Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.25-r4/0109-2.6.25.10-all-fixes.patch

    Annotation of /trunk/kernel26-magellan/patches-2.6.25-r4/0109-2.6.25.10-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 664 - (hide annotations) (download)
    Thu Jul 10 13:03:47 2008 UTC (15 years, 10 months ago) by niro
    File size: 15530 byte(s) 
    -2.6.25-magellan-r4; updated to linux-2.6.25.10
    1 niro 664 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
    2     index d2e39e6..5f04579 100644
    3     --- a/arch/x86/kernel/i387.c
    4     +++ b/arch/x86/kernel/i387.c
    5     @@ -130,7 +130,7 @@ int xfpregs_get(struct task_struct *target, const struct user_regset *regset,
    6     void *kbuf, void __user *ubuf)
    7     {
    8     if (!cpu_has_fxsr)
    9     - return -ENODEV;
    10     + return -EIO;
    11    
    12     init_fpu(target);
    13    
    14     @@ -145,7 +145,7 @@ int xfpregs_set(struct task_struct *target, const struct user_regset *regset,
    15     int ret;
    16    
    17     if (!cpu_has_fxsr)
    18     - return -ENODEV;
    19     + return -EIO;
    20    
    21     init_fpu(target);
    22     set_stopped_child_used_math(target);
    23     diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
    24     index 9003e0b..a10ba65 100644
    25     --- a/arch/x86/kernel/ptrace.c
    26     +++ b/arch/x86/kernel/ptrace.c
    27     @@ -1309,42 +1309,49 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
    28     break;
    29    
    30     case PTRACE_GETREGS: /* Get all gp regs from the child. */
    31     - return copy_regset_to_user(child, &user_x86_32_view,
    32     - REGSET_GENERAL,
    33     - 0, sizeof(struct user_regs_struct32),
    34     - datap);
    35     + ret = copy_regset_to_user(child, &user_x86_32_view,
    36     + REGSET_GENERAL,
    37     + 0, sizeof(struct user_regs_struct32),
    38     + datap);
    39     + break;
    40    
    41     case PTRACE_SETREGS: /* Set all gp regs in the child. */
    42     - return copy_regset_from_user(child, &user_x86_32_view,
    43     - REGSET_GENERAL, 0,
    44     - sizeof(struct user_regs_struct32),
    45     - datap);
    46     + ret = copy_regset_from_user(child, &user_x86_32_view,
    47     + REGSET_GENERAL, 0,
    48     + sizeof(struct user_regs_struct32),
    49     + datap);
    50     + break;
    51    
    52     case PTRACE_GETFPREGS: /* Get the child FPU state. */
    53     - return copy_regset_to_user(child, &user_x86_32_view,
    54     - REGSET_FP, 0,
    55     - sizeof(struct user_i387_ia32_struct),
    56     - datap);
    57     + ret = copy_regset_to_user(child, &user_x86_32_view,
    58     + REGSET_FP, 0,
    59     + sizeof(struct user_i387_ia32_struct),
    60     + datap);
    61     + break;
    62    
    63     case PTRACE_SETFPREGS: /* Set the child FPU state. */
    64     - return copy_regset_from_user(
    65     + ret = copy_regset_from_user(
    66     child, &user_x86_32_view, REGSET_FP,
    67     0, sizeof(struct user_i387_ia32_struct), datap);
    68     + break;
    69    
    70     case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
    71     - return copy_regset_to_user(child, &user_x86_32_view,
    72     - REGSET_XFP, 0,
    73     - sizeof(struct user32_fxsr_struct),
    74     - datap);
    75     + ret = copy_regset_to_user(child, &user_x86_32_view,
    76     + REGSET_XFP, 0,
    77     + sizeof(struct user32_fxsr_struct),
    78     + datap);
    79     + break;
    80    
    81     case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
    82     - return copy_regset_from_user(child, &user_x86_32_view,
    83     + ret = copy_regset_from_user(child, &user_x86_32_view,
    84     REGSET_XFP, 0,
    85     sizeof(struct user32_fxsr_struct),
    86     datap);
    87     + break;
    88    
    89     default:
    90     - return compat_ptrace_request(child, request, addr, data);
    91     + ret = compat_ptrace_request(child, request, addr, data);
    92     + break;
    93     }
    94    
    95     out:
    96     diff --git a/arch/x86/kernel/smpboot_64.c b/arch/x86/kernel/smpboot_64.c
    97     index 0880f2c..7b768e3 100644
    98     --- a/arch/x86/kernel/smpboot_64.c
    99     +++ b/arch/x86/kernel/smpboot_64.c
    100     @@ -704,7 +704,6 @@ do_rest:
    101     clear_bit(cpu, (unsigned long *)&cpu_initialized); /* was set by cpu_init() */
    102     clear_node_cpumask(cpu); /* was set by numa_add_cpu */
    103     cpu_clear(cpu, cpu_present_map);
    104     - cpu_clear(cpu, cpu_possible_map);
    105     per_cpu(x86_cpu_to_apicid, cpu) = BAD_APICID;
    106     return -EIO;
    107     }
    108     diff --git a/drivers/char/drm/i915_drv.c b/drivers/char/drm/i915_drv.c
    109     index b2b451d..becab51 100644
    110     --- a/drivers/char/drm/i915_drv.c
    111     +++ b/drivers/char/drm/i915_drv.c
    112     @@ -385,6 +385,7 @@ static int i915_resume(struct drm_device *dev)
    113     pci_restore_state(dev->pdev);
    114     if (pci_enable_device(dev->pdev))
    115     return -1;
    116     + pci_set_master(dev->pdev);
    117    
    118     pci_write_config_byte(dev->pdev, LBB, dev_priv->saveLBB);
    119    
    120     diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
    121     index 252db08..0b92d3e 100644
    122     --- a/drivers/infiniband/hw/mthca/mthca_memfree.c
    123     +++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
    124     @@ -109,7 +109,11 @@ static int mthca_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_m
    125     {
    126     struct page *page;
    127    
    128     - page = alloc_pages(gfp_mask, order);
    129     + /*
    130     + * Use __GFP_ZERO because buggy firmware assumes ICM pages are
    131     + * cleared, and subtle failures are seen if they aren't.
    132     + */
    133     + page = alloc_pages(gfp_mask | __GFP_ZERO, order);
    134     if (!page)
    135     return -ENOMEM;
    136    
    137     diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
    138     index 0a9b751..756e1bb 100644
    139     --- a/drivers/net/hamradio/6pack.c
    140     +++ b/drivers/net/hamradio/6pack.c
    141     @@ -601,6 +601,8 @@ static int sixpack_open(struct tty_struct *tty)
    142    
    143     if (!capable(CAP_NET_ADMIN))
    144     return -EPERM;
    145     + if (!tty->driver->write)
    146     + return -EOPNOTSUPP;
    147    
    148     dev = alloc_netdev(sizeof(struct sixpack), "sp%d", sp_setup);
    149     if (!dev) {
    150     diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    151     index 30c9b3b..f650da3 100644
    152     --- a/drivers/net/hamradio/mkiss.c
    153     +++ b/drivers/net/hamradio/mkiss.c
    154     @@ -529,6 +529,7 @@ static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
    155     static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
    156     {
    157     struct mkiss *ax = netdev_priv(dev);
    158     + int cib = 0;
    159    
    160     if (!netif_running(dev)) {
    161     printk(KERN_ERR "mkiss: %s: xmit call when iface is down\n", dev->name);
    162     @@ -544,10 +545,11 @@ static int ax_xmit(struct sk_buff *skb, struct net_device *dev)
    163     /* 20 sec timeout not reached */
    164     return 1;
    165     }
    166     + if (ax->tty->driver->chars_in_buffer)
    167     + cib = ax->tty->driver->chars_in_buffer(ax->tty);
    168    
    169     printk(KERN_ERR "mkiss: %s: transmit timed out, %s?\n", dev->name,
    170     - (ax->tty->driver->chars_in_buffer(ax->tty) || ax->xleft) ?
    171     - "bad line quality" : "driver error");
    172     + cib || ax->xleft ? "bad line quality" : "driver error");
    173    
    174     ax->xleft = 0;
    175     clear_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
    176     @@ -736,6 +738,8 @@ static int mkiss_open(struct tty_struct *tty)
    177    
    178     if (!capable(CAP_NET_ADMIN))
    179     return -EPERM;
    180     + if (!tty->driver->write)
    181     + return -EOPNOTSUPP;
    182    
    183     dev = alloc_netdev(sizeof(struct mkiss), "ax%d", ax_setup);
    184     if (!dev) {
    185     diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
    186     index fc753d7..df755f5 100644
    187     --- a/drivers/net/irda/irtty-sir.c
    188     +++ b/drivers/net/irda/irtty-sir.c
    189     @@ -64,7 +64,9 @@ static int irtty_chars_in_buffer(struct sir_dev *dev)
    190     IRDA_ASSERT(priv != NULL, return -1;);
    191     IRDA_ASSERT(priv->magic == IRTTY_MAGIC, return -1;);
    192    
    193     - return priv->tty->driver->chars_in_buffer(priv->tty);
    194     + if (priv->tty->driver->chars_in_buffer)
    195     + return priv->tty->driver->chars_in_buffer(priv->tty);
    196     + return 0;
    197     }
    198    
    199     /* Wait (sleep) until underlaying hardware finished transmission
    200     diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
    201     index f023d5b..098bf44 100644
    202     --- a/drivers/net/ppp_async.c
    203     +++ b/drivers/net/ppp_async.c
    204     @@ -158,6 +158,9 @@ ppp_asynctty_open(struct tty_struct *tty)
    205     struct asyncppp *ap;
    206     int err;
    207    
    208     + if (!tty->driver->write)
    209     + return -EOPNOTSUPP;
    210     +
    211     err = -ENOMEM;
    212     ap = kzalloc(sizeof(*ap), GFP_KERNEL);
    213     if (!ap)
    214     diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
    215     index 0d80fa5..7372938 100644
    216     --- a/drivers/net/ppp_synctty.c
    217     +++ b/drivers/net/ppp_synctty.c
    218     @@ -207,6 +207,9 @@ ppp_sync_open(struct tty_struct *tty)
    219     struct syncppp *ap;
    220     int err;
    221    
    222     + if (!tty->driver->write)
    223     + return -EOPNOTSUPP;
    224     +
    225     ap = kzalloc(sizeof(*ap), GFP_KERNEL);
    226     err = -ENOMEM;
    227     if (!ap)
    228     diff --git a/drivers/net/slip.c b/drivers/net/slip.c
    229     index 5a55ede..9d138bf 100644
    230     --- a/drivers/net/slip.c
    231     +++ b/drivers/net/slip.c
    232     @@ -460,10 +460,14 @@ static void sl_tx_timeout(struct net_device *dev)
    233     /* 20 sec timeout not reached */
    234     goto out;
    235     }
    236     - printk(KERN_WARNING "%s: transmit timed out, %s?\n",
    237     - dev->name,
    238     - (sl->tty->driver->chars_in_buffer(sl->tty) || sl->xleft) ?
    239     - "bad line quality" : "driver error");
    240     + {
    241     + int cib = 0;
    242     + if (sl->tty->driver->chars_in_buffer)
    243     + cib = sl->tty->driver->chars_in_buffer(sl->tty);
    244     + printk(KERN_WARNING "%s: transmit timed out, %s?\n",
    245     + dev->name, (cib || sl->xleft) ?
    246     + "bad line quality" : "driver error");
    247     + }
    248     sl->xleft = 0;
    249     sl->tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
    250     sl_unlock(sl);
    251     @@ -829,6 +833,8 @@ static int slip_open(struct tty_struct *tty)
    252    
    253     if (!capable(CAP_NET_ADMIN))
    254     return -EPERM;
    255     + if (!tty->driver->write)
    256     + return -EOPNOTSUPP;
    257    
    258     /* RTnetlink lock is misused here to serialize concurrent
    259     opens of slip channels. There are better ways, but it is
    260     diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
    261     index 0f8aca8..f5b9a71 100644
    262     --- a/drivers/net/wan/x25_asy.c
    263     +++ b/drivers/net/wan/x25_asy.c
    264     @@ -283,6 +283,10 @@ static void x25_asy_write_wakeup(struct tty_struct *tty)
    265     static void x25_asy_timeout(struct net_device *dev)
    266     {
    267     struct x25_asy *sl = (struct x25_asy*)(dev->priv);
    268     + int cib = 0;
    269     +
    270     + if (sl->tty->driver->chars_in_buffer)
    271     + cib = sl->tty->driver->chars_in_buffer(sl->tty);
    272    
    273     spin_lock(&sl->lock);
    274     if (netif_queue_stopped(dev)) {
    275     @@ -290,8 +294,7 @@ static void x25_asy_timeout(struct net_device *dev)
    276     * 14 Oct 1994 Dmitry Gorodchanin.
    277     */
    278     printk(KERN_WARNING "%s: transmit timed out, %s?\n", dev->name,
    279     - (sl->tty->driver->chars_in_buffer(sl->tty) || sl->xleft) ?
    280     - "bad line quality" : "driver error");
    281     + (cib || sl->xleft) ? "bad line quality" : "driver error");
    282     sl->xleft = 0;
    283     sl->tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
    284     x25_asy_unlock(sl);
    285     @@ -561,6 +564,9 @@ static int x25_asy_open_tty(struct tty_struct *tty)
    286     return -EEXIST;
    287     }
    288    
    289     + if (!tty->driver->write)
    290     + return -EOPNOTSUPP;
    291     +
    292     /* OK. Find a free X.25 channel to use. */
    293     if ((sl = x25_asy_alloc()) == NULL) {
    294     return -ENFILE;
    295     diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
    296     index 88efe1b..5536a94 100644
    297     --- a/drivers/net/wireless/strip.c
    298     +++ b/drivers/net/wireless/strip.c
    299     @@ -802,7 +802,8 @@ static void set_baud(struct tty_struct *tty, unsigned int baudcode)
    300     struct ktermios old_termios = *(tty->termios);
    301     tty->termios->c_cflag &= ~CBAUD; /* Clear the old baud setting */
    302     tty->termios->c_cflag |= baudcode; /* Set the new baud setting */
    303     - tty->driver->set_termios(tty, &old_termios);
    304     + if (tty->driver->set_termios)
    305     + tty->driver->set_termios(tty, &old_termios);
    306     }
    307    
    308     /*
    309     diff --git a/include/asm-x86/msr.h b/include/asm-x86/msr.h
    310     index 3ca29eb..84a15b6 100644
    311     --- a/include/asm-x86/msr.h
    312     +++ b/include/asm-x86/msr.h
    313     @@ -18,7 +18,7 @@ static inline unsigned long long native_read_tscp(unsigned int *aux)
    314     unsigned long low, high;
    315     asm volatile (".byte 0x0f,0x01,0xf9"
    316     : "=a" (low), "=d" (high), "=c" (*aux));
    317     - return low | ((u64)high >> 32);
    318     + return low | ((u64)high << 32);
    319     }
    320    
    321     /*
    322     diff --git a/kernel/futex.c b/kernel/futex.c
    323     index e43945e..cc6fd0d 100644
    324     --- a/kernel/futex.c
    325     +++ b/kernel/futex.c
    326     @@ -1118,21 +1118,64 @@ static void unqueue_me_pi(struct futex_q *q)
    327     * private futexes.
    328     */
    329     static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
    330     - struct task_struct *newowner)
    331     + struct task_struct *newowner,
    332     + struct rw_semaphore *fshared)
    333     {
    334     u32 newtid = task_pid_vnr(newowner) | FUTEX_WAITERS;
    335     struct futex_pi_state *pi_state = q->pi_state;
    336     + struct task_struct *oldowner = pi_state->owner;
    337     u32 uval, curval, newval;
    338     - int ret;
    339     + int ret, attempt = 0;
    340    
    341     /* Owner died? */
    342     + if (!pi_state->owner)
    343     + newtid |= FUTEX_OWNER_DIED;
    344     +
    345     + /*
    346     + * We are here either because we stole the rtmutex from the
    347     + * pending owner or we are the pending owner which failed to
    348     + * get the rtmutex. We have to replace the pending owner TID
    349     + * in the user space variable. This must be atomic as we have
    350     + * to preserve the owner died bit here.
    351     + *
    352     + * Note: We write the user space value _before_ changing the
    353     + * pi_state because we can fault here. Imagine swapped out
    354     + * pages or a fork, which was running right before we acquired
    355     + * mmap_sem, that marked all the anonymous memory readonly for
    356     + * cow.
    357     + *
    358     + * Modifying pi_state _before_ the user space value would
    359     + * leave the pi_state in an inconsistent state when we fault
    360     + * here, because we need to drop the hash bucket lock to
    361     + * handle the fault. This might be observed in the PID check
    362     + * in lookup_pi_state.
    363     + */
    364     +retry:
    365     + if (get_futex_value_locked(&uval, uaddr))
    366     + goto handle_fault;
    367     +
    368     + while (1) {
    369     + newval = (uval & FUTEX_OWNER_DIED) | newtid;
    370     +
    371     + curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
    372     +
    373     + if (curval == -EFAULT)
    374     + goto handle_fault;
    375     + if (curval == uval)
    376     + break;
    377     + uval = curval;
    378     + }
    379     +
    380     + /*
    381     + * We fixed up user space. Now we need to fix the pi_state
    382     + * itself.
    383     + */
    384     if (pi_state->owner != NULL) {
    385     spin_lock_irq(&pi_state->owner->pi_lock);
    386     WARN_ON(list_empty(&pi_state->list));
    387     list_del_init(&pi_state->list);
    388     spin_unlock_irq(&pi_state->owner->pi_lock);
    389     - } else
    390     - newtid |= FUTEX_OWNER_DIED;
    391     + }
    392    
    393     pi_state->owner = newowner;
    394    
    395     @@ -1140,26 +1183,35 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
    396     WARN_ON(!list_empty(&pi_state->list));
    397     list_add(&pi_state->list, &newowner->pi_state_list);
    398     spin_unlock_irq(&newowner->pi_lock);
    399     + return 0;
    400    
    401     /*
    402     - * We own it, so we have to replace the pending owner
    403     - * TID. This must be atomic as we have preserve the
    404     - * owner died bit here.
    405     + * To handle the page fault we need to drop the hash bucket
    406     + * lock here. That gives the other task (either the pending
    407     + * owner itself or the task which stole the rtmutex) the
    408     + * chance to try the fixup of the pi_state. So once we are
    409     + * back from handling the fault we need to check the pi_state
    410     + * after reacquiring the hash bucket lock and before trying to
    411     + * do another fixup. When the fixup has been done already we
    412     + * simply return.
    413     */
    414     - ret = get_futex_value_locked(&uval, uaddr);
    415     +handle_fault:
    416     + spin_unlock(q->lock_ptr);
    417    
    418     - while (!ret) {
    419     - newval = (uval & FUTEX_OWNER_DIED) | newtid;
    420     + ret = futex_handle_fault((unsigned long)uaddr, fshared, attempt++);
    421    
    422     - curval = cmpxchg_futex_value_locked(uaddr, uval, newval);
    423     + spin_lock(q->lock_ptr);
    424    
    425     - if (curval == -EFAULT)
    426     - ret = -EFAULT;
    427     - if (curval == uval)
    428     - break;
    429     - uval = curval;
    430     - }
    431     - return ret;
    432     + /*
    433     + * Check if someone else fixed it for us:
    434     + */
    435     + if (pi_state->owner != oldowner)
    436     + return 0;
    437     +
    438     + if (ret)
    439     + return ret;
    440     +
    441     + goto retry;
    442     }
    443    
    444     /*
    445     @@ -1524,7 +1576,7 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
    446     * that case:
    447     */
    448     if (q.pi_state->owner != curr)
    449     - ret = fixup_pi_state_owner(uaddr, &q, curr);
    450     + ret = fixup_pi_state_owner(uaddr, &q, curr, fshared);
    451     } else {
    452     /*
    453     * Catch the rare case, where the lock was released
    454     @@ -1556,7 +1608,8 @@ static int futex_lock_pi(u32 __user *uaddr, struct rw_semaphore *fshared,
    455     int res;
    456    
    457     owner = rt_mutex_owner(&q.pi_state->pi_mutex);
    458     - res = fixup_pi_state_owner(uaddr, &q, owner);
    459     + res = fixup_pi_state_owner(uaddr, &q, owner,
    460     + fshared);
    461    
    462     /* propagate -EFAULT, if the fixup failed */
    463     if (res)
    464     diff --git a/kernel/sched.c b/kernel/sched.c
    465     index 1e4596c..c54077c 100644
    466     --- a/kernel/sched.c
    467     +++ b/kernel/sched.c
    468     @@ -5728,6 +5728,7 @@ static void migrate_dead_tasks(unsigned int dead_cpu)
    469     next = pick_next_task(rq, rq->curr);
    470     if (!next)
    471     break;
    472     + next->sched_class->put_prev_task(rq, next);
    473     migrate_dead(dead_cpu, next);
    474    
    475     }