 01:32:38 +0000 (09:32 +0800)]
libata-acpi: add ACPI _PSx method
ACPI spec (ver 3.0a, p289) requires IDE power on/off executes ACPI _PSx
methods. As recently most PATA drivers use libata, this patch adds _PSx
method support in libata. ACPI spec doesn't mention if SATA requires the
same _PSx method.
Signed-off-by: Shaohua Li <shaohua.li@intel.com> Acked-by: Len Brown <len.brown@intel.com> Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
Alan Cox [Mon, 5 Nov 2007 03:05:49 +0000 (22:05 -0500)]
libata: Disable ATA8-ACS proposed Trusted Computing features by default
Historically word 48 in the identify data was used to mean 32bit I/O
was supported for VLB IDE etc. ATA8 reassigns this word to the Trusted
Computing Group, where it is used for TCG features. This means that
an ATA8 TCG drive is going to trigger 32bit I/O on some systems which
will be funny.
Anyway we need to sort this out ready for ATA8 so:
- Reorder the ata.h header a bit so the ata_version function occurs early
in it
- Make dword_io check the ATA version
- Add an ATA8 version checking TCG presence test
While we are at it the current drafts have a flaw where it may not be
possible to disable TCG features at boot (and opt out of the trusted
model) as TCG intends because it relies on presence of a different
optional feature (DCS). Handle this in software by refusing the TCG
commands if libata.allow_tpm is not set. (We must make it possible
as some environments such as proprietary VDR devices will doubtless
want to use it to lock up content)
Finally as with CPRM print a warning so that the user knows they may
not be able to full access and use the device.
Jordan Crouse [Tue, 22 Jan 2008 22:30:16 +0000 (23:30 +0100)]
x86: GEODE fix a race condition in the MFGPT timer tick
When we set the MFGPT timer tick, there is a chance that we'll
immediately assert an event. If for some reason the IRQ routing
for this clock has been setup for some other purpose, then we
could end up firing an interrupt into the SMM handler or worse.
This rearranges the timer tick init function to initalize the handler
before we set up the MFGPT clock to make sure that even if we get
an event, it will go to the handler.
Furthermore, in the handler we need to make sure that we clear the
event, even if the timer isn't running.
Signed-off-by: Jordan Crouse <jordan.crouse@amd.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Ingo Molnar <mingo@elte.hu> Tested-by: Arnd Hannemann <hannemann@i4.informatik.rwth-aachen.de>
Fix typo in arch/powerpc/boot/flatdevtree_env.h.
There is no Documentation/networking/ixgbe.txt.
README.cycladesZ is now in Documentation/.
wavelan.p.h is now in drivers/net/wireless/.
HFS.txt is now Documentation/filesystems/hfs.txt.
OSS-files are now in sound/oss/.
Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net> Acked-by: Randy Dunlap <randy.dunlap@oracle.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
David Fries [Tue, 22 Jan 2008 11:31:39 +0000 (03:31 -0800)]
W1: w1_therm.c is flagging 0C etc as invalid
The extra rom[0] check is flagging valid temperatures as invalid when
there is already a CRC data transmission check.
w1_therm_read_bin()
if (rom[8] == crc && rom[0])
verdict = 1;
Requiring rom[0] to be non-zero will flag as invalid temperature
conversions when the low byte is zero, specifically the temperatures 0C,
16C, 32C, 48C, -16C, -32C, and -48C.
The CRC check is produced on the device for the previous 8 bytes and is
required to ensure the data integrity in transmission. I don't see why the
extra check for rom[0] being non-zero is in there. Evgeniy Polyakov didn't
know either. Just for a check I unplugged the sensor, executed a
temperature conversion, and read the results. The read was all ff's, which
also failed the CRC, so it doesn't need to protect against a disconnected
sensor.
I have more extensive patches in the work, but these two trivial ones will
do for today. I would like to hear from people who use the ds2490 USB to
one wire dongle. 1 if you would be willing to test the patches as I
currently only have the one sensor on a short parisite powered wire, 2 if
there is any cheap sources for the ds2490.
Signed-off-by: David Fries <david@fries.net> Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Correct the decoding of negative C temperatures. The code did a binary OR
of two bytes to make a 16 bit value, but assignd it to an integer. This
caused the value to not be sign extended and to loose that it was a
negative number in the assignment.
Before the patch (in my freezer),
w1_slave
ed fe 4b 46 7f ff 03 10 e4 : crc=e4 YES
ed fe 4b 46 7f ff 03 10 e4 t=4078
With the patch,
e3 fe 4b 46 7f ff 0d 10 81 : crc=81 YES
e3 fe 4b 46 7f ff 0d 10 81 t=-17
Signed-off-by: David Fries <david@fries.net> Acked-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bjorn Helgaas [Tue, 22 Jan 2008 12:21:03 +0000 (07:21 -0500)]
hwmon: (it87) request only Environment Controller ports
The IT8705F and related parts are Super I/O controllers that contain
many separate devices.
Some BIOSes describe IT8705F I/O port usage under a motherboard device
(PNP0C02) with overlapping regions, e.g., 0x290-0x29f and 0x290-0x294.
The it87 driver supports only the Environment Controller, which requires
only two ISA ports, but it used to request an eight-port range. If that
range exceeds a range reported by the BIOS, as 0x290-0x297 would, the
request fails, and the it87 driver cannot claim the device.
This patch makes the it87 driver request only the two ports used for the
Environment Controller device.
Systems where this problem has been reported:
Gigabyte GA-K8N Ultra 9
Gigabyte M56S-S3
Gigabyte GA-965G-DS3
The patch above increases the number of PNP port resources we support.
Prior to this patch, we ignored some port resources, which masked the
it87 problem.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com> Signed-off-by: Mark M. Hoffman <mhoffman@lightlink.com>
It tried to fix long standing bugzilla entries, but the solution was
reported to break other systems. The reporter of
http://bugzilla.kernel.org/show_bug.cgi?id=9791
tracked it down to this commit and confirmed that reverting the patch
restores the correct behaviour. It's too late in the release cycle to
find a better solution than reverting the commit to avoid regressions.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Ingo Molnar <mingo@elte.hu>
Linus Torvalds [Tue, 22 Jan 2008 03:40:05 +0000 (19:40 -0800)]
Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
tc35815: Use irq number for tc35815-mac platform device id
[MIPS] Malta: Fix reading the PCI clock frequency on big-endian
[MIPS] SMTC: Fix build error.
Andrew G. Morgan [Tue, 22 Jan 2008 01:18:30 +0000 (17:18 -0800)]
Fix filesystem capability support
In linux-2.6.24-rc1, security/commoncap.c:cap_inh_is_capped() was
introduced. It has the exact reverse of its intended behavior. This
led to an unintended privilege esculation involving a process'
inheritable capability set.
To be exposed to this bug, you need to have Filesystem Capabilities
enabled and in use. That is:
- CONFIG_SECURITY_FILE_CAPABILITIES must be defined for the buggy code
to be compiled in.
- You also need to have files on your system marked with fI bits raised.
Signed-off-by: Andrew G. Morgan <morgan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@akpm@linux-foundation.org>
Stefan Schmidt [Tue, 22 Jan 2008 01:18:27 +0000 (17:18 -0800)]
s3c2410_fb: fix line length calculation
Fix line length calculation. var->width is the size of the display in mm. We
like to use the pixel size.
Without this fix, dynamic (fbset) based resolution and depths changes with
s3c2410_fb don't work at all.
Spotted by john cass <johnpcass@yahoo.com>
Signed-off-by: Stefan Schmidt <stefan@openmoko.org> Signed-off-by: Harald Welte <laforge@openmoko.org> Acked-by: Ben Dooks <ben-linux@fluff.org> Acked-by: Arnaud Patard <arnaud.patard@rtp-net.org> Acked-by: Krzysztof Helt <krzysztof.h1@wp.pl> Cc: "Antonino A. Daplas" <adaplas@pol.net> Cc: Russell King <rmk@arm.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@akpm@linux-foundation.org>
Randy Dunlap [Tue, 22 Jan 2008 01:18:25 +0000 (17:18 -0800)]
timer: fix section mismatch
The caller is __cpuinit.
Also, this code block and its caller are inside #ifdef CONFIG_HOTPLUG_CPU
blocks, so this code should reflect that config symbol's usage.
WARNING: vmlinux.o(.text+0x4252f): Section mismatch: reference to .init.text: (between 'timer_cpu_notify' and 'msleep')
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: Sam Ravnborg <sam@ravnborg.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@akpm@linux-foundation.org>
Alan Cox [Tue, 22 Jan 2008 01:18:24 +0000 (17:18 -0800)]
keyspan: fix oops
If we get a data URB back from the hardware after we have put the tty to
bed we go kaboom. Fortunately all we need to do is process the URB without
trying to ram its contents down the throat of an ex-tty.
Signed-off-by: Alan Cox <alan@redhat.com> Cc: Greg KH <greg@kroah.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@akpm@linux-foundation.org>
Atsushi Nemoto [Fri, 18 Jan 2008 16:15:52 +0000 (01:15 +0900)]
tc35815: Use irq number for tc35815-mac platform device id
The tc35815-mac platform device used a pci bus number and a devfn to
identify its target device, but the pci bus number may vary if some
bus-bridges are found. Use irq number which is be unique for embedded
controllers.
Dmitri Vorobiev [Mon, 14 Jan 2008 21:27:46 +0000 (00:27 +0300)]
[MIPS] Malta: Fix reading the PCI clock frequency on big-endian
The JMPRS register on Malta boards keeps a 32-bit CPU-endian
value. The readw() function assumes that the value it reads is a
little-endian 16-bit number. Therefore, using readw() to obtain
the value of the JMPRS register is a mistake. This error leads
to incorrect reading of the PCI clock frequency on big-endian
during board start-up.
Change readw() to __raw_readl().
This was tested by injecting a call to printk() and verifying
that the value of the jmpr variable was consistent with current
setting of the JP4 "PCI CLK" jumper.
Signed-off-by: Dmitri Vorobiev <dmitri.vorobiev@gmail.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
In that patch, David L added a icmp_out_count() in
ip_push_pending_frames(), remove icmp_out_count() from
icmp_reply(). But he forgot to remove icmp_out_count() from
icmp_send() too. Since icmp_send and icmp_reply will call
icmp_push_reply, which will call ip_push_pending_frames, a duplicated
increment happened in icmp_send.
This patch remove the icmp_out_count from icmp_send too.
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Wang Chen [Mon, 21 Jan 2008 11:05:43 +0000 (03:05 -0800)]
[IPV6]: RFC 2011 compatibility broken
The snmp6 entry name was changed, and it broke compatibility
to RFC 2011.
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Wang Chen [Mon, 21 Jan 2008 11:04:47 +0000 (03:04 -0800)]
[IPV6]: ICMP6_MIB_OUTMSGS increment duplicated
icmpv6_send() calls ip6_push_pending_frames() indirectly.
Both ip6_push_pending_frames() and icmpv6_send() increment
counter ICMP6_MIB_OUTMSGS.
This patch remove the increment from icmpv6_send.
Signed-off-by: Wang Chen <wangchen@cn.fujitsu.com> Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Patrick McHardy [Mon, 21 Jan 2008 01:25:14 +0000 (17:25 -0800)]
[NET]: rtnl_link: fix use-after-free
When unregistering the rtnl_link_ops, all existing devices using
the ops are destroyed. With nested devices this may lead to a
use-after-free despite the use of for_each_netdev_safe() in case
the upper device is next in the device list and is destroyed
by the NETDEV_UNREGISTER notifier.
The easy fix is to restart scanning the device list after removing
a device. Alternatively we could add new devices to the front of
the list to avoid having dependant devices follow the device they
depend on. A third option would be to only restart scanning if
dev->iflink of the next device matches dev->ifindex of the current
one. For now this seems like the safest solution.
With this patch, the veth rtnl_link_ops unregistration can use
rtnl_link_unregister() directly since it now also handles destruction
of multiple devices at once.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
Jesper Juhl [Mon, 21 Jan 2008 00:58:04 +0000 (16:58 -0800)]
[IrDA]: af_irda memory leak fixes
Here goes an IrDA patch against your latest net-2.6 tree.
This patch fixes some af_irda memory leaks. It also checks for
irias_new_obect() return value.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Samuel Ortiz <samuel@sortiz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
David S. Miller [Mon, 21 Jan 2008 00:39:03 +0000 (16:39 -0800)]
[NEIGH]: Revert 'Fix race between neigh_parms_release and neightbl_fill_parms'
Commit 9cd40029423701c376391da59d2c6469672b4bed (Fix race between
neigh_parms_release and neightbl_fill_parms) introduced device
reference counting regressions for several people, see:
http://bugzilla.kernel.org/show_bug.cgi?id=9778
for example.
Signed-off-by: David S. Miller <davem@davemloft.net>
When packets are flood-forwarded to multiple output devices, the
bridge-netfilter code reuses skb->nf_bridge for each clone to store
the bridge port. When queueing packets using NFQUEUE netfilter takes
a reference to skb->nf_bridge->physoutdev, which is overwritten
when the packet is forwarded to the second port. This causes
refcount unterflows for the first device and refcount leaks for all
others. Additionally this provides incorrect data to the iptables
physdev match.
Unshare skb->nf_bridge by copying it if it is shared before assigning
the physoutdev device.
Reported, tested and based on initial patch by
Jan Christoph Nordholz <hesso@pool.math.tu-berlin.de>.
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
[IPV6] ROUTE: Make sending algorithm more friendly with RFC 4861.
We omit (or delay) sending NSes for known-to-unreachable routers (in
NUD_FAILED state) according to RFC 4191 (Default Router Preferences
and More-Specific Routes). But this is not fully compatible with RFC
4861 (Neighbor Discovery Protocol for IPv6), which does not remember
unreachability of neighbors.
So, let's avoid mixing sending algorithm of RFC 4191 and that of RFC
4861, and make the algorithm more friendly with RFC 4861 if RFC 4191
is disabled.
Issue was found by IPv6 Ready Logo Core Self_Test 1.5.0b2 (by TAHI
Project), and has been tracked down by Mitsuru Chinen
<mitch@linux.vnet.ibm.com>.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Eric Dumazet [Fri, 18 Jan 2008 12:30:21 +0000 (04:30 -0800)]
[IPV4] FIB_HASH : Avoid unecessary loop in fn_hash_dump_zone()
I noticed "ip route list" was slower than "cat /proc/net/route" on a
machine with a full Internet routing table (214392 entries : Special
thanks to Robert ;) )
David S. Miller [Fri, 18 Jan 2008 12:21:39 +0000 (04:21 -0800)]
[NET]: Fix interrupt semaphore corruption in Intel drivers.
Several of the Intel ethernet drivers keep an atomic counter used to
manage when to actually hit the hardware with a disable or an enable.
The way the net_rx_work() breakout logic works during a pending
napi_disable() is that it simply unschedules the poll even if it
still has work.
This can potentially leave interrupts disabled, but that is OK
because all of the drivers are about to disable interrupts
anyways in all such code paths that do a napi_disable().
Unfortunately, this trips up the semaphore used here in the Intel
drivers. If you hit this case, when you try to bring the interface
back up it won't enable interrupts. A reload of the driver module
fixes it of course.
So what we do is make sure all the sequences now go:
Russell King [Sun, 20 Jan 2008 10:18:12 +0000 (10:18 +0000)]
Merge branch 'omap-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6
* 'omap-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
ARM: OMAP1: Fix compile for board-nokia770
ARM: OMAP1: Keymap fix for f-sample and p2-sample
Dan Williams [Fri, 18 Jan 2008 22:26:10 +0000 (23:26 +0100)]
[ARM] 4748/1: dca: source drivers/dca/Kconfig in arch/arm/Kconfig to fix warning
'select' used by config symbol 'INTEL_IOATDMA' refers to undefined symbol 'DCA'
Although drivers/dma is currently the only user future drivers outside of
drivers/dma may select this option so it is better to add this to
arch/arm/Kconfig than move DCA to drivers/dma/Kconfig.
Signed-off-by: Dan Williams <dan.j.williams@intel.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Russell King [Fri, 11 Jan 2008 12:23:58 +0000 (12:23 +0000)]
[ARM] pxa: don't rely on r2 being preserved over a function call
r2 is not guaranteed to be preserved over a function call, so relying
on it to store the link register over the call to sleep_phys_sp() is
unreliable. Store the link register on the stack instead.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Rusty Russell [Sun, 20 Jan 2008 00:54:18 +0000 (11:54 +1100)]
Remove bogus duplicate CONFIG_LGUEST_GUEST entry.
It was moved to arch/x86/lguest/Kconfig, but I lost the deletion part in a
patch suffle. My confused one-liner "fix" to turn it on is also reverted: 84f7466ee20cc094aa38617abfa2f3834871f054
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Alan Cox [Sat, 19 Jan 2008 15:51:26 +0000 (15:51 +0000)]
pata_pdc202xx_old: Fix crashes with ATAPI
The PDC202xx older devices do not support ATAPI DMA via the usual
interfaces. What documentation I have isn't sufficient to support DMA and
it isn't clear if the Windows drivers do this or it is possible at all.
(Neither do the drivers/ide old drivers)
So turn it ATAPI DMA off, these are disk optimised controllers.
Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
projects / linux-2.6 / log