[00/11] -stable review

[00/11] -stable review

[Greg KH]

This is the start of the stable review cycle for the 2.6.12.3 release.
There are 11 patches in this series, all will be posted as a response to
this one.  If anyone has any issues with these being applied, please let
us know.  If anyone is a maintainer of the proper subsystem, and wants
to add a signed-off-by: line to the patch, please respond with it.

These patches are sent out with a number of different people on the Cc:
line.  If you wish to be a reviewer, please email stable@kernel.org to
add your name to the list.  If you want to be off the reviewer list,
also email us.

Responses should be made by Friday, July 15, 20:00:00 UTC 2005.
Anything received after that time, might be too late.

thanks,

the -stable release team

[02/11] [NETFILTER]: revert nf_reset change

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

[NETFILTER]: Revert nf_reset change

Revert the nf_reset change that caused so much trouble, drop conntrack
references manually before packets are queued to packet sockets.

Adapted for 2.6.12 by Daniel Drake <dsd@gentoo.org>

Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 net/ipv4/ip_output.c                         |    3 ---
 net/ipv4/netfilter/ip_conntrack_standalone.c |    7 +++++++
 net/packet/af_packet.c                       |    6 ++++++
 3 files changed, 13 insertions(+), 3 deletions(-)

--- linux-2.6.12.2.orig/net/ipv4/ip_output.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/ipv4/ip_output.c	2005-07-13 10:56:44.000000000 -0700
@@ -111,7 +111,6 @@
 #ifdef CONFIG_NETFILTER_DEBUG
 	nf_debug_ip_loopback_xmit(newskb);
 #endif
-	nf_reset(newskb);
 	netif_rx(newskb);
 	return 0;
 }
@@ -196,8 +195,6 @@
 	nf_debug_ip_finish_output2(skb);
 #endif /*CONFIG_NETFILTER_DEBUG*/
 
-	nf_reset(skb);
-
 	if (hh) {
 		int hh_alen;
 
--- linux-2.6.12.2.orig/net/ipv4/netfilter/ip_conntrack_standalone.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/ipv4/netfilter/ip_conntrack_standalone.c	2005-07-13 10:56:44.000000000 -0700
@@ -432,6 +432,13 @@
 				        const struct net_device *out,
 				        int (*okfn)(struct sk_buff *))
 {
+#if !defined(CONFIG_IP_NF_NAT) && !defined(CONFIG_IP_NF_NAT_MODULE)
+	/* Previously seen (loopback)?  Ignore.  Do this before
+           fragment check. */
+	if ((*pskb)->nfct)
+		return NF_ACCEPT;
+#endif
+
 	/* Gather fragments. */
 	if ((*pskb)->nh.iph->frag_off & htons(IP_MF|IP_OFFSET)) {
 		*pskb = ip_ct_gather_frags(*pskb,
--- linux-2.6.12.2.orig/net/packet/af_packet.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/net/packet/af_packet.c	2005-07-13 10:56:44.000000000 -0700
@@ -274,6 +274,9 @@
 	dst_release(skb->dst);
 	skb->dst = NULL;
 
+	/* drop conntrack reference */
+	nf_reset(skb);
+
 	spkt = (struct sockaddr_pkt*)skb->cb;
 
 	skb_push(skb, skb->data-skb->mac.raw);
@@ -517,6 +520,9 @@
 	dst_release(skb->dst);
 	skb->dst = NULL;
 
+	/* drop conntrack reference */
+	nf_reset(skb);
+
 	spin_lock(&sk->sk_receive_queue.lock);
 	po->stats.tp_packets++;
 	__skb_queue_tail(&sk->sk_receive_queue, skb);

[03/11] ppc32: stop misusing ntps time_offset value

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: john stultz <johnstul@us.ibm.com>

As part of my timeofday rework, I've been looking at the NTP code and I
noticed that the PPC architecture is apparently misusing the NTP's
time_offset (it is a terrible name!) value as some form of timezone offset.

This could cause problems when time_offset changed by the NTP code.  This
patch changes the PPC code so it uses a more clear local variable:
timezone_offset.

Signed-off-by: John Stultz <johnstul@us.ibm.com>
Acked-by: Tom Rini <trini@kernel.crashing.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/ppc/kernel/time.c |   13 ++++++++-----
 1 files changed, 8 insertions(+), 5 deletions(-)

--- linux-2.6.12.2.orig/arch/ppc/kernel/time.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/ppc/kernel/time.c	2005-07-13 10:56:23.000000000 -0700
@@ -89,6 +89,9 @@
 
 extern unsigned long wall_jiffies;
 
+/* used for timezone offset */
+static long timezone_offset;
+
 DEFINE_SPINLOCK(rtc_lock);
 
 EXPORT_SYMBOL(rtc_lock);
@@ -170,7 +173,7 @@
 		     xtime.tv_sec - last_rtc_update >= 659 &&
 		     abs((xtime.tv_nsec / 1000) - (1000000-1000000/HZ)) < 500000/HZ &&
 		     jiffies - wall_jiffies == 1) {
-		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + time_offset) == 0)
+		  	if (ppc_md.set_rtc_time(xtime.tv_sec+1 + timezone_offset) == 0)
 				last_rtc_update = xtime.tv_sec+1;
 			else
 				/* Try again one minute later */
@@ -286,7 +289,7 @@
 	unsigned old_stamp, stamp, elapsed;
 
         if (ppc_md.time_init != NULL)
-                time_offset = ppc_md.time_init();
+                timezone_offset = ppc_md.time_init();
 
 	if (__USE_RTC()) {
 		/* 601 processor: dec counts down by 128 every 128ns */
@@ -331,10 +334,10 @@
 	set_dec(tb_ticks_per_jiffy);
 
 	/* If platform provided a timezone (pmac), we correct the time */
-        if (time_offset) {
-		sys_tz.tz_minuteswest = -time_offset / 60;
+        if (timezone_offset) {
+		sys_tz.tz_minuteswest = -timezone_offset / 60;
 		sys_tz.tz_dsttime = 0;
-		xtime.tv_sec -= time_offset;
+		xtime.tv_sec -= timezone_offset;
         }
         set_normalized_timespec(&wall_to_monotonic,
                                 -xtime.tv_sec, -xtime.tv_nsec);

[01/11] If ACPI doesn't find an irq listed, don't accept 0 as a valid PCI irq.

[Greg KH]

[resend to get threading correct, sorry]

-stable review patch.  If anyone has any objections, please let us know.

------------------

If ACPI doesn't find an irq listed, don't accept 0 as a valid PCI irq.
That zero just means that nothing else found any irq information either.

Fixes http://bugme.osdl.org/show_bug.cgi?id=4824

Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/pci_irq.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.2.orig/drivers/acpi/pci_irq.c	2005-07-13 10:53:01.000000000 -0700
+++ linux-2.6.12.2/drivers/acpi/pci_irq.c	2005-07-13 10:56:30.000000000 -0700
@@ -433,7 +433,7 @@
 		printk(KERN_WARNING PREFIX "PCI Interrupt %s[%c]: no GSI",
 			pci_name(dev), ('A' + pin));
 		/* Interrupt Line values above 0xF are forbidden */
-		if (dev->irq >= 0 && (dev->irq <= 0xF)) {
+		if (dev->irq > 0 && (dev->irq <= 0xF)) {
 			printk(" - using IRQ %d\n", dev->irq);
 			acpi_register_gsi(dev->irq, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
 			return_VALUE(0);

[04/11] [SHAPER] fix Shaper driver lossage in 2.6.12

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

[SHAPER]: Switch to spinlocks.

Dave, you were right and the sleeping locks in shaper were
broken. Markus Kanet noticed this and also tested the patch below that
switches locking to spinlocks.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/net/shaper.c      |   42 ++++++++++++++++--------------------------
 include/linux/if_shaper.h |    2 +-
 2 files changed, 17 insertions(+), 27 deletions(-)

--- linux-2.6.12.2.orig/drivers/net/shaper.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/net/shaper.c	2005-07-13 10:56:34.000000000 -0700
@@ -135,10 +135,8 @@
 {
 	struct shaper *shaper = dev->priv;
  	struct sk_buff *ptr;
-   
-	if (down_trylock(&shaper->sem))
-		return -1;
-
+
+	spin_lock(&shaper->lock);
  	ptr=shaper->sendq.prev;
  	
  	/*
@@ -232,7 +230,7 @@
                 shaper->stats.collisions++;
  	}
 	shaper_kick(shaper);
-	up(&shaper->sem);
+	spin_unlock(&shaper->lock);
  	return 0;
 }
 
@@ -271,11 +269,9 @@
 {
 	struct shaper *shaper = (struct shaper *)data;
 
-	if (!down_trylock(&shaper->sem)) {
-		shaper_kick(shaper);
-		up(&shaper->sem);
-	} else
-		mod_timer(&shaper->timer, jiffies);
+	spin_lock(&shaper->lock);
+	shaper_kick(shaper);
+	spin_unlock(&shaper->lock);
 }
 
 /*
@@ -332,21 +328,6 @@
 
 
 /*
- *	Flush the shaper queues on a closedown
- */
- 
-static void shaper_flush(struct shaper *shaper)
-{
-	struct sk_buff *skb;
-
-	down(&shaper->sem);
-	while((skb=skb_dequeue(&shaper->sendq))!=NULL)
-		dev_kfree_skb(skb);
-	shaper_kick(shaper);
-	up(&shaper->sem);
-}
-
-/*
  *	Bring the interface up. We just disallow this until a 
  *	bind.
  */
@@ -375,7 +356,15 @@
 static int shaper_close(struct net_device *dev)
 {
 	struct shaper *shaper=dev->priv;
-	shaper_flush(shaper);
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(&shaper->sendq)) != NULL)
+		dev_kfree_skb(skb);
+
+	spin_lock_bh(&shaper->lock);
+	shaper_kick(shaper);
+	spin_unlock_bh(&shaper->lock);
+
 	del_timer_sync(&shaper->timer);
 	return 0;
 }
@@ -576,6 +565,7 @@
 	init_timer(&sh->timer);
 	sh->timer.function=shaper_timer;
 	sh->timer.data=(unsigned long)sh;
+	spin_lock_init(&sh->lock);
 }
 
 /*
--- linux-2.6.12.2.orig/include/linux/if_shaper.h	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/include/linux/if_shaper.h	2005-07-13 10:56:34.000000000 -0700
@@ -23,7 +23,7 @@
 	__u32 shapeclock;
 	unsigned long recovery;	/* Time we can next clock a packet out on
 				   an empty queue */
-	struct semaphore sem;
+	spinlock_t lock;
         struct net_device_stats stats;
 	struct net_device *dev;
 	int  (*hard_start_xmit) (struct sk_buff *skb,

[05/11] SMP fix for 6pack driver

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------


Drivers really only work well in SMP if they actually can be selected.
This is a leftover from the time when the 6pack drive only used to be
a bitrotten variant of the slip driver.

Signed-off-by: Ralf Baechle DL5RB <ralf@linux-mips.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/net/hamradio/Kconfig |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.2.orig/drivers/net/hamradio/Kconfig	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/net/hamradio/Kconfig	2005-07-13 10:56:32.000000000 -0700
@@ -17,7 +17,7 @@
 
 config 6PACK
 	tristate "Serial port 6PACK driver"
-	depends on AX25 && BROKEN_ON_SMP
+	depends on AX25
 	---help---
 	  6pack is a transmission protocol for the data exchange between your
 	  PC and your TNC (the Terminal Node Controller acts as a kind of

Re: [05/11] SMP fix for 6pack driver

[Francois Romieu]

Greg KH <gregkh@suse.de> :
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> 
> Drivers really only work well in SMP if they actually can be selected.
> This is a leftover from the time when the 6pack drive only used to be
> a bitrotten variant of the slip driver.

Is the guideline above from 28/04/2005 obsoleted ?

 - It must fix a problem that causes a build error (but not for things
   marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
   security issue, or some "oh, that's not good" issue.  In short,
   something critical.

--
Ueimor

Re: [stable] Re: [05/11] SMP fix for 6pack driver

[Greg KH]

On Thu, Jul 14, 2005 at 12:01:23AM +0200, Francois Romieu wrote:
> Greg KH <gregkh@suse.de> :
> > -stable review patch.  If anyone has any objections, please let us know.
> > 
> > ------------------
> > 
> > 
> > Drivers really only work well in SMP if they actually can be selected.
> > This is a leftover from the time when the 6pack drive only used to be
> > a bitrotten variant of the slip driver.
> 
> Is the guideline above from 28/04/2005 obsoleted ?
> 
>  - It must fix a problem that causes a build error (but not for things
>    marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
>    security issue, or some "oh, that's not good" issue.  In short,
>    something critical.

It lets the driver be built, when it previously could not be, unless the
user used a config option that almost no one does...

That's pretty critical if you ask me.

thanks,

greg k-h

Re: [stable] Re: [05/11] SMP fix for 6pack driver

[Adrian Bunk]

On Wed, Jul 13, 2005 at 03:13:11PM -0700, Greg KH wrote:
> On Thu, Jul 14, 2005 at 12:01:23AM +0200, Francois Romieu wrote:
> > Greg KH <gregkh@suse.de> :
> > > -stable review patch.  If anyone has any objections, please let us know.
> > > 
> > > ------------------
> > > 
> > > 
> > > Drivers really only work well in SMP if they actually can be selected.
> > > This is a leftover from the time when the 6pack drive only used to be
> > > a bitrotten variant of the slip driver.
> > 
> > Is the guideline above from 28/04/2005 obsoleted ?
> > 
> >  - It must fix a problem that causes a build error (but not for things
> >    marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
> >    security issue, or some "oh, that's not good" issue.  In short,
> >    something critical.
> 
> It lets the driver be built, when it previously could not be, unless the
> user used a config option that almost no one does...
> 
> That's pretty critical if you ask me.


I do agree with Francois regarding this issue:

AFAIR, there has been not one 2.6 kernel where this driver was available 
for SMP kernels. It's therefore untested which problems might arise with 
this driver on SMP systems. I'm not arguing against including this 
driver in 2.6.13, but 2.6.12.3 isn't the right place.


What surprises me most is that you accepted this patch is neither in 
2.6.13-rc3 nor in 2.6.13-rc3-mm1. There seems to be either an
(IMHO unfortunate) change in your policy of what patches to accept,
or there's a serious problem in your patch review process.


> thanks,
> 
> greg k-h

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [stable] Re: [05/11] SMP fix for 6pack driver

[Ralf Baechle]

On Fri, Jul 15, 2005 at 09:35:56PM +0200, Adrian Bunk wrote:

> I do agree with Francois regarding this issue:
> 
> AFAIR, there has been not one 2.6 kernel where this driver was available 
> for SMP kernels.

Eh...  That after all is the raison d'etre for this patch :)

> It's therefore untested which problems might arise with 
> this driver on SMP systems. I'm not arguing against including this 
> driver in 2.6.13, but 2.6.12.3 isn't the right place.

Nonsense.  Most development activity for this stuff happens not on the
internet and you won't be able to follow it unless you're a licensed ham.
I've been circulating things patch since a while and nobody has been unhappy.

> What surprises me most is that you accepted this patch is neither in 
> 2.6.13-rc3 nor in 2.6.13-rc3-mm1. There seems to be either an
> (IMHO unfortunate) change in your policy of what patches to accept,
> or there's a serious problem in your patch review process.

I've sent it to jgarzik so it's somewhere on it's long way there.

  Ralf

Re: [stable] Re: [05/11] SMP fix for 6pack driver

[Adrian Bunk]

On Sun, Jul 17, 2005 at 05:09:39PM -0400, Ralf Baechle wrote:
> On Fri, Jul 15, 2005 at 09:35:56PM +0200, Adrian Bunk wrote:
> 
> > I do agree with Francois regarding this issue:
> > 
> > AFAIR, there has been not one 2.6 kernel where this driver was available 
> > for SMP kernels.
> 
> Eh...  That after all is the raison d'etre for this patch :)
> 
> > It's therefore untested which problems might arise with 
> > this driver on SMP systems. I'm not arguing against including this 
> > driver in 2.6.13, but 2.6.12.3 isn't the right place.
> 
> Nonsense.  Most development activity for this stuff happens not on the
> internet and you won't be able to follow it unless you're a licensed ham.
> I've been circulating things patch since a while and nobody has been unhappy.

So why was it important to get it into 2.6.12.3?

I must have missed the announcement that the original -stable goals have 
been declared obsolete.

> > What surprises me most is that you accepted this patch is neither in 
> > 2.6.13-rc3 nor in 2.6.13-rc3-mm1. There seems to be either an
> > (IMHO unfortunate) change in your policy of what patches to accept,
> > or there's a serious problem in your patch review process.
> 
> I've sent it to jgarzik so it's somewhere on it's long way there.
> 
>   Ralf

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

[06/11] tpm breaks 8139cp

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

A problem was reported that the tpm driver was interfereing with
networking on the 8139 chipset.  The tpm driver was using a hard coded
the memory address instead of the value the BIOS was putting the chip
at.  This was in the tpm_lpc_bus_init function.  That function can be
replaced with querying the value at Vendor specific locations.  This
patch replaces all calls to tpm_lpc_bus_init and the hardcoding of the
base address with a lookup of the address at the correct vendor
location.

Signed-off-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/char/tpm/tpm.c       |   76 -------------------------------------------
 drivers/char/tpm/tpm.h       |    2 -
 drivers/char/tpm/tpm_atmel.c |   16 +++++----
 drivers/char/tpm/tpm_nsc.c   |   16 +++++----
 4 files changed, 20 insertions(+), 90 deletions(-)

--- linux-2.6.12.2.orig/drivers/char/tpm/tpm_atmel.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/char/tpm/tpm_atmel.c	2005-07-13 10:56:27.000000000 -0700
@@ -22,7 +22,10 @@
 #include "tpm.h"
 
 /* Atmel definitions */
-#define	TPM_ATML_BASE			0x400
+enum tpm_atmel_addr {
+	TPM_ATMEL_BASE_ADDR_LO = 0x08,
+	TPM_ATMEL_BASE_ADDR_HI = 0x09
+};
 
 /* write status bits */
 #define	ATML_STATUS_ABORT		0x01
@@ -127,7 +130,6 @@
 	.cancel = tpm_atml_cancel,
 	.req_complete_mask = ATML_STATUS_BUSY | ATML_STATUS_DATA_AVAIL,
 	.req_complete_val = ATML_STATUS_DATA_AVAIL,
-	.base = TPM_ATML_BASE,
 	.miscdev = { .fops = &atmel_ops, },
 };
 
@@ -136,14 +138,16 @@
 {
 	u8 version[4];
 	int rc = 0;
+	int lo, hi;
 
 	if (pci_enable_device(pci_dev))
 		return -EIO;
 
-	if (tpm_lpc_bus_init(pci_dev, TPM_ATML_BASE)) {
-		rc = -ENODEV;
-		goto out_err;
-	}
+	lo = tpm_read_index( TPM_ATMEL_BASE_ADDR_LO );
+	hi = tpm_read_index( TPM_ATMEL_BASE_ADDR_HI );
+
+	tpm_atmel.base = (hi<<8)|lo;
+	dev_dbg( &pci_dev->dev, "Operating with base: 0x%x\n", tpm_atmel.base);
 
 	/* verify that it is an Atmel part */
 	if (tpm_read_index(4) != 'A' || tpm_read_index(5) != 'T'
--- linux-2.6.12.2.orig/drivers/char/tpm/tpm.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/char/tpm/tpm.c	2005-07-13 10:56:27.000000000 -0700
@@ -32,12 +32,6 @@
 
 #define	TPM_BUFSIZE			2048
 
-/* PCI configuration addresses */
-#define	PCI_GEN_PMCON_1			0xA0
-#define	PCI_GEN1_DEC			0xE4
-#define	PCI_LPC_EN			0xE6
-#define	PCI_GEN2_DEC			0xEC
-
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
 static int dev_mask[32];
@@ -61,72 +55,6 @@
 EXPORT_SYMBOL_GPL(tpm_time_expired);
 
 /*
- * Initialize the LPC bus and enable the TPM ports
- */
-int tpm_lpc_bus_init(struct pci_dev *pci_dev, u16 base)
-{
-	u32 lpcenable, tmp;
-	int is_lpcm = 0;
-
-	switch (pci_dev->vendor) {
-	case PCI_VENDOR_ID_INTEL:
-		switch (pci_dev->device) {
-		case PCI_DEVICE_ID_INTEL_82801CA_12:
-		case PCI_DEVICE_ID_INTEL_82801DB_12:
-			is_lpcm = 1;
-			break;
-		}
-		/* init ICH (enable LPC) */
-		pci_read_config_dword(pci_dev, PCI_GEN1_DEC, &lpcenable);
-		lpcenable |= 0x20000000;
-		pci_write_config_dword(pci_dev, PCI_GEN1_DEC, lpcenable);
-
-		if (is_lpcm) {
-			pci_read_config_dword(pci_dev, PCI_GEN1_DEC,
-					      &lpcenable);
-			if ((lpcenable & 0x20000000) == 0) {
-				dev_err(&pci_dev->dev,
-					"cannot enable LPC\n");
-				return -ENODEV;
-			}
-		}
-
-		/* initialize TPM registers */
-		pci_read_config_dword(pci_dev, PCI_GEN2_DEC, &tmp);
-
-		if (!is_lpcm)
-			tmp = (tmp & 0xFFFF0000) | (base & 0xFFF0);
-		else
-			tmp =
-			    (tmp & 0xFFFF0000) | (base & 0xFFF0) |
-			    0x00000001;
-
-		pci_write_config_dword(pci_dev, PCI_GEN2_DEC, tmp);
-
-		if (is_lpcm) {
-			pci_read_config_dword(pci_dev, PCI_GEN_PMCON_1,
-					      &tmp);
-			tmp |= 0x00000004;	/* enable CLKRUN */
-			pci_write_config_dword(pci_dev, PCI_GEN_PMCON_1,
-					       tmp);
-		}
-		tpm_write_index(0x0D, 0x55);	/* unlock 4F */
-		tpm_write_index(0x0A, 0x00);	/* int disable */
-		tpm_write_index(0x08, base);	/* base addr lo */
-		tpm_write_index(0x09, (base & 0xFF00) >> 8);	/* base addr hi */
-		tpm_write_index(0x0D, 0xAA);	/* lock 4F */
-		break;
-	case PCI_VENDOR_ID_AMD:
-		/* nothing yet */
-		break;
-	}
-
-	return 0;
-}
-
-EXPORT_SYMBOL_GPL(tpm_lpc_bus_init);
-
-/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
@@ -590,10 +518,6 @@
 	if (chip == NULL)
 		return -ENODEV;
 
-	spin_lock(&driver_lock);
-	tpm_lpc_bus_init(pci_dev, chip->vendor->base);
-	spin_unlock(&driver_lock);
-
 	return 0;
 }
 
--- linux-2.6.12.2.orig/drivers/char/tpm/tpm.h	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/char/tpm/tpm.h	2005-07-13 10:56:27.000000000 -0700
@@ -79,8 +79,6 @@
 }
 
 extern void tpm_time_expired(unsigned long);
-extern int tpm_lpc_bus_init(struct pci_dev *, u16);
-
 extern int tpm_register_hardware(struct pci_dev *,
 				 struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
--- linux-2.6.12.2.orig/drivers/char/tpm/tpm_nsc.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/char/tpm/tpm_nsc.c	2005-07-13 10:56:27.000000000 -0700
@@ -24,6 +24,10 @@
 /* National definitions */
 #define	TPM_NSC_BASE			0x360
 #define	TPM_NSC_IRQ			0x07
+#define	TPM_NSC_BASE0_HI		0x60
+#define	TPM_NSC_BASE0_LO		0x61
+#define	TPM_NSC_BASE1_HI		0x62
+#define	TPM_NSC_BASE1_LO		0x63
 
 #define	NSC_LDN_INDEX			0x07
 #define	NSC_SID_INDEX			0x20
@@ -234,7 +238,6 @@
 	.cancel = tpm_nsc_cancel,
 	.req_complete_mask = NSC_STATUS_OBF,
 	.req_complete_val = NSC_STATUS_OBF,
-	.base = TPM_NSC_BASE,
 	.miscdev = { .fops = &nsc_ops, },
 	
 };
@@ -243,15 +246,16 @@
 				  const struct pci_device_id *pci_id)
 {
 	int rc = 0;
+	int lo, hi;
+
+	hi = tpm_read_index(TPM_NSC_BASE0_HI);
+	lo = tpm_read_index(TPM_NSC_BASE0_LO);
+
+	tpm_nsc.base = (hi<<8) | lo;
 
 	if (pci_enable_device(pci_dev))
 		return -EIO;
 
-	if (tpm_lpc_bus_init(pci_dev, TPM_NSC_BASE)) {
-		rc = -ENODEV;
-		goto out_err;
-	}
-
 	/* verify that it is a National part (SID) */
 	if (tpm_read_index(NSC_SID_INDEX) != 0xEF) {
 		rc = -ENODEV;

Re: [06/11] tpm breaks 8139cp

[John W. Linville]

On Wed, Jul 13, 2005 at 11:43:41AM -0700, Greg KH wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> A problem was reported that the tpm driver was interfereing with
> networking on the 8139 chipset.  The tpm driver was using a hard coded

ACK...this looks very similar to a patch I got from Kylene for fixing
this same issue when it showed-up in FC4.

John
-- 
John W. Linville
linville@tuxdriver.com

[07/11] v4l cx88 hue offset fix

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

Changed hue offset to 128 to correct behavior in cx88 cards.  Previously, 
setting 0% or 100% hue was required to avoid blue/green people on screen.  
Now, 50% Hue means no offset, just like bt878 stuff.

Signed-off-by: Michael Krufky <mkrufky@m1k.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/media/video/cx88/cx88-video.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.2.orig/drivers/media/video/cx88/cx88-video.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/media/video/cx88/cx88-video.c	2005-07-13 10:56:14.000000000 -0700
@@ -261,7 +261,7 @@
 			.default_value = 0,
 			.type          = V4L2_CTRL_TYPE_INTEGER,
 		},
-		.off                   = 0,
+		.off                   = 128,
 		.reg                   = MO_HUE,
 		.mask                  = 0x00ff,
 		.shift                 = 0,

[08/11] coverity: tty_ldisc_ref return null check

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: KAMBAROV, ZAUR <kambarov@berkeley.edu>

We add a check of the return value of tty_ldisc_ref(), which
is checked 7 out of 8 times, e.g.:

149  		ld = tty_ldisc_ref(tty);
150  		if (ld != NULL) {
151  			if (ld->set_termios)
152  				(ld->set_termios)(tty, &old_termios);
153  			tty_ldisc_deref(ld);
154  		}

This defect was found automatically by Coverity Prevent, a static analysis
tool.

(akpm: presumably `ld' is never NULL.  Oh well)

Signed-off-by: Zaur Kambarov <zkambarov@coverity.com>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/char/tty_ioctl.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.12.2.orig/drivers/char/tty_ioctl.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/drivers/char/tty_ioctl.c	2005-07-13 10:56:39.000000000 -0700
@@ -476,11 +476,11 @@
 			ld = tty_ldisc_ref(tty);
 			switch (arg) {
 			case TCIFLUSH:
-				if (ld->flush_buffer)
+				if (ld && ld->flush_buffer)
 					ld->flush_buffer(tty);
 				break;
 			case TCIOFLUSH:
-				if (ld->flush_buffer)
+				if (ld && ld->flush_buffer)
 					ld->flush_buffer(tty);
 				/* fall through */
 			case TCOFLUSH:

[09/11] uml: fix TT mode by reverting "use fork instead of clone"

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Jeff Dike <jdike@addtoit.com>, Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>

Revert the following patch, because of miscompilation problems in different
environments leading to UML not working *at all* in TT mode; it was merged
lately in 2.6 development cycle, a little after being written, and has caused
problems to lots of people; I know it's a bit too long, but it shouldn't have
been merged in first place, so I still apply for inclusion in the -stable
tree. Anyone using this feature currently is either using some older kernel
(some reports even used 2.6.12-rc4-mm2) or using this patch, as included in my
-bs patchset.

For now there's not yet a fix for this patch, so for now the best thing is to
drop it (which was widely reported to give a working kernel).

"Convert the boot-time host ptrace testing from clone to fork.  They were
essentially doing fork anyway.  This cleans up the code a bit, and makes
valgrind a bit happier about grinding it."

URL:
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=98fdffccea6cc3fe9dba32c0fcc310bcb5d71529

Signed-off-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/um/kernel/process.c |   48 ++++++++++++++++++++++++++++-------------------
 1 files changed, 29 insertions(+), 19 deletions(-)

--- linux-2.6.12.2.orig/arch/um/kernel/process.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/um/kernel/process.c	2005-07-13 10:56:41.000000000 -0700
@@ -130,7 +130,7 @@
 	return(arg.pid);
 }
 
-static int ptrace_child(void)
+static int ptrace_child(void *arg)
 {
 	int ret;
 	int pid = os_getpid(), ppid = getppid();
@@ -159,16 +159,20 @@
 	_exit(ret);
 }
 
-static int start_ptraced_child(void)
+static int start_ptraced_child(void **stack_out)
 {
+	void *stack;
+	unsigned long sp;
 	int pid, n, status;
 	
-	pid = fork();
-	if(pid == 0)
-		ptrace_child();
-
+	stack = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
+		     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	if(stack == MAP_FAILED)
+		panic("check_ptrace : mmap failed, errno = %d", errno);
+	sp = (unsigned long) stack + PAGE_SIZE - sizeof(void *);
+	pid = clone(ptrace_child, (void *) sp, SIGCHLD, NULL);
 	if(pid < 0)
-		panic("check_ptrace : fork failed, errno = %d", errno);
+		panic("check_ptrace : clone failed, errno = %d", errno);
 	CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED));
 	if(n < 0)
 		panic("check_ptrace : wait failed, errno = %d", errno);
@@ -176,6 +180,7 @@
 		panic("check_ptrace : expected SIGSTOP, got status = %d",
 		      status);
 
+	*stack_out = stack;
 	return(pid);
 }
 
@@ -183,12 +188,12 @@
  * just avoid using sysemu, not panic, but only if SYSEMU features are broken.
  * So only for SYSEMU features we test mustpanic, while normal host features
  * must work anyway!*/
-static int stop_ptraced_child(int pid, int exitcode, int mustexit)
+static int stop_ptraced_child(int pid, void *stack, int exitcode, int mustpanic)
 {
 	int status, n, ret = 0;
 
 	if(ptrace(PTRACE_CONT, pid, 0, 0) < 0)
-		panic("stop_ptraced_child : ptrace failed, errno = %d", errno);
+		panic("check_ptrace : ptrace failed, errno = %d", errno);
 	CATCH_EINTR(n = waitpid(pid, &status, 0));
 	if(!WIFEXITED(status) || (WEXITSTATUS(status) != exitcode)) {
 		int exit_with = WEXITSTATUS(status);
@@ -199,13 +204,15 @@
 		printk("check_ptrace : child exited with exitcode %d, while "
 		      "expecting %d; status 0x%x", exit_with,
 		      exitcode, status);
-		if (mustexit)
+		if (mustpanic)
 			panic("\n");
 		else
 			printk("\n");
 		ret = -1;
 	}
 
+	if(munmap(stack, PAGE_SIZE) < 0)
+		panic("check_ptrace : munmap failed, errno = %d", errno);
 	return ret;
 }
 
@@ -227,11 +234,12 @@
 
 static void __init check_sysemu(void)
 {
+	void *stack;
 	int pid, syscall, n, status, count=0;
 
 	printk("Checking syscall emulation patch for ptrace...");
 	sysemu_supported = 0;
-	pid = start_ptraced_child();
+	pid = start_ptraced_child(&stack);
 
 	if(ptrace(PTRACE_SYSEMU, pid, 0, 0) < 0)
 		goto fail;
@@ -249,7 +257,7 @@
 		panic("check_sysemu : failed to modify system "
 		      "call return, errno = %d", errno);
 
-	if (stop_ptraced_child(pid, 0, 0) < 0)
+	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
 		goto fail_stopped;
 
 	sysemu_supported = 1;
@@ -257,7 +265,7 @@
 	set_using_sysemu(!force_sysemu_disabled);
 
 	printk("Checking advanced syscall emulation patch for ptrace...");
-	pid = start_ptraced_child();
+	pid = start_ptraced_child(&stack);
 	while(1){
 		count++;
 		if(ptrace(PTRACE_SYSEMU_SINGLESTEP, pid, 0, 0) < 0)
@@ -282,7 +290,7 @@
 			break;
 		}
 	}
-	if (stop_ptraced_child(pid, 0, 0) < 0)
+	if (stop_ptraced_child(pid, stack, 0, 0) < 0)
 		goto fail_stopped;
 
 	sysemu_supported = 2;
@@ -293,17 +301,18 @@
 	return;
 
 fail:
-	stop_ptraced_child(pid, 1, 0);
+	stop_ptraced_child(pid, stack, 1, 0);
 fail_stopped:
 	printk("missing\n");
 }
 
 void __init check_ptrace(void)
 {
+	void *stack;
 	int pid, syscall, n, status;
 
 	printk("Checking that ptrace can change system call numbers...");
-	pid = start_ptraced_child();
+	pid = start_ptraced_child(&stack);
 
 	if (ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)PTRACE_O_TRACESYSGOOD) < 0)
 		panic("check_ptrace: PTRACE_SETOPTIONS failed, errno = %d", errno);
@@ -330,7 +339,7 @@
 			break;
 		}
 	}
-	stop_ptraced_child(pid, 0, 1);
+	stop_ptraced_child(pid, stack, 0, 1);
 	printk("OK\n");
 	check_sysemu();
 }
@@ -362,10 +371,11 @@
 static inline int check_skas3_ptrace_support(void)
 {
 	struct ptrace_faultinfo fi;
+	void *stack;
 	int pid, n, ret = 1;
 
 	printf("Checking for the skas3 patch in the host...");
-	pid = start_ptraced_child();
+	pid = start_ptraced_child(&stack);
 
 	n = ptrace(PTRACE_FAULTINFO, pid, 0, &fi);
 	if (n < 0) {
@@ -380,7 +390,7 @@
 	}
 
 	init_registers(pid);
-	stop_ptraced_child(pid, 1, 1);
+	stop_ptraced_child(pid, stack, 1, 1);
 
 	return(ret);
 }

[10/11] fix semaphore handling in __unregister_chrdev_region

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

This up() should be down() instead.

Signed-off-by: Wen-chien Jesse Sung <jesse@cola.voip.idv.tw>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 fs/char_dev.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.2.orig/fs/char_dev.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/fs/char_dev.c	2005-07-13 10:54:19.000000000 -0700
@@ -139,7 +139,7 @@
 	struct char_device_struct *cd = NULL, **cp;
 	int i = major_to_index(major);
 
-	up(&chrdevs_lock);
+	down(&chrdevs_lock);
 	for (cp = &chrdevs[i]; *cp; cp = &(*cp)->next)
 		if ((*cp)->major == major &&
 		    (*cp)->baseminor == baseminor &&

[11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Suresh Siddha <suresh.b.siddha@intel.com>

Appended patch will setup compatibility mode TASK_SIZE properly.  This will
fix atleast three known bugs that can be encountered while running
compatibility mode apps.

a) A malicious 32bit app can have an elf section at 0xffffe000.  During
   exec of this app, we will have a memory leak as insert_vm_struct() is
   not checking for return value in syscall32_setup_pages() and thus not
   freeing the vma allocated for the vsyscall page.  And instead of exec
   failing (as it has addresses > TASK_SIZE), we were allowing it to
   succeed previously.

b) With a 32bit app, hugetlb_get_unmapped_area/arch_get_unmapped_area
   may return addresses beyond 32bits, ultimately causing corruption
   because of wrap-around and resulting in SEGFAULT, instead of returning
   ENOMEM.

c) 32bit app doing this below mmap will now fail.

  mmap((void *)(0xFFFFE000UL), 0x10000UL, PROT_READ|PROT_WRITE,
	MAP_FIXED|MAP_PRIVATE|MAP_ANON, 0, 0);

Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: Andi Kleen <ak@muc.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 arch/x86_64/ia32/ia32_binfmt.c  |    5 +----
 arch/x86_64/kernel/process.c    |    4 ++--
 arch/x86_64/kernel/ptrace.c     |   17 ++++++++++-------
 arch/x86_64/kernel/sys_x86_64.c |   14 ++++----------
 arch/x86_64/mm/fault.c          |    2 +-
 include/asm-x86_64/a.out.h      |    2 +-
 include/asm-x86_64/processor.h  |   11 ++++++-----
 7 files changed, 25 insertions(+), 30 deletions(-)

--- linux-2.6.12.2.orig/arch/x86_64/ia32/ia32_binfmt.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/ia32/ia32_binfmt.c	2005-07-13 10:56:37.000000000 -0700
@@ -46,7 +46,7 @@
 
 #define IA32_EMULATOR 1
 
-#define ELF_ET_DYN_BASE		(TASK_UNMAPPED_32 + 0x1000000)
+#define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
 
 #undef ELF_ARCH
 #define ELF_ARCH EM_386
@@ -307,9 +307,6 @@
 
 #define elf_addr_t __u32
 
-#undef TASK_SIZE
-#define TASK_SIZE 0xffffffff
-
 static void elf32_init(struct pt_regs *);
 
 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
--- linux-2.6.12.2.orig/arch/x86_64/kernel/process.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/kernel/process.c	2005-07-13 10:56:37.000000000 -0700
@@ -656,7 +656,7 @@
 
 	switch (code) { 
 	case ARCH_SET_GS:
-		if (addr >= TASK_SIZE) 
+		if (addr >= TASK_SIZE_OF(task))
 			return -EPERM; 
 		cpu = get_cpu();
 		/* handle small bases via the GDT because that's faster to 
@@ -682,7 +682,7 @@
 	case ARCH_SET_FS:
 		/* Not strictly needed for fs, but do it for symmetry
 		   with gs */
-		if (addr >= TASK_SIZE)
+		if (addr >= TASK_SIZE_OF(task))
 			return -EPERM; 
 		cpu = get_cpu();
 		/* handle small bases via the GDT because that's faster to 
--- linux-2.6.12.2.orig/arch/x86_64/kernel/ptrace.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/kernel/ptrace.c	2005-07-13 10:56:37.000000000 -0700
@@ -257,12 +257,12 @@
 			value &= 0xffff;
 			return 0;
 		case offsetof(struct user_regs_struct,fs_base):
-			if (value >= TASK_SIZE)
+			if (value >= TASK_SIZE_OF(child))
 				return -EIO;
 			child->thread.fs = value;
 			return 0;
 		case offsetof(struct user_regs_struct,gs_base):
-			if (value >= TASK_SIZE)
+			if (value >= TASK_SIZE_OF(child))
 				return -EIO;
 			child->thread.gs = value;
 			return 0;
@@ -279,7 +279,7 @@
 			break;
 		case offsetof(struct user_regs_struct, rip):
 			/* Check if the new RIP address is canonical */
-			if (value >= TASK_SIZE)
+			if (value >= TASK_SIZE_OF(child))
 				return -EIO;
 			break;
 	}
@@ -419,6 +419,8 @@
 		break;
 
 	case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
+	{
+		int dsize = test_tsk_thread_flag(child, TIF_IA32) ? 3 : 7;
 		ret = -EIO;
 		if ((addr & 7) ||
 		    addr > sizeof(struct user) - 7)
@@ -430,22 +432,22 @@
 			break;
 		/* Disallows to set a breakpoint into the vsyscall */
 		case offsetof(struct user, u_debugreg[0]):
-			if (data >= TASK_SIZE-7) break;
+			if (data >= TASK_SIZE_OF(child) - dsize) break;
 			child->thread.debugreg0 = data;
 			ret = 0;
 			break;
 		case offsetof(struct user, u_debugreg[1]):
-			if (data >= TASK_SIZE-7) break;
+			if (data >= TASK_SIZE_OF(child) - dsize) break;
 			child->thread.debugreg1 = data;
 			ret = 0;
 			break;
 		case offsetof(struct user, u_debugreg[2]):
-			if (data >= TASK_SIZE-7) break;
+			if (data >= TASK_SIZE_OF(child) - dsize) break;
 			child->thread.debugreg2 = data;
 			ret = 0;
 			break;
 		case offsetof(struct user, u_debugreg[3]):
-			if (data >= TASK_SIZE-7) break;
+			if (data >= TASK_SIZE_OF(child) - dsize) break;
 			child->thread.debugreg3 = data;
 			ret = 0;
 			break;
@@ -469,6 +471,7 @@
 		  break;
 		}
 		break;
+	}
 	case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
 	case PTRACE_CONT:    /* restart after signal. */
 
--- linux-2.6.12.2.orig/arch/x86_64/kernel/sys_x86_64.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/kernel/sys_x86_64.c	2005-07-13 10:56:37.000000000 -0700
@@ -68,13 +68,7 @@
 static void find_start_end(unsigned long flags, unsigned long *begin,
 			   unsigned long *end)
 {
-#ifdef CONFIG_IA32_EMULATION
-	if (test_thread_flag(TIF_IA32)) { 
-		*begin = TASK_UNMAPPED_32;
-		*end = IA32_PAGE_OFFSET; 
-	} else 
-#endif
-	if (flags & MAP_32BIT) { 
+	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
 		/* This is usually used needed to map code in small
 		   model, so it needs to be in the first 31bit. Limit
 		   it to that.  This means we need to move the
@@ -84,10 +78,10 @@
 		   of playground for now. -AK */ 
 		*begin = 0x40000000; 
 		*end = 0x80000000;		
-	} else { 
-		*begin = TASK_UNMAPPED_64; 
+	} else {
+		*begin = TASK_UNMAPPED_BASE;
 		*end = TASK_SIZE; 
-		}
+	}
 } 
 
 unsigned long
--- linux-2.6.12.2.orig/arch/x86_64/mm/fault.c	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/mm/fault.c	2005-07-13 10:56:37.000000000 -0700
@@ -350,7 +350,7 @@
 	 * (error_code & 4) == 0, and that the fault was not a
 	 * protection error (error_code & 1) == 0.
 	 */
-	if (unlikely(address >= TASK_SIZE)) {
+	if (unlikely(address >= TASK_SIZE64)) {
 		if (!(error_code & 5) &&
 		      ((address >= VMALLOC_START && address < VMALLOC_END) ||
 		       (address >= MODULES_VADDR && address < MODULES_END))) {
--- linux-2.6.12.2.orig/include/asm-x86_64/a.out.h	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/include/asm-x86_64/a.out.h	2005-07-13 10:56:37.000000000 -0700
@@ -21,7 +21,7 @@
 
 #ifdef __KERNEL__
 #include <linux/thread_info.h>
-#define STACK_TOP (test_thread_flag(TIF_IA32) ? IA32_PAGE_OFFSET : TASK_SIZE)
+#define STACK_TOP TASK_SIZE
 #endif
 
 #endif /* __A_OUT_GNU_H__ */
--- linux-2.6.12.2.orig/include/asm-x86_64/processor.h	2005-06-17 12:48:29.000000000 -0700
+++ linux-2.6.12.2/include/asm-x86_64/processor.h	2005-07-13 10:56:37.000000000 -0700
@@ -160,16 +160,17 @@
 /*
  * User space process size. 47bits minus one guard page.
  */
-#define TASK_SIZE	(0x800000000000UL - 4096)
+#define TASK_SIZE64	(0x800000000000UL - 4096)
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? 0xc0000000 : 0xFFFFe000)
-#define TASK_UNMAPPED_32 PAGE_ALIGN(IA32_PAGE_OFFSET/3)
-#define TASK_UNMAPPED_64 PAGE_ALIGN(TASK_SIZE/3) 
-#define TASK_UNMAPPED_BASE	\
-	(test_thread_flag(TIF_IA32) ? TASK_UNMAPPED_32 : TASK_UNMAPPED_64)  
+
+#define TASK_SIZE 		(test_thread_flag(TIF_IA32) ? IA32_PAGE_OFFSET : TASK_SIZE64)
+#define TASK_SIZE_OF(child) 	((test_tsk_thread_flag(child, TIF_IA32)) ? IA32_PAGE_OFFSET : TASK_SIZE64)
+
+#define TASK_UNMAPPED_BASE	PAGE_ALIGN(TASK_SIZE/3)
 
 /*
  * Size of io_bitmap.

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Andi Kleen]

On Wed, Jul 13, 2005 at 11:44:26AM -0700, Greg KH wrote:
> -stable review patch.  If anyone has any objections, please let us know.

I think the patch is too risky for stable. I had even my doubts
for mainline.

-Andi

Re: [stable] Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Greg KH]

On Wed, Jul 13, 2005 at 08:49:47PM +0200, Andi Kleen wrote:
> On Wed, Jul 13, 2005 at 11:44:26AM -0700, Greg KH wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> 
> I think the patch is too risky for stable. I had even my doubts
> for mainline.

Ok, thanks, I've removed it out of the queue.

greg k-h

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Siddha, Suresh B]

On Wed, Jul 13, 2005 at 08:49:47PM +0200, Andi Kleen wrote:
> On Wed, Jul 13, 2005 at 11:44:26AM -0700, Greg KH wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> 
> I think the patch is too risky for stable. I had even my doubts
> for mainline.

hmm.. Main reason why Andrew posted this for stable series is because of
the memory leak issue mentioned in the patch changeset comments...

We have not seen any stability issues because of this patch so far(its been
there for more than a month in -mm series). Lack of this patch is actually 
causing us more troubles (DOS/app failures/..).

thanks,
suresh

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Justin M. Forbes]

On Thu, Jul 14, 2005 at 09:45:17AM -0700, Siddha, Suresh B wrote:
> On Wed, Jul 13, 2005 at 08:49:47PM +0200, Andi Kleen wrote:
> > On Wed, Jul 13, 2005 at 11:44:26AM -0700, Greg KH wrote:
> > > -stable review patch.  If anyone has any objections, please let us know.
> > 
> > I think the patch is too risky for stable. I had even my doubts
> > for mainline.
> 
> hmm.. Main reason why Andrew posted this for stable series is because of
> the memory leak issue mentioned in the patch changeset comments...
> 
I would say if Andi has concerns for this stable series, we should indeed
leave it out.  That said, I will be testing this patch a bit further
myself, and because it does address a real memory leak issue, we should
consider it or another fix for stable 2.6.12.4.

Justin M. Forbes

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Siddha, Suresh B]

On Fri, Jul 15, 2005 at 10:53:33AM -0500, Justin M. Forbes wrote:
> That said, I will be testing this patch a bit further

Thanks. Let me know if you see any issues.

> myself, and because it does address a real memory leak issue, we should
> consider it or another fix for stable 2.6.12.4.

Appended patch will just fix the memory leak issue. Atleast, we should
apply this.

thanks,
suresh
--

malicious 32bit app can have an elf section at 0xffffe000.  During
exec of this app, we will have a memory leak as insert_vm_struct() is
not checking for return value in syscall32_setup_pages() and thus not
freeing the vma allocated for the vsyscall page.

Check the return value and free the vma incase of failure.

Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>


--- linux-2.6.12.2/arch/x86_64/ia32/syscall32.c.orig	2005-06-29 16:00:53.000000000 -0700
+++ linux-2.6.12.2/arch/x86_64/ia32/syscall32.c	2005-07-15 18:09:06.684409144 -0700
@@ -57,6 +57,7 @@
 	int npages = (VSYSCALL32_END - VSYSCALL32_BASE) >> PAGE_SHIFT;
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
+	int ret;
 
 	vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 	if (!vma)
@@ -78,7 +79,11 @@
 	vma->vm_mm = mm;
 
 	down_write(&mm->mmap_sem);
-	insert_vm_struct(mm, vma);
+	if ((ret = insert_vm_struct(mm, vma))) {
+		up_write(&mm->mmap_sem);
+		kmem_cache_free(vm_area_cachep, vma);
+		return ret;
+	}
 	mm->total_vm += npages;
 	up_write(&mm->mmap_sem);
 	return 0;

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Andi Kleen]

On Fri, Jul 15, 2005 at 07:17:44PM -0700, Siddha, Suresh B wrote:
> On Fri, Jul 15, 2005 at 10:53:33AM -0500, Justin M. Forbes wrote:
> > That said, I will be testing this patch a bit further
> 
> Thanks. Let me know if you see any issues.
> 
> > myself, and because it does address a real memory leak issue, we should
> > consider it or another fix for stable 2.6.12.4.
> 
> Appended patch will just fix the memory leak issue. Atleast, we should
> apply this.

Looks good. Thanks, Suresh.

-Andi

Re: [stable] Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Chris Wright]

* Andi Kleen (ak@suse.de) wrote:
> On Fri, Jul 15, 2005 at 07:17:44PM -0700, Siddha, Suresh B wrote:
> > On Fri, Jul 15, 2005 at 10:53:33AM -0500, Justin M. Forbes wrote:
> > > That said, I will be testing this patch a bit further
> > 
> > Thanks. Let me know if you see any issues.
> > 
> > > myself, and because it does address a real memory leak issue, we should
> > > consider it or another fix for stable 2.6.12.4.
> > 
> > Appended patch will just fix the memory leak issue. Atleast, we should
> > apply this.
> 
> Looks good. Thanks, Suresh.

Queued for next -stable.

thanks,
-chris

Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Horst von Brand]

Greg KH <gregkh@suse.de> wrote:
> -stable review patch.  If anyone has any objections, please let us know.
> Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
> Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
> Cc: Andi Kleen <ak@muc.de>

Huh? Cc: in here?

> Signed-off-by: Andrew Morton <akpm@osdl.org>
> Signed-off-by: Chris Wright <chrisw@osdl.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> ---
-- 
Dr. Horst H. von Brand                   User #22616 counter.li.org
Departamento de Informatica                     Fono: +56 32 654431
Universidad Tecnica Federico Santa Maria              +56 32 654239
Casilla 110-V, Valparaiso, Chile                Fax:  +56 32 797513

Re: [stable] Re: [11/11] x86_64: TASK_SIZE fixes for compatibility mode processes

[Greg KH]

On Wed, Jul 13, 2005 at 06:05:32PM -0400, Horst von Brand wrote:
> Greg KH <gregkh@suse.de> wrote:
> > -stable review patch.  If anyone has any objections, please let us know.
> > Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
> > Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
> > Cc: Andi Kleen <ak@muc.de>
> 
> Huh? Cc: in here?

Hold over from Andrew's scripts that add this.

thanks,

greg k-h

[01/11] If ACPI doesn't find an irq listed, don't accept 0 as a valid PCI irq.

[Greg KH]

-stable review patch.  If anyone has any objections, please let us know.

------------------

If ACPI doesn't find an irq listed, don't accept 0 as a valid PCI irq.
That zero just means that nothing else found any irq information either.

Fixes http://bugme.osdl.org/show_bug.cgi?id=4824

Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/acpi/pci_irq.c |    2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.12.2.orig/drivers/acpi/pci_irq.c	2005-07-13 10:53:01.000000000 -0700
+++ linux-2.6.12.2/drivers/acpi/pci_irq.c	2005-07-13 10:56:30.000000000 -0700
@@ -433,7 +433,7 @@
 		printk(KERN_WARNING PREFIX "PCI Interrupt %s[%c]: no GSI",
 			pci_name(dev), ('A' + pin));
 		/* Interrupt Line values above 0xF are forbidden */
-		if (dev->irq >= 0 && (dev->irq <= 0xF)) {
+		if (dev->irq > 0 && (dev->irq <= 0xF)) {
 			printk(" - using IRQ %d\n", dev->irq);
 			acpi_register_gsi(dev->irq, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
 			return_VALUE(0);