From: Arnd Bergmann <arnd@arndb.de>

Christian Bornträger noticed that the kernel can crash after <SysRq>-T.  It
appears that the show_task function gets called for all tasks, which does
not work if one of the tasks is running in a system call on another CPU.
In that case the result of thread_saved_pc and show_stack is undefined and
likely to cause a crash.

For tasks running in user space on other CPUs, show_task() is probably
harmless, but I'm not sure if that's true on all architectures.

The patch below is still racy for tasks that are about to sleep, but it
demonstrates the problem.

show_task() is preinting negative numbers for free stack due to arithmetic
against the wrong pointer.

Fix that up, and clean up a few related things.

show_task still has bogus code which atempts to work out how much stack the
task has ever used - it cannot work because we don't actually zero out the
stack pages when allocating them.  We should fix that, or take it out.

I find this handy sometimes: it makes the oops output include info as to
whether the user has selected CONFIG_PREEMPT, CONFIG_SMP or, particularly,
CONFIG_DEBUG_PAGEALLOC.  It can save one email round-trip.

From: "Martin J. Bligh" <mbligh@aracnet.com>

Make irqbalance into a config option - some people (jgarzik, arjan, etc)
wanted to be able to disable it and do things from userspace instead.  This
patch allows each camp to do their own thing, which seems fair ;-)

From: "Martin J. Bligh" <mbligh@aracnet.com>

Disallow NUMA on the i386 PC subarch (it doesn't work, nor was it intended
to).

From: "Martin J. Bligh" <mbligh@aracnet.com>

Makes sure pfn_to_nid is defined for all combinations of subarches, and that
it's defined before it's used so we don't run into implicit declaration
problems.

From: "Martin J. Bligh" <mbligh@aracnet.com>

Fix pfn_valid for architctures with discontiguous memory.  This only
changes the NUMA definition, and it leaves the NUMA-Q definition as was,
because it's faster that way, it's in hotpaths, and our memory is always
contiguous.

From: Andreas Gruenbacher <agruen@suse.de>

The fix for permission() that makes it compliant with POSIX.1-2001
apparently was lost.  Here is the patch I sent before.  (The relevant lines
from the standard text are cited in
http://www.ussg.iu.edu/hypermail/linux/kernel/0310.2/0286.html.  The fix
proposed in that posting did not handle directories without execute
permissions correctly.)


Make permission check conform to POSIX.1-2001

The access(2) function does not conform to POSIX.1-2001: For root
and a file with no permissions, access(file, MAY_READ|MAY_EXEC)
returns 0 (it should return -1).

drivers/net/bonding/bond_alb.c: In function `bond_alb_xmit':
drivers/net/bonding/bond_alb.c:1188: error: invalid lvalue in assignment

gcc-3.4 incorretly inlines rest_init() into start_kernel(), causing things to
crash when the .text.init section gets unloaded.  Use noinline to prevent
that.

From: Andi Kleen <ak@muc.de>

This patch adds the `noinline' function attribute.  It can be used to
explicitly tell the compiler to not inline functions.

We need this due to what is, IMO, a bug present in gcc-3.4 and current
gcc-3.5 CVS: the compiler is inlining init/main.c:rest_init() inside
init/main.c:start_kernel(), despite the fact that thay are declared to be
placed in different text sections.

From: Andi Kleen <ak@muc.de>

The upcomming gcc 3.4 has a new compilation mode called unit-at-a-time.
What it does is to first load the whole file into memory and then generate
the output. This allows it to use a better inlining strategy, drop unused
static functions and use -mregparm automatically for static functions.

It does not seem to compile significantly slower.

This is also available in some of the 3.3 based "hammer branch"
compilers used in distributions (at least in SuSE and Mandrake)

Some tests show impressive .text shrinkage from unit-at-a-time.

e.g. here is the same kernel compiled with -fno-unit-at-a-time and
-funit-at-a-time with a gcc 3.4 snapshot. The gains are really
impressive:

   text    data     bss     dec     hex filename
4129346  708629  207240 5045215  4cfbdf vmlinux-nounitatatime
3999250  674853  207208 4881311  4a7b9f vmlinux-unitatatime

.text shrinks by over 130KB!. And .data shrinks too.

At first look the numbers look nearly too good to be true, but they have been
verified with several configurations and seem to be real. It looks like
we have a lot of stupid inlines or dead functions. I'm really not
sure why it is that much better. But it's hard to argue with hard
numbers.

[A bloat-o-meter comparision between the two vmlinuxes can be found in
http://www.firstfloor.org/~andi/unit-vs-no-unit.gz . It doesn't show
any obvious candidates unfortunately, just lots of small changes]

With the gcc 3.3-hammer from SuSE 9.0 the gains are a bit smaller, but
still noticeable (>100KB on .text)

This patch enables -funit-at-a-time on ia32 if the compiler is gcc-3.4 or
later.  We had several reports of gcc-3.3 producing very early lockups.

From: Andi Kleen <ak@muc.de>, me.

Using -mregparm=3 shrinks the kernel further:

(compiled with gcc 3.4, without -funit-at-a-time, using the later and
together with -Os shrinks .text even more, making over 700KB difference)

4129346  708629  207240 5045215  4cfbdf vmlinux
3892905  708629  207240 4808774  496046 vmlinux-regparm

This one helps even more, >236KB .text difference. Clearly worth
the effort.

This patch adds an option to use -mregparm=3 while compiling the kernel.  I
did an LTP run and it showed no additional failures over an non regparm
kernel.

According to some gcc developers it should be safe to use in all gccs that
are still supports (2.95 and up)

I didn't make it the default because it will break all binary only modules
(although they can be fixed by adding a wrapper that calls them with
"asmlinkage").  Actually it may be a good idea to make this default with
2.7.1 or somesuch.

We add new kbuild infrastructure: the command

	scripts/gcc-version.sh $(CC)

will print out the version of gcc in a canonical 4-digit form suitable for
performing numerical tests against.
DESC
arch/i386/Makefile,scripts/gcc-version.sh,Makefile small fixes
EDESC
From: Serge Belyshev <33554432@mtu-net.ru>

arch/i386/Makefile:
*  omitted $(KBUILD_SRC)/ in script call.

scripts/gcc-version.sh:
*  GNU tail no longer supports 'tail -1' syntax.

We should consider adding -fweb option:

   vanilla:
   $ size vmlinux
      text    data     bss     dec     hex filename
   3056270  526780  386056 3969106  3c9052 vmlinux

   with -fweb:
   $ size vmlinux
      text    data     bss     dec     hex filename
   3049523  526780  386056 3962359  3c75f7 vmlinux

   Also note 0.1 ... 1.0% speedup in various benchmarks.
   This option is not enabled by default at -O2 because it
   (like -fomit-frame-pointer) makes debugging impossible.

Remove page validity test.  I had a warning in there for a few weeks, no
reports of it happening.

From: Manfred Spraul <manfred@colorfullife.com>

The patch is designed improve the diagnostics which are presented when the
slab memory poison detector triggers.


check_poison_obj checks for write accesses after kfree by comparing the
object contents with the poison value.  The current implementation contains
several flaws:

- it accepts both POISON_BEFORE and POISON_AFTER.  check_poison_obj is
  only called with POISON_AFTER poison bytes.  Fix: only accept
  POISON_AFTER.

- the output is unreadable.  Fix: use hexdump.

- if a large objects is corrupted, then the relevant lines can scroll of
  the screen/dmesg buffer.  Fix: line limit.

- it can access addresses behind the end of the object, which can oops
  with CONFIG_DEBUG_PAGEALLOC.  Fix: bounds checks.

Additionally, the patch contains the following changes:

- rename POISON_BEFORE and POISON_AFTER to POISON_FREE and POISON_INUSE.
  The old names are ambiguous.

- use the new hexdump object function in ptrinfo.

- store_stackinfo was called with wrong parameters: it should store
  caller, i.e.  __builtin_return_address(0), not POISON_AFTER in the
  object.

- dump both the object before and after the corrupted one, not just the
  one after.

Example output:
<<<
Slab corruption: start=194e708c, len=2048
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<02399d7c>](dummy_init_module+0x1c/0xb0)
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 7b
030: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 63
Prev obj: start=194e6880, len=2048
Redzone: 0x5a2cf071/0x5a2cf071.
Last user: [<00000000>](0x0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
<<<

From: Roland McGrath <roland@redhat.com>

Under some circumstances, ptrace PEEK/POKE_TEXT can cause page permissions
to be permanently changed.  Thsi causes changes in application behaviour
when run under gdb.

Fix that by only marking the pte as writeable if the vma is marked for
writing.  A write fault thus unshares the page but doesn't necessarily make
it writeable.

Print the name of the offending slab if we're going to go BUG in
kmem_cache_init().

Fairly pointless coding-style cleanups which I've been sitting on for ages.
The ramdisk driver is still buggy: it drops pagecache when unmounted.  I
still need to fix this.

Apparently it also displays data corruption under load even when not
unmounted.

Correct the cache setup bits for the 5407. This enables the write
buffers properly (despite what the previous comment said). This
combined with fixed cache flushing code provides a nice performance
boost on the 5407.

Also fix the ROMfs setup to only move the ROMfs region if it is actually
configured.

Added ELF relocation type defines.  These are needed by the module
loading code for m68knommu.

This adds the configuration option to enable the uClinux shared flat
binary support.  The code support is already in the binfmt_load code,
just the config option is missing.

Fix a number of memory leaks in the uClinux binfmt_flat loader.  All are
related to not cleaning up properly on failure conditions.

From: Janet Morgan <janetmor@us.ibm.com>

It looks like aio_nr and aio_max_nr were intended to be sysctl parameters.

From: Christoph Hellwig <hch@lst.de>

I've just grepped over the tree for reamining MOD_INC_USE_COUNT users, and
ftape is a really horrible one, it relies on MOD_{INC,DEV}_USE_COUNT in the
most horrible places + it's own bookkepping and the <= 2.4 may unload
hooks.  And although I don't have the hardware I can guarantee it doesn't
work as expected.

So let's just remove the module_exit handler and mark it unremovable, if
someone wants to fix up ftape later it's fine with me, but it's a really
scary driver..

From: "Art Haas" <ahaas@airmail.net>

Here's a small patch that adds C99 initializers to the file.

From: Matt Domsch <Matt_Domsch@dell.com>

Patch below applies to both 2.4.25 and 2.6.3, and replaces the public
domain statement and non-warranty with the GPL, as is permitted by the code
being in the public domain, and is done with legal advice.

From: Gerd Knorr <kraxel@bytesex.org>

"options tuner type=2" is just there for historical reasons and should
only be used/needed if the main driver doesn't allow to configure the
tuner type.  I'm not sure whenever I can remove that altogether without
breaking anything.  There are several users of the tuner module, some
outside the standard kernel tree ...

> >         if (type < TUNERS) {
> > +               t->type = type;
> >                 printk("tuner: type forced to %d (%s) [insmod]\n",
> >                        t->type,tuners[t->type].name);
> >                 set_type(client,type);

That is wrong, it will break in other corner cases, it may cause the
set_type() function not doing the initializations.

The prink can also be dropped because set_type does that too.  The patch
below removes that.  It also makes the kernel messages a bit more verbose
and adds support for two new tuners.

From: mcgrof@studorgs.rutgers.edu (Luis R. Rodriguez)

Complete the migration from Kconfig's undocumented "enable" to "select".

From: Pragnesh Sampat <pragnesh.sampat@timesys.com>

The file initramfs_data.cpio is slightly different when generated on
cygwin, compared to linux, which causes the kernel to panic with the
message "no cpio magic" (See Documentation/early-userspace/README).

The problem in cpio generation is due to the difference in sprintf
modifiers on cygwin.  The code uses "%08ZX" for strlen of a device node.
printf man pages discourages "Z" and has 'z' instead.  Both of these are
not available on cygwin sprintf (at least some versions of cygwin).  The
net result of all of this is that the generated file literally contains
"ZX" and then the strlen after that and messes up that 110 offset etc.  The
file is 516 bytes long on the system that I tested and on linux it is 512
bytes.

The fix below just uses "%08X" for that field.

From: Urban Widmark <urban@teststation.com>

Add the necessary bits for loop-over-smbfs.

From: Michael Frank <mhf@linuxmail.org>