Summary of changes from v2.6.0-test9 to v2.6.0-test10 ============================================ [libata] only reset if ATA_FLAG_SATA_RESET is present [libata] add per-driver port init/shutdown hooks, with helper defaults [libata] convert Promise to packetized DMA [libata] add ->host_stop hook, and copy ->private_data from probe_ent [libata] fill in a lot more Promise PDC20621 support [libata] more pdc20621 work [libata] kill timer when thread dies Noticed and fixed by David Woodhouse. [libata] fix Promise build on older compilers [libata] PDC20621 hdma fixes [IPV4]: Fix SKB handling in ipmr xmit. [IRDA]: Fix references to dead mailing lists and URLs. [NET]: Forward port iproute2 build fix from 2.4.23-preX [SPARC]: Fix emul paths to be root relative. [IPSEC]: Strengthen policy checks. [IPV6]: Fix IPSEC oops, RTF_NDISC flag gets dropped in __xfrm6_bundle_create(). [NET]: Limit SO_BSDCOMPAT warning. [IPV4]: Fix typo in ipmr.c [PATCH] atkbd: 0xfa is ACK The 0xfa code can be a key scancode or it can be a protocol scancode. Only few keyboards use it as a key scancode, and if we always interpret it as a protocol scancode then these rare keyboards will have a dead key. If we interpret it as a key scancode then we have a dead keyboard in case it was protocol. Clearly it is safer to prefer to interpret it as a protocol scancode. This moves the test for ACK and NAK up, so that they are always seen as protocol. This is just a minimal patch. What I did in 1.1.54 was to keep track of commands sent with a flag reply_expected, so that 0xfa could be taken as ACK when a reply is expected and as key scancode otherwise. That is the better solution, but requires larger surgery. [PATCH] Relax FATFS validity tests The first FAT entry should have the media byte (0xf0,0xf8,...,0xff) extended with all 1 bits in the first FAT entry. Checking this is a good idea, it prevents us from mounting garbage as FAT - there is no good magic for FAT. Unfortunately, Windows does not enforce this, and 2.4 doesn't either. It turns out that there are filesystems around (two reports so far) that have a zero first FAT entry, and work under Windows and 2.4 but fail to mount under 2.6. So, this weakens the test. [PATCH] sonypi: fix Zoom/Thumbphrase button events This corrects the Zoom and Thumbphrase button events. [PATCH] meye: documentation This documents the existence of a forth 'motioneye' camera plugged into the USB bus, of course unsupported by the meye driver. [PATCH] Essential x86-64 updates The most important part is that it makes x86-64 compile again. Without that 2.6 users won't be very happy. It also works around a bug that allowed every user program to reboot the system on B stepping K8. Also update to match some recent i386 fixes. Full ChangeLog: - Add acpi_pic_set_level_irq to make ACPI compile again - Work around compat mode K8 bug in IRET exception handling - Increase exception stack. The old 1k stack was too easy to overflow (from Jim Paradis, changed by me) - Replace safe_smp_processor_id with cpuid (needed for above) - When there is only one node always enable fake_node mode - Merge with i386 (NTP gettimeofday monoticity fix, irq nr_vectors change) - Fix compile problem for UP kernels in time/cpufreq - Set all nodes online at bootup - Define node_to_cpumask correctly [PATCH] fix h8/300 support - add 'sched_clock' - delete smplock.h [PATCH] fix __div64_32 to do division properly This fixes the generic __div64_32() to correctly handle divisions by large 32-bit values (as used by nanosleep() and friends, for example). It's a simple bit-at-a-time implementation with a reduction of the high 32-bits handled manually. Architectures that can do 64/32-bit divisions in hardware should implement their own more efficient versions. Add a sticky "PF_DEAD" task flag to keep track of dead processes. Use this to simplify 'finish_task_switch', but perhaps more importantly we can use this to track down why some processes seem to sometimes not die properly even after having been marked as ZOMBIE. The "task->state" flags are too fluid to allow that well. Properly terminate /proc/tty/driver/serial output lines of known UARTS when the caller has no CAP_SYS_ADMIN capability. [NETFILTER]: Fix modular iptables build. [NET]: Fix oops in ethertap_rx(). [IPV6]: Typo in address comparison. [IPV6]: Use real storage for cork'd packets, else MSG_MORE corrupts UDP packets. [IPV4,6]: Use common storage for cork'd flow, needed to handle mapped-ipv4 ipv6 addresses properly. [IPV6]: Process ipv4-mapped addresses properly on UDPv6 sockets. [NETFILTER]: Fix ipchains oops in NAT We updated ip_nat_setup_info to set the initialized flag and call place_in_hashes, but *didn't* change the call in ip_fw_compat_masq.c which also calls place_in_hashes() itself (again!). Result: corrupt list, and next thing which lands in the same hash bucket goes boom. Thanks to Andy Polyakov for chasing this down. [IPV6]: Fix bogus semicolon typo in mcast.c [NETFILTER]: Fix potential OOPS in ipt_REDIRECT. Revert signal handling changes in tcp.c - they break SIGURG. Cset exclude: kuznet@ms2.inr.ac.ru|ChangeSet|20031021052951|52463 Revert "Zero initial timestamps are valid" changeset. I am still not sure that this change all by itself is enough to make us accept zero initial timestamps properly. Cset exclude: davem@nuts.ninka.net|ChangeSet|20031025060257|60993 [IPV6]: Do not virt_to_page() on stack addresses, fixes OOPS. [IPSEC]: Fix accidental too many ref drops on policies. Put the compiler barrier() on the right side of the preemption enable on UP-PREEMPT. Without this, the enable could "migrate" up into the critical region (on SMP, the actual spinlock would act as an additional barrier and PREEMPT was ok). [PATCH] Fix DM on top of raid Force Device-Mapper to use PAGE_SIZE or smaller I/O when the underlying device has a bvec_merge_fn routine registered. This will fix the situation of Device-Mapper submitting I/Os to RAID-0 that span the RAID-0 chunk boundaries. Joe is working on a better solution that actually honors the MD merge_bvec_fn routine. But this minimal change will fix the problem for the time being. [PATCH] ia64: fix perfmon UP breakage Fix ZOMBIE race with self-reaping threads. exit_notify() used to leave a window open when a thread died that made the thread visible as a ZOMBIE even though the thread reaped itself. This closes that window by marking the thread DEAD within the tasklist_lock. Don't force PS/2 mouse rate or resolution by default. Only set the rate/resolution if the user actually asked for it. Some mice and KVM switches don't like to have their rate forced. [PATCH] Fix binfmt_misc locking This fixes a sleep-in-spinlock bug for binfmt_misc registration. That lock is purely for the list, not for the dentry. [PCMCIA] Fix card detection. Idea from David Hinds. Some PCMCIA/Cardbus controllers seem to get upset when we ask them to re-do card interrogation - they miss the next insertion event. We therefore avoid forcing needless card interrogations if a card has already been succesfully detected and interrogated. [PATCH] ia64: fix 2 more perfmon2 bugs Here is the minimal patch that fixes things that do not work and that can be noticed fairly easily: - remove a typo in pfm_check_task_state() which causes PFM_READ_PMDS to fail when context is in PFM_MASKED state. - fix a typo in perfmon_mcklinley.h when checking the value combinations for when writing to PMC14. This could reject a valid request to program PMC14. [LLC]: Fix array indexing in llc_add_pack(). [LLC]: In llc_ui_connect(), return error properly when device not found. [IPV4]: Make sure ipgre_tunnel_init() gets the correct ioctl settings. [SERIAL PATCH] 1672/1: Restore sizeof(struct serial_struct) Patch from SAN People Patch 2.4.21-rmk1 added a "iomap_base" field to the serial_struct structure (include/linux/serial.h). Since that structure is exported to user-space it should be consistent between revisions of the stable 2.4 kernels. This patch removes 4 bytes (were "reserved") to restore the size of the structure. Without this patch, ioctl(TIOCGSERIAL) will copy_to_user() 4 bytes more than expected and possibly corrupt the application's stack/heap. [SPARC]: Add AIO syscalls, 32-bit compat handling will come later. [SPARC64]: Fix preempt handling in dec_and_lock.S [IPV6]: Fix inappropriate usage of inet{,6}_sk(). [IPV4]: Remove out-of-date info CONFIG_INET help text. [PATCH] osst buglet Fixes a "Bad page state at destroy_compound_page" error. [PATCH] Strange SCSI messages In SCSI messages, sdsdd should have been sdd. That is, these days error printing is a bit broken. [IPV6]: Fix outdated and inaccurate information in Kconfig help. [libata] Add paranoia checks/settings suggested by Promise [SPARC64]: Get preempt building and working again. - HAVE_DEC_LOCK depends on SMP - Trap return preemption check needs interrupt disabled check - Implement write_trylock - Fix in_atomic() definition when PREEMPT enabled [TCP]: When SYN is set, the window is not scaled. [PATCH] Fix alpha "white box" boot Here's a show-stopper patch for Alpha; missing it prevents several of our platforms ("white box" 3000 and 5000 series) from booting. [ACPI] REVERT acpi_ec_gpe_query(ec) fix that crashed non-T40 boxes http://bugme.osdl.org/show_bug.cgi?id=1171 [ACPI] REVERT ACPICA-20030918 CONFIG_ACPI_DEBUG printk that caused crash http://bugzilla.kernel.org/show_bug.cgi?id=1341 [NET/COMPAT]: Fix copying of ipt_entry objects in do_netfilter_replace(). As noted by Georg Chini, ipt_entry object are of variable size so just copying individual struct ipt_entry slots around does not work. [NETFILTER]: Add IPCHAINS to MAINTAINERS entry. [LLC]: Fix oops in procf handling. [PATCH] ibmtr_cs/ibmtr - get working again Patch to get ibmtr_cs / ibmtr working again. A change went in a while back I missed that killed it. Also fixed the timer to eliminate the uninitialized timer error on close. [PATCH] digi_accelport warning fix Use the correct type for the workqueue callback. [PATCH] JBD: use-after-free fix The wait_event() in there can touch the memory at *transaction after kjournald has freed it. Rework the code to not wait until the transaction enters T_FLUSH state: just loop back and try against after the wakeup. [PATCH] WinTV-D patch to make tuner functional From: "Brad House" Quick patch to enable the Philips tuner on the WinTV-D boards. Tested and works fine. (acked by Gerd) [PATCH] bttv jiffies warning fix Use unsigned long for time_after(), not an int. [PATCH] Export some symbols on x86-64 From: Andi Kleen Export two symbols on x86-64. This is needed for the sk98lin driver and ipv6. [PATCH] /proc/tty/driver/serial formatting fix From: Matthias Andree Properly terminate /proc/tty/driver/serial output lines of known UARTS when the caller has no CAP_SYS_ADMIN capability. [PATCH] direct-io typo fix From: Klaas de Waal Bug in parameter of ZERO_PAGE macro in line 679 of fb/direct-io.c Parameter dio->cur_user_address has to be dio->curr_user_address. This bug shows when compling for MIPS little endian as target, not when compiling for X86. [PATCH] sis900 skb free fix This driver is freeing skb's from timer context, with local irq's disabled. It generates warnings from local_bh_enable() because local_bh_enable() reenables interrupts, exposing the machine to deadlocks. So use the deferred dev_kfree_skb_irq() instead. [LLC]: llc_lookup_listener has to consider the 'any' mac address [LLC]: fix net_device refcounting bug [LLC]: fix bug that prevented fcntl(O_NONBLOCK) from working with PF_LLC sockets [PATCH] r8169 module license tag [LLC]: set local mac addr at connect time when userland left it as zeroes [netdrvr 8139too] add pci id [netdrvr starfire] include asm/io.h Fixes build on some platforms. [PATCH] Fix compatibily issue with some APs [PATCH] 2.6.0-test8: fix ARM ether driver naming Ensure that arm ether drivers print the correct ether device name rather than "eth%d". [pcmcia fmvj18x_cs] share interrupts properly for TDK multifunction cards. [netdrvr bonding] fix monitoring functions This fix got missed in the bonding patchset applied a while ago. [NET]: Allow SOMAXCONN to be adjusted via sysctl. [NET]: Introduce dev_getbyfirsthwtype. [LLC]: when the user doesn't specifies a local address to connect, do an autobind Other protocols do this as soon as they discover over what interface the packet will be routed, but LLC isn't routable, so, to provide similar semantics to the other protocols, I'm just binding it to the first interface of the type specified, perhaps we'll need a tunable for this or some sort of routing table done manually by the admin, later we'll see, for now this allows an application like openssh, with patched getaddrinfo/getnameinfo to use PF_LLC sockets with a very small patch. [SPARC]: Fix _IOC_SIZE() macro when direction is _IOC_NONE. [PATCH] fix starfire 64-bit b0rkage (x >> 32) is undefined on a 32 bit integral variable in C; In contrast (x >>16 >> 16) is fine (and gets optimized out to 0, while (x >> 32) gets optimized out to a nop). Fix for starfire below [PATCH] Fix wireless stats locking [netdrvr 3c527] add MODULE_LICENSE tag JFS: remove racy, redundant call to block_invalidatepage __invalidate_metapages references mp->page after after releasing the meta_lock spinlock, without increasing the use count. This is racy and unnecessary since setting the META_discard flag is sufficient. block_invalidatepage() will be called when the metapage is released. [NET]: Make skb_copy_expand() copy header area too. [PATCH] PCI: fix bug in pci_setup_bridge() This bug prevents Alphas with older firmware from booting if there is a card with PCI-PCI bridge that supports 32-bit IO. This has happened on AS2100 with a quad-tulip card, for example: - initially, the I/O window of 21152 bridge was 0x10000-0x10fff, as set up by firmware; - pci_setup_bridge() is going to change this, say, to 0xa000-0xafff: first, it updates PCI_IO_BASE_UPPER16 and PCI_IO_LIMIT_UPPER16 registers, so that IO window temporarily is at 0x0000-0x0fff, which effectively blocks up all legacy IO ports in the lower 4K range, such as serial, floppy, RTC an so on; does debugging printk - machine dies here with recursive machine checks as the serial console has gone. Moving (or disabling) the debugging printk is not a solution - there is possibility that timer interrupt (which might access RTC ports) occurs between writes to lower and upper parts of the base/limit registers. The patch temporarily disables the IO window of the bridge by setting PCI_IO_BASE_UPPER16 > PCI_IO_LIMIT_UPPER16 before doing an update. It's safe, as we don't have any active IO behind the bridge at this point. Also, it's a NOP for bridges with 16-bit-only IO. Similar (but simpler, as we always clear upper 32 bits) fix for 64-bit prefetchable MMIO range. [PATCH] I2C: remove some MOD_INC and MOD_DEC usages that are not needed anymore. [PATCH] USB: don't build the whiteheat driver if on SMP as the locking is all messed up. [PATCH] Fix for module initialization failure Bug reported by Paul Mackerras: if a module parameter fails, we didn't call module_arch_cleanup(). On x86 this was harmless (module_arch_cleanup() is a no-op), but on other architectures like PPC this causes inconsistent data structures and subsequent oopses. JFS: Fix race between link() and unlink() JFS isn't happy it thinks a file has been removed, and link() increases its nlink count back from zero. In 2.4, i_zombie prevented this race condition. http://bugzilla.kernel.org/show_bug.cgi?id=866 [CRYPTO]: crypto_alg_lookup() should fail when passed a NULL name. [IPSEC]: Missing NULL algorithm checks in AH and IPCOMP init. [LLC]: Fix sockaddr, only need to provide one MAC address not three. Stop SIS 96x chips from lying about themselves. Some machines with the SIS 96x southbridge have it set up to claim it is a SIS 503 chip. That breaks irq routing logic among other things. Fix it properly by making everybody aware of the duplicity. [SPARC]: Eliminate references to linux/smp_lock.h, from willy. [IPX]: Fix OOPS when ipxcfg_auto_create_interfaces is on. Buslogic is MCA capable as well as PCI and ISA [IPX]: Memset newly allocated atalk private area. [IPX]: Fix checksum computation. [IPX]: Missing memset()'s in route and interface creation. [netdrvr 8139cp] fix NAPI race Cures reported lockups. [libata] fix bugs in SATA reset code path [libata] add Promise SATA pci id [APPLETALK]: Mark me as the maintainer. [PATCH] add support for new nForce IDE controllers Original 2.4.23-pre4 patch by Allen Martin . This does not add any new code, it only adds new PCI ID's and related info to the existing driver. [PATCH] AMD/nForce driver update From Vojtech Pavlik . Change AMD8111 and nForce2 max speed to UDMA133. Add workaround for Serenade mainboards which only handle UDMA100. Fix printing of chipset name. Fix some whitspace issues. Forward-port PIRQ table updates from 2.4.x This separates out the PIRQ table parsing to vendor-specific code, which allows us to handle specific vendor quirks. In particular, SiS has a really funky notion of what PCI device ID's are meant to be. Some hardware designers seem to be hitting the recreational drugs a bit too heavily. Tssk, tssk. The Sis96x irq routing update is confirmed to fix at least one laptop. Cset exclude: akpm@osdl.org|ChangeSet|20031029192849|64746 [IPV4/IPV6]: Fix one more inappropriate use of inet6_sk()->ipv6only [LLC]: fix procfs reading when there are saps without sockets [LLC]: fix client side after sockaddr_llc fixup [PATCH] More SiS AGP ids This extends the agppart table with three new SiS chipsets that must be handled as the other ones. No actual code changes. Avoid user space access with interrupts disabled in vm86 support. Getting a signal while in vm86 caused warnings because we still had interrupts disabled - for no good reason. Enable interrupts before accessing user space. Only truncate file types that can be truncated on minixfs. Only regular files, directories and symbolic links can have any blocks allocated to them - other types of files have different metadata in their inodes and should not get to the truncation paths. Enforce this in fs/minix/inode.c. Without this, deleting a block or character device can cause minix filesystem corruption. Noted by Konstantin Boldyshev. [PATCH] ia64: fix bug in SN2 sn_pci_map_sg that causes MCA If sg->dma_address is set, we try to do a __pa() on a dma_address, then, later, create a dma_addresss from a munged dma_address. When this bogus dma_address is used by the card, it results in MCAs. [PATCH] drivers/pci DEBUG build fix Trivial build fix for the debug code in drivers PCI. Seems like nobody has had to use this code in a long time. [PATCH] ia64: don't access per-CPU data of off-line CPUs This patch prevents a crash that happens when per-CPU data is allocated only for CPUs that are online. [PATCH] Fix ISAPNP netdev initialization Moving isapnp further down in the bus initialization obviously sparked some new problems. Instead, remove the legacy netdev probing function from dev.c and give it its own initcall later in the cycle. [PATCH] fix ide-tape oops Set filp->private_data in idetape_chrdev_open() to point to a opened drive, otherwise driver oopses during future access to tape character device. Thanks to Stef van der Made for testing ide-tape fixes. [PATCH] fix rq->flags use in ide-tape.c Noticed by Stuart_Hayes@Dell.com: I've noticed that, in the 2.6 (test 9) kernel, the "cmd" field (of type int) in struct request has been removed, and it looks like all of the code in ide-tape has just had a find & replace run on it to replace any instance of rq.cmd or rq->cmd with rq.flags or rq->flags. The values being put into "cmd" in 2.4 (now "flags", in 2.6) by ide-tape are 8-bit numbers, like 90, 91, etc... and the actual flags that are being used in "flags" cover the low 23 bits. So, not only do the flags get wiped out when, say, ide-tape assigns, say, 90 to "flags", but also the 90 gets wiped out when one of the flags is modified. I noticed this, because ide-tape checks this value, and spews error codes when it isn't correct--continuously--as soon as you load the module, because ide-tape is calling ide_do_drive_cmd with an action of ide_preempt, which causes ide_do_drive_cmd to set the REQ_PREEMPT flag, so "flags" isn't the same when it gets back to idetape_do_request. [EBTABLES]: Fix ebt_limit for HZ=1000 [NETFILTER]: get_unique_tuple doesn't always return unique tuple. get_unique_tuple doesn't check that the tuple is unique if it finds a hash_by_src match. [NETFILTER]: Fix ip_queue_maxlen sysctl. [NETLINK]: Initialize nl_pad in getname and recvmsg, noticed by Uli Drepper. [IRDA]: Fix irlmp seqfile, initialize the iterator in start. [IPV4]: Initialize ARP seqfile state in start() method. [IRDA]: Fix SKB leaks in af_irda.c, from Arnaldo Carvalho de Melo. [PATCH] Fix crash-on-boot in init_l440gx SMP ioremap_nocache() doesn't need to check for physical address wraps because __ioremap() has already done that; fix calculation of npages to handle non-aligned phys_addr; [SPARC64]: Preserve cache/side-effect PTE bits in pte_modify(). Bug noticed by Russell King. [PATCH] Fix panic-at-boot This fixes a panic-at-boot when ACPI Hotplug PCI is compiled in, but ACPI is disabled. It just makes sure that the list is properly initialized statically instead of depending on runtime initialization that may or may not happen. [IPV6]: Fix OOPS on NETDEV_CHANGENAME events. [IRDA]: Fix two OOPSers in IrCOMM - Do not do copy_from_user() under spinlock - Always access self->skb under spinlock Original patch from Martin Diehl. [IRDA]: Fix races between IRNET and PPP. - Prevent sending status event to dead/kfree sockets - Disable PPP access before deregistration PPP deregistration might sleep -> race condition [IRDA]: Fix IrLMP open leak. - Prevent 'self' leak on error in irlmp_open. ASSERT is compiled in only with DEBUG option => risk = 0. Original patch from Chris Wright. [IPV6]: Fix /proc/sys/net/ipv6/icmp permissions. [IPV6]: In ip6ip6 tunnel, set skb->h.raw after obtaining private copy. [IPV6]: In ip6ip6 tunnel, user provides flowlabel in network byte order. [IRDA]: Fix IRQ save/restore handling in seq file handlers. IRDA was restoring IRQ flags in a different function from which they were saved which explodes on certain platforms. It did not need to use _irq{save,restore}() anyways since the seqfile layer always invokes these routines from user context with interrupts enabled, so using plain spin_{lock,unlock}_irq() works just fine. [TG3]: Fix bugs in ETHTOOL_SSET introduced by ethtool_ops conversion. - Missing spin_lock*() calls before tp->link_config twiddling. - Missing assignment to tp->link_config.autoneg [TG3]: Bump driver version and release date. Fix cut-and-paste error in radeonfb.c From Ronald Lembcke. [PATCH] fix visws irq breakage This fixes visws subarch which was broken by asm-i386/hw_irq.h changes [PATCH] fix segment accounting with bounced pages There's a problem with bio segment accounting for pages that reside above the bounce limit of a queue. When submitted, they may be considered part of another segment. A condition that changes when the page gets bounced. This can cause us to send bio's that have too many segments to a driver. The best fix is to always consider pages above q->bounce_pfn as seperate segments. That's the conservative approach and the easy fix. Problem identified and fixed by Herbert Xu. [libata] fix ugly Promise interrupt masking bug [libata] bump libata version [PATCH] Drop spin lock when calling request_module in quota code From Herbert Xu [NET]: Fix skb_copy_expand offset calculation. [NET]: Do not run netdev todo work from linkwatch code. [PATCH] Fix cramfs metadata races There's a few places that use incorrect exclusion for the cramfs raw data access buffers. The proper lock is "read_mutex" (and BKL does nothing). - fix mount-time read and block number initialization without the mutex held. - cramfs_readdir() needs to copy the name and inode information into a separate buffer since it can't hold the semaphore over the (potentially blocking) user mode access - cramfs_lookup() needs to hold the access lock over the whole function, not just the read itself - use generic_file_llseek on directories to get i_sem exclusion on readdir/lseek [PATCH] PCI: Fix oops in quirk_via_bridge I have a VIA cardbus 1394 controller which oops on insertion after an APM suspend/resume cycle (without card inserted): bounds: 0000 [#1] CPU: 0 EIP: 0060:[] Tainted: PF EFLAGS: 00010206 EIP is at quirk_via_bridge+0x4/0x1c eax: 0000ffff ebx: c02982e0 ecx: d1958000 edx: 000c0010 esi: d1958000 edi: 00000001 ebp: 00000000 esp: da401ee8 ds: 007b es: 007b ss: 0068 Process pccardd (pid: 1093, threadinfo=da400000 task=da4c8780) Stack: c019fb85 d1958000 00000001 d1958000 00000000 c019fbc2 d1958000 00000001 c02980a0 d1958000 dfdebf14 c019d828 00000001 d1958000 00000000 dec2802c dfdebf00 dfdebf14 00000000 e3dfe7c7 dfdebf00 00000000 dec2802c da401f48 Call Trace: [] pci_do_fixups+0x52/0x54 [] pci_fixup_device+0x3b/0x49 [] pci_scan_slot+0x46/0x8f [] cb_alloc+0x29/0xf7 [pcmcia_core] [] socket_insert+0x90/0x102 [pcmcia_core] [] socket_detect_change+0x54/0x7e [pcmcia_core] [] pccardd+0x185/0x1f9 [pcmcia_core] quirk_via_bridge (which is marked device PCI_ANY_ID) triggers on my 1394 controller which vendor=VIA but is not a bridge. Making the quirk __devinit solves the problem. [PATCH] USB: fix a thread-exit problem at module unload This patch fixes a thread-exit problem when the usb-storage module is unloaded with a preemptable kernel. Please refer to the comments in the code for more detail. [PATCH] USB: usb ignores 64bit dma The dma hooks whereby EHCI can pass 64bit DMA support up the driver stack (to avoid buffer copies) turn out to broken on most architectures(*). This patch just disables them all, since it looks like those mechanisms won't get fixed before 2.6.0-final. For now it'd only matter on a few big Intel boxes anyway. Please merge. - Dave (*) On x86, mips, and arm dma_supported() doesn't even compare with the device's mask. On several other architectures (reported on ppc, alpha, and sparc64), asking that question for non-PCI devices will just BUG() -- even though all info needed to answer the question is right at hand. [libata] fix Promise PCI posting bugs [PATCH] Fix IP checksum for SuSE 9.0 compiler The hammer branch based gcc 3.3 in SuSE 9.0 has a more aggressive optimizer. ip_send_check has this code: iph->check = 0; iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl); The new gcc optimizes the first store away because it doesn't know that ip_fast_csum reads its input memory. This leads to occassionally packets with wrong IP header checksum getting sent; this happens especially with NFS. Fixing it in the constraints would have been ugly and probably not future proof, so this patch just adds a memory clobber to ip_fast_csum. For some reason the issue only hits in 2.6, we haven't seen it in 2.4. Problem occurs on both i386 and x86-64. Credit goes to Olaf Kirch for tracking this down. [PATCH] fix reference count bug with class devices When a kobject is associated with a kset, the kset MUST be set before the kobject is initialized (by either a call to kobject_register() or kobject_init()). This patch fixes the class code which improperly set the kset after the kobject was initialized, which would cause improper reference counts on the kset. Thanks to Mike Anderson for locating the source of this bug. [netdrvr b44] Fix irq enable/disable; fix oops due to lack of SET_NETDEV_DEV() call Also, add suspend/resume functions. [netdrvr pcnet32] add missing pci_dma_sync_single a patch for the pcnet32.c driver which adds a missing call to pci_dma_sync_single. If a received packet is smaller than rx_copybreak the pcnet driver will recycle the receive buffer which requires calling pci_dma_sync_single. Patch is against 2.6 but I it's also needed in 2.4. Without that call the processor might still have old stale data in the data cache when the processor accesses the recycled buffer. Don't fold nanosleep() into clock_nanosleep(). The latter has buggy restart functionality and is a lot more complicated anyway. [PATCH] Fix TSS limit on x86-64 The limit of the TSS segment was incorrectly set to a too big value on x86-64. This lead to the CPU reading random memory behind the main TSS when iopl was >0, but there was no ioperm bitmap set. This caused random failures in port accesses in this state. Set the correct limit. [PATCH] Fix oops in x86-64 strace path Fix a nasty typo found by Albert Cahalan. This lead to an oops when a invalid syscall was called under strace in 2.6. [PATCH] SMP signal latency fix The code that sends a signal needs to "kick" the target process if it runs on another CPU and wasn't woken up by the signal to let it know that it has a new event. Otherwise it might take a long time until the target actually notices and acts on the signal. [TCP]: Normalize jiffies values reported to userspace. [NET]: Use cpumask_t for cpumap in flow cache. [IPV6]: Fix hangs during interface down caused by ipv6_del_addr(). While using PRIVACY extensions, I sometimes get a hang when I remove the interface. But I can reproduce this every time using the test script at the end of the mail (hang depends on the order of address deletion). The bug is in ipv6_del_addr() where if a temp address is being deleted, it does an __in6_ifa_put() of the main address from which it was derived (basically the autoconf prefix address). So if the main address was deleted first, it's ifp ref count would be 1 and it would 'wait' to be freed till it's temp address was freed first. When the temp address is deleted, the __put() routine drops the main address's ifp ref count to 0, but not free it. unregister_netdevice() hangs giving message that ref count is 1. Fix tested overnight. Also, the code at the top of the routine is unnecessary, the same is being done when the address is found a little later in that routine. [PATCH] Fix critical issue in x86-64 IOMMU code The K8 IOMMU code had some broken BUG_ON()s that hit with <4K aligned IO through the IOMMU. This patch fixes this. Without this database raw IO is often broken. [PATCH] input: Always reset PS/2 mouse resolution and update speed to default values after probing This sets the mouse to 100 samples/second, 200 dpi, 1:1 mapping, which is a standard setting, as close to 2.4 XFree86 behavior as possible, and a good performance setting, too. It also in the case of 'psmouse_noext' doesn't probe and set anything all, though it still issues the RESET command. This is as safe as one can get. The only real problem remaining is that the report rate and resolution cannot be set from XFree86 config and only is available as a kernel/module parameter. The fix is, howewer not 2.6.0 material. [PATCH] Work around K8 errata on x86-64 K8 has an erratum (#100) that essentially causes some compat mode processes to fault occassionally. The issue can be worked around in the OS. It only applies to x86-64, in 32bit it is fine. This adds a check to the page fault handler that checks for addresses >4GB from compat mode. If they happen just return; the CPU will reexecute the instruction and the condition that caused the problem is gone. More details in Opteron/Athlon64 specification update on the AMD website. Also I removed a left over debugging printk in the prefetch handling code. [ARM] Fix ARM signal handling. If we are unable to deliver a signal to the process (eg, due to stack pointer corruption) block the signal so other fatal signals can kill off the process. [NET]: Bart wrote arpt_mangle not DaveM. :-) [JIFFIES]: linux/times.h needs asm/param.h (for USER_HZ) [IPV4/IPV6]: Normalize jiffies reported to userspace in routing code. [PATCH] PPC32: Fix alignment problem with __ex_table and __bug_table. The __start___ex_table and __start___bug_table symbols could end up pointing a few bytes before the actual __ex_table and __bug_table sections, if the preceding section had an odd length. This led to oopses in some situations. Patch from Sam Ravnborg. [PATCH] Fix nfsd extra dput() An extra dput was introduced in nfsd_rename 20 months ago.... time to remove it. [PATCH] AS: handle non-block requests From: Nick Piggin as_completed_request() can be called for requests which were not generated by the generic block layer. Handle these, to avoid a subsequent WARN_ON (at least). Also kill a separate WARN_ON which is bogusly triggering. [PATCH] 3c509 MCA compile fix Only include mca.h if CONFIG_MCA: only ia32 and ia64 have [PATCH] ext2 block allocation race fix If this CPU decides that an ext2 block group has a free block it will then go in and try to acquire it. No locks are held, so another CPU can come in and steal the last block. In this case we will bogusly report a corrupted filessytem. Fix it by just restarting the scan - this will choose a different blockgroup or will generate -ENOSPC. [PATCH] Disable IDE Tagged Command Queueing It's not ready for prime time yet, so hide it until the additional work has been done. [PATCH] char dev request_module fix From: Rusty Russell Module aliases are all of form "char-major--". char_dev.c calls request_module with "char-major-". [PATCH] Fix RAID1 recovery From: Mike Tran This fixes the RAID1 recovery problems; it seems to be a simple thinko: sync_request_write() is passing "ok=0" into md_done_sync(). Clearly, `ok' should be true here. (acked by neilb) [PATCH] JBD: fix assertion failure This fixes a JBD assertion failure (goes BUG) in __journal_remove_journal_head(). When the journal had aborted due to earlier internal consistency errors (or I/O errors) it is possible that we free journal_heads which still have attached copyout buffers. So just free them up. [PATCH] compile fix for voyager with gcc-3.3 From: James Bottomley The cpu_callout_map differs from the prototype in asm-i386/smp.h by a volatile. gcc-3.3 now treats this as an error, so voyager support will only compile with older gcc's. The fix is to remove the spurious volatile. [libata promise] fixes suggested by Promise * flush host FIFO after sending data to DIMM window * don't set SCR addresses, as the hardware doesn't have SCRs (cosmetic) [PATCH] Warn about old EZD and DM disk remappers Since 2.6.x by default does not remap the disk partitions any more, it would be a good idea to warn when we see EZD or DM signatures. That informs the user to fix his setup (or pass in "hdx=remap" on the kernel command line). Fix pte_modify() bug which allowed mprotect() to change too many bits. Found by Russell King. [PATCH] ia64: fix bug in prof_cpu_mask_read_proc() Display of cpumask for /proc/irq/prof_cpu_mask has a botch in the print loop - should consume 2 bytes per loop. ia64: Fix _PAGE_CHG_MASK so PROT_NONE works again. Caught by Linus. [DECNET]: Normalize jiffies reported to userspace. [IPV4/IPV6]: More userland jiffies reporting fixes for routing. [SPARC64]: Fix PCI floppy IRQ enable/disable handling. - Delete fd_{enable,disable}_irq() interfaces, never used. - Move ebus_dma_irq_enable() calls into sun_pci_fd_{request,free}_irq(). Fix double unlock of page_table_lock in do_wp_page(). Noticed by Petr Vandrovec. In the out-of-memory case, do_wp_page() would unlock page_table_lock twice - once before allocating, and once in the exit path. Rewrite the exit paths to be more readable, and don't try to share the code between all the exit cases, since they are very different. NTFS: Minor bug fix in attribute list attribute handling that fixes the I/O errors on "ls" of certain fragmented files found by at least two people running Windows XP. [PATCH] Fix AIO reference counts This makes the AIO submit path holds an extra reference until just before returning. This fixes the referencing a free kiocb. Without this patch the kernel will oops if the AIO completes early. Avoid racy optimization in signal sending. The bug is probably impossible to trigger on x86, due to its fairly strong coherency model (the SMP-safe bitops end up being memory barriers etc), but other architectures - notably ppc64 - can apparently trigger a race whereby the signal sender doesn't wake up the target because it doesn't notice that it has gone to sleep. The optimization also optimizes only what appears to be the uncommon case, where the signal happens for an already-running process. [PATCH] ia64: fix is_headless_node() for SN Without this patch, SN machines which have nodes that contain memory only (no CPUs will hang. [PATCH] Fix clock_nanosleep() signal restart issues The problem with clock_nanosleep() restarting was that the address of the users return timespec was being saved at the wrong place. In needs to be saved in the sys call interface code rather than the do_clock_nanosleep(). My original tests were a bit weak as they only did one signal rather than two or more which were required to break it. The attached patch fixes the problem. I also added a few comments about how restart works, and added my name to the MAINTAINERS list. [IPVS]: avoid NULL ptr deref for dest in __ip_vs_get_out_rt [NET]: Remove __devinitdata from board_info[] in tlan.c driver. [IPVS]: make sure timer expires on one cpu Fix ALI 15x3 IDE driver oops It would oops on any machines that had an ALI northbridge but didn't have the exact ISA bridge we expected. Always disable system call restart when invoking a signal handler. Otherwise, a restarted system call that gets interrupted before the restart has taken effect by _another_ signal will potentially restart the wrong system call. ia64: From Linus: Always disable system call restart when invoking a signal handler. Otherwise, a restarted system call that gets interrupted before the restart has taken effect by _another_ signal will potentially restart the wrong system call. [IPV6]: Fix packet quoting in icmpv6_send(). - Mucking with the original skb pointers with push/pull around the packet quoting was wrong, muching with these pointers could cause problems with others using the SKB. It was also buggy, it only handled the case where skb->nh.raw was ahead of or equal to skb->data - The fix is to record skb->nh.raw - skb->data and use this as a base offset in calls to skb_copy_and_csum_bits(). This is what the pre-IPSEC code did. This fixes IPV6 oopses and packet corruption on 64-bit platforms when sending UDP port unreachable ICMP messages. Reported and analyzed by Jan Oravec (jan.oravec@6com.sk) Re-instate the ALI northbridge checks in ALI IDE driver This leaves just the minimal oops protection in place, and maintains the logic that "if we have a non-ALI northbridge, we shouldn't touch any of the GPIOs because we don't know what they might be connected to". [PATCH] Legacy ALi5455 Audio Driver update We've resolved some bugs in legacy ALi5455 audio driver. [PATCH] ALI IDE forward port from 2.4.x This forward-ports some more of the ALI IDE sanity checks from the 2.4.x tree. In particular, we only do the enable bits for revisions < 0xC5 [IPV6]: Fix len calculation after icmp changes. [netdrvr tg3] initialize workqueue correctly (fixes crash) [netdrvr de4x5] NE54-de4x5 - fix missing free on error path - found by viro [IPV6]: Fix ref count bug in MLDv2, test idev->dead instead of IFF_UP. lasi700: Fix missed variable name change causing module load error [PATCH] ia64: invoke schedule_tail unconditionally on ia32 emulation The #ifdef CONFIG_SMP around the call to schedule_tail was removed a long time ago for native ia64, but ia32 emulation continues to have a #ifdef. We saw a bunch of weird behavior with respect to getpid() on multithreaded programs (they behave ok on SMP, but break on UP). Don't panic on a corrupt MP table. It's likely just a broken UP BIOS. So just print a warning and continue. [SPARC]: Port over x86 signal bugfix in cset 1.1431. [COMPAT]: Fix arguments to compat statfs64 syscalls, 'sz' was missing. [SPARC64]: For 32-bit processes, use compat statfs64 syscall handlers not the normal ones. [PATCH] make 2.6 megaraid recognize intel vendor id The 2.4 megaraid driver recognizes the Intel PCI vendor id whereas the 2.6 driver does not. The attached patch against 2.6.0-test9 adds the missing two lines from the 2.4 driver to enable this. [PATCH] Improper mapping of ACPI-HPET table Early ACPI table parse for HPET tables has a bug, where in it does not do proper set_fixmap for ACPI-HPET table. This bug was lost in oversight, and was not noticed during my testing too, as the ACPI-HPET table on all my test systems happened to be in 1st Gig of memory (where __va() will do the job). [PATCH] PPC32: Don't oops on out-of-range system call This patch fixes a bug on PPC where the kernel will oops if a process does a system call and the system call number is out of range. While fixing that, I noticed that if the process is being ptraced, an out-of-range system call will not get traced on the way in but will on the way out. This patch fixes that too, by making it get traced on the way in as well as the way out. It turned out to be less change, and fewer instructions overall, to do that than to make the out-of-range system call not be traced at all. [PATCH] PPC32: cancel syscall restart on signal delivery This patch ensures that the PPC kernel cancels any pending restarted system call when it delivers a signal. This is the PPC counterpart of the change that has recently gone into i386 and other architectures. [PATCH] scsi_device refcounting and list lockdown - shost->my_devices is gone and replaced by ->__devices, which is not exposed to drivers and locked by the host lock. Use the exported helpers that do proper refcounting to access it. - sdev->access_count is gone as a side-effect, the sg interfaces to export it now return 1 for a present scsi_device. - drivers/scsi/host.h is empty now. ia64: Fix bug in fsys_rt_sigprocmask() which breaks new-stub-enabled libc/NPTL. Disable system call restart at sigreturn time rather than when invoking the signal. This fixes all races. As per discussion with Paul Mackerras on linux-kernel. [PATCH] Fix ppc system restart properly We're actually much better off resetting system call restart at signal return. This makes all other resets unnecessary. Here's the ppc version of it. [ARM] Fix system call restarting Always disable system call restart when returning from a signal handler. This follows the new x86 behaviour. [netdrvr tulip] fix hashed setup frame code It is using local variable `i' in both the inner and outer loop. Need to bring the for loop outside the loop. Otherwise we need to reset the setup_frame to tp->setup_frame after every loop. You do not need to set the setup_frm for every mc address, we can set once after the complete has_table is ready. [PATCH] Off-by-one bug in user page calculations for Direct I/O On Sun, 16 Nov 2003, Kai Makisara wrote: > On Sun, 16 Nov 2003, Alan Stern wrote: > > > The page count calculations in drivers/scsi/st.c (and copied in sg.c) are > > wrong. The code says: > > > > nr_pages = ((uaddr & ~PAGE_MASK) + count - 1 + ~PAGE_MASK) >> > > PAGE_SHIFT; > > > > That will compute an incorrect value if the user's buffer happens to end > > on the first byte of a new page. Example: Suppose uaddr starts right on > > Your analysis is correct and this is a bug. Could you send the fix to > James Bottomley for inclusion into the scsi-bugfixes-2.6 bk tree (at least > the st part). > > Thanks for noticing the bug. > > Kai > > P.S. I usually write these ((base ~ mask) + count + PAGE_SIZE - 1) >> > PAGE_SHIFT. I don't know why I did it like this here. One should never try > to be clever and do something in a new way or copy something that does not > match one's own standard ways of doing things ;-) On Mon, 17 Nov 2003, Douglas Gilbert wrote: > Alan, > ... and the sg part as well .. > > > Thanks for noticing the bug. > > dito > > Doug Gilbert [PATCH] Fix double module_put in lockd kernel_thread() returns the pid if successful, so the test for errors is to test for _negative_ values. [PATCH] Fix bootmem breakage on ARM Russell King reports: "With previous kernels, the nodes are added to the list in reverse order, so architecture code knew we had to add the highest PFN first and the lowest PFN node last. Unfortunately, init_bootmem_core() now sorts the nodes according to their start pfn. This active sorting broke ARM discontig memory support." Andrew Morton chimes in: "It looks to be bogus on ia64 as well, for which the patch was written" Yep, I think it is bogus. There's only one caller on ia64 that would be affected--swiotlb_init(), and afaik multi-node systems won't be using that code (except maybe NEC?), so even if the pgdat list is out of order we should be ok. If not I'll fix the ia64 discontig code. Add missing .module initialisation to lasi700 and sim710 This bug prevents their module refcounts being increased by opending upper layer drivers Thus they can be removed at any time and panic the system. [SPARC]: Update to changeset 1.1445 version of signal fix. [SPARC]: Do not provide VGA_CONSOLE for sparc builds. While here, fix the existing conditional. The || should be an && as all config options mentioned should prevent VGA_CONSOLE from being offered. [IPV6]: Fix UDP socket selection for multicast. When binding to two different multicast addresses on the same UDP port, a copy sent to either multicast address is delivered to both. [IPV6]: Verify nlmsg_len in rt6_dump_route(). [PATCH] PPC64: Fix possible race in syscall restart This is the PPC64 counterpart of the fix for the potential race in the syscall restart code that has gone into other architectures. It resets current_thread_info()->restart_block.fn to do_no_syscall_restart in the sigreturn code. [IPV4]: Always set hoplimit metric, even for non-unicast routes. [NET SCHED]: Adjust qlen when grafting in multiple qdiscs [NET SCHED]: Reset q.qlen in tbf_reset instead of purging an unused queue. Problem introduced by cset 1.1046.1.318 [NET SCHED]: Fix queue limits in multiple qdiscs. [IPV6]: Fix milliseconds to jiffies conversion in multicast code. [PATCH] Fix scsi_report_lun_scan sign bug We need to make the scan data unsigned, since we do length = ((data[0] << 24) | (data[1] << 16) | (data[2] << 8) | (data[3] << 0)); and if data[3] is 0xff, this expression will always evaluate to 0xffffffff. etcetera. [PATCH] gcc bug workaround for constant_test_bit() From: Zwane Mwaikambo gcc-3.2.2-5 miscompiles constant_test_bit(). Tweak it so the compiler gets it right. It cleans it up too! [PATCH] videobuf_waiton race fix There's a window in this function where a wakeup can get lost. [PATCH] gettimeofday resolution fix From: Stephen Hemminger The original problem all this is solving is that when NTP is slowing the clock there existed real cases where time appeared to go backwards. Assuming NTP was slowing the clock, then it would update the xtime by 999us at the next timer interrupt. If a program read time three times: A: xtime = t0 B: A+1000 xtime = t0 + 1000 C: B+1 xtime = t0 + 999 To behave correctly C > B > A; but we were returning C < B The code does have bug if we are losing clock interrupts. The test for lost interrupts needs to be after the interval clamp. [PATCH] sched_clock() fix From: Thomas Schlicter sched_clock() will try to use the TSC even if the system is not using the TSC as a time source. It causes bad scheduling decisions and poor interactivity. The problem was exhibited by the patch which uses ACPI PM as a time source, but could also happen if the system is using the PIT. [PATCH] reiserfs pinned buffer fix From: Oleg Drokin reiserfs shouldn't be holding a ref against a buffer when running set_blocksize(): it means that truncate_inode_pages() cannot free that page. Which is not fatal - the page will drift aimlessly down the LRU until the VM nails it. But it's better this way. [PATCH] ia32: hugetlb needs pse From: Zwane Mwaikambo If the CPU doesn't support PSE we cannot use hugetlb pages. [PATCH] Fix bugs in ext2_new_inode() From: Mingming Cao I found several bugs/issues in the ext2_new_inode() code: 1) The for loop variable "i" is used to save the inode offset. In the case of failure, the loop variable could be crapped. So it is possible to quit searching before looking at every block groups. 2) The number of free inodes in the selected group is possibly being miscalculated. The counter is only decreased in the find_group_xx() functions for the initial selected group. If the initial try failed, and succeed in finding a free inode in other group, the counter for that group will not to be decreased. 3) In case of the concurrent case, going back to find_group_xx() functions are unnecessary, it will only get the same group as before. The following patch fixed those issues. Ideas are stolen from ext3_new_inode(). [PATCH] remove ext2_reserve_inode() It now has no callers. [PATCH] fix percpu_counter_mod linkage problem If both ext2 and ext3 are built as modules there is nothing to pull percpu_counter_mod() into the kernel build and the ext2 and ext3 modules do not load. So move percpu_counter_mod() out of lib.a. [PATCH] ide-scsi: warn when used for cdroms From: Jens Axboe Print a runtime warning if ide-scsi is used on a cd device. Modify the ide-scsi menuconfig help to reflect that ide-scsi should not be used for cd burning. [PATCH] ext3_new_inode fixlet From: Alex Tomas If the ext3 inode allocator tries to claim an inode and fails because another CPU got in there first it will then advance onto the next blockgroup and try again. Change it to advance onto the next inode within the same blockgroup instead. [PATCH] ext2 block allocator fixes Fix a couple of problems which were introduced by a recent race fix in the ext2 block allocator: - if the allocation attempt raced, and lost the race then a new attempt is made. But the earlier reservation must be put back first. Add a call to group_release_blocks() to fix this. - if the filesystem is genuinely corrupted then the code as-is can get stuck in an infinite loop, thinking that a blockgroup has free blocks and then discovering that its bitmap is full. Fix this by baling out after having scanned all blockgroups twice. (Thanks Muli Ben-Yehuda for spotting this). [PATCH] init.h needs to include compiler.h From: Jun Sun It is needed for all those "__attribute_used__" etc to be valid. Also, it seems that when compiling a file ending in ".S", gcc-2.95.3 does not expand __GNUC__ at all. This causes the compiler version check to fail when building vsyscall.S. So add __ASSEMBLY__ wrappers in there. [PATCH] cpu_sibling_map fix From: James Cleverdon On summit-based machines the cpu_sibling_map data has been hosed for some time. I found out why in Intel's IA-32 Software Deveveopers' Manual Vol 2 under CPUID. Looks like the value that cpuid returns is the one latched at reset, and doesn't reflect any changes made by the BIOS later: * Local APIC ID (high byte of EBX)--this number is the 8-bit ID that is assigned to the local APIC on the processor during power up. This field was introduced in the Pentium 4 processor. Also, the code in init_intel was a bit overdesigned. Until Intel releases a chip with a non-power-of-2 sibling count on it, there's no point in all that bit bashing. [PATCH] fs/ext[23]/xattr.c pointer arithmetic fix From: Andreas Gruenbacher 64-bit pointer arithmetic bug in xattr code The int offset is not enought to hold the difference between arbitraty pointers on 64-bit machines. Compute the offset of here and last inside HDR(bh) instead. [PATCH] resource.c bounds checking fix From: Jeremy Higdon I believe there is a bug in kernel/resource.c. We (SGI sn2 I/O code) are using this for allocating dma map resources, and we tracked failures we were seeing to find_resource(). The problem is that when testing bounds in the forever loop, the end bound would be one higher than it should be if it gets set from another resource (it's set to the proper value when it gets set from the root), causing find_resource to return an invalid min/max when the requested size was one greater than would fit between two existing resources. [PATCH] mpparse printk fix From: Herbert Xu The recent patch produces a message with no terminating newline on the machine in question. This is because one of the four bytes that you're printing out is NUL. The following patch avoids that problem. [PATCH] disallow modular BINFMT_ELF From: Adrian Bunk Modular BINFMT_ELF doesn't build, and is pretty pathological anyway. So just make it a boolean rather than a tristate. [PATCH] fix scsi_report_lun_scan bug Original report and bug fix from: Amit Patel The problem was a signed vs unsigned char problem when computing luns for scanning. [SPARC]: Port over cset 1.1459 x86 gettimeofday fix. [IPV6]: In multicast code, set MAF_TIMER_RUNNING when timer is set. [IPV6]: Fix jiffies procfs output in multicast code. [IPV4]: Fix jiffies procfs output in multicast code. [SPARC]: Add missing symbol exports, this is fallout from kernel/ksyms.c being nuked. [SPARC64]: Get PCI floppies fully functional again. EBUS DMA fixes: - Add EBUS_DMA_FLAG_TCI_DISABLE that the client can set if it wants only to hear device interrupts, not DMA complete ones. - When initially resetting the EBUS DMA unit, put valid burst etc. encodings in the CSR register. Not doing this appears to leave the attached ISA device in a weird state. PCI FLOPPY fixes: - Do ebus_dma_enable() before ebus_dma_request() - In sun_pci_fd_set_dma_mode() do not forget to set the direction. - Set EBUS_DMA_FLAG_TCI_DISABLE in ebus_dma flags. - Make sure that in error paths sun_fdc/FCD1 will be -1 (invalid). Thanks to Soyoung Park for loaning her Ultra5 to me so I could fix this. [IPV4]: igmp.c needs linux/times.h [PATCH] [bonding 2.6] Restore missing backward compatibility This patch (against latest 2.6.0) is also waiting for almost a month. It's already in 2.4 but is still very much needed for 2.6. Old ifenslave versions (like the one in Red Hat 9) don't work with the bonding module in the latest 2.6 kernel without it. Amir [PATCH] [bonding 2.6] fix creation of /proc/net/bonding dir Fix the creation of the /proc/net/bonding dir. Patch is against 2.6. Amir [netdrvr tg3] fix BCM5705 pending-RX count (was 64, now 63) [netdrvr sis190] fix oopsable bug in TX path, related to skb_padto return Caught by Francois Romieu. [IPV6]: In igmp6_group_queried, fix address check to comply with RFC2710. RFC2710 says: 1) MLD messages are never sent for multicast addresses whose scope is 0 (reserved) or 1 (node-local). 2) MLD messages ARE sent for multicast addresses whose scope is 2 (link-local), including Solicited-Node multicast addersses [ADDR-ARCH], except for the link-scope, all-nodes address (FF02::1). The current MLDv1 code does not send reports for link-scope addresses and doesn't restrict scope 0. This may break switches that snoop reports for determining which ports should receive particular addresses. Patch below. ia64: Fix off-by-1 error in imm60 patching. The bug hasn't been observed in practice, but it's clearly wrong and just waiting there to get triggered... ia64: From Linus/Paulus: reset restart_block function in restore_sigcontext(). Also update ia32 subsystem accordingly. ia64: Drop printk from ia64_ni_syscall(). This is a temporary fix for 2.6.0. The proper fix is to replace ia64_ni_syscall with sys_ni_syscall, but that would make the patch quite large, so we defer that till 2.6.1. Limit USB storage transfers to 240 sectors. Work around binutils bug. This caused the system call code to test for the wrong number of system calls, with resulting exciting results. [IPV6]: Fix header length calculation in multicast input. It did not account for extension headers properly. If we get this length wrong, we do not determine if a multicast packet is MLDv1 vs. MLDv2 correctly. [PATCH] reserve resources specified by the PnPBIOS properly A bug prevents the PnP layer from reserving some of the resources specified by the PnPBIOS. As a result some systems will have unpredicable (random crashes etc.) problems because of resource conflicts, especially when PCMCIA support is enabled. This patch fixes the problem by ensuring that the proper resource data is reserved. [PATCH] More SiS interrupt routing It turns out that the SiS irq routing logic doesn't go by chipset after all - it's just that some pirq entries are "legacy" numbers, while others are raw offsets into PCI config space (and the legacy numbers are more commonly used with the older chipsets, which explains the correlations). This simplifies the router code substantially. Linux 2.6.0-test10