--- /dev/null
+From stable-bounces@linux.kernel.org Wed Nov 8 20:02:01 2006
+Message-Id: <200611090358.kA93w8an004152@shell0.pdx.osdl.net>
+To: greg@kroah.com
+From: akpm@osdl.org
+Date: Wed, 08 Nov 2006 19:58:07 -0800
+Cc: akpm@osdl.org, benh@kernel.crashing.org, dtor@mail.ru, stable@kernel.org, olh@suse.de
+Subject: correct keymapping on Powerbook built-in USB ISO keyboards
+
+From: Olaf Hering <olh@suse.de>
+
+similar to the version in adbhid_input_register(): The '<>' key and the
+'^°' key on a german keyboard is swapped. Provide correct keys to
+userland, external USB keyboards will not work correctly when the
+'badmap'/'goodmap' workarounds from xkeyboard-config are used.
+
+It is expected that distributions drop the badmap/goodmap part from
+keycodes/macintosh in the xkeyboard-config package.
+
+This is probably 2.6.18.x material, if major distros settle on 2.6.18.
+
+Signed-off-by: Olaf Hering <olh@suse.de>
+Cc: Greg KH <greg@kroah.com>
+Cc: Dmitry Torokhov <dtor@mail.ru>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+Note: still not upstream, candidate to drop. Please advise.
+
+ drivers/usb/input/hid-core.c | 4 ++--
+ drivers/usb/input/hid-input.c | 17 +++++++++++++++++
+ drivers/usb/input/hid.h | 1 +
+ 3 files changed, 20 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.2.orig/drivers/usb/input/hid-core.c
++++ linux-2.6.18.2/drivers/usb/input/hid-core.c
+@@ -1734,10 +1734,10 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
+- { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
++ { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
+ { USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
+- { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
++ { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
+ { USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
+ { USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
+--- linux-2.6.18.2.orig/drivers/usb/input/hid-input.c
++++ linux-2.6.18.2/drivers/usb/input/hid-input.c
+@@ -123,6 +123,12 @@ static struct hidinput_key_translation p
+ { }
+ };
+
++static struct hidinput_key_translation powerbook_iso_keyboard[] = {
++ { KEY_GRAVE, KEY_102ND },
++ { KEY_102ND, KEY_GRAVE },
++ { }
++};
++
+ static int usbhid_pb_fnmode = 1;
+ module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
+ MODULE_PARM_DESC(pb_fnmode,
+@@ -197,6 +203,14 @@ static int hidinput_pb_event(struct hid_
+ }
+ }
+
++ if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) {
++ trans = find_translation(powerbook_iso_keyboard, usage->code);
++ if (trans) {
++ input_event(input, usage->type, trans->to, value);
++ return 1;
++ }
++ }
++
+ return 0;
+ }
+
+@@ -212,6 +226,9 @@ static void hidinput_pb_setup(struct inp
+
+ for (trans = powerbook_numlock_keys; trans->from; trans++)
+ set_bit(trans->to, input->keybit);
++
++ for (trans = powerbook_iso_keyboard; trans->from; trans++)
++ set_bit(trans->to, input->keybit);
+ }
+ #else
+ static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
+--- linux-2.6.18.2.orig/drivers/usb/input/hid.h
++++ linux-2.6.18.2/drivers/usb/input/hid.h
+@@ -260,6 +260,7 @@ struct hid_item {
+ #define HID_QUIRK_POWERBOOK_HAS_FN 0x00001000
+ #define HID_QUIRK_POWERBOOK_FN_ON 0x00002000
+ #define HID_QUIRK_INVERT_HWHEEL 0x00004000
++#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD 0x00010000
+
+ /*
+ * This is the global environment of the parser. This information is
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Nov 6 09:01:05 2006
+From: Auke Kok <auke-jan.h.kok@intel.com>
+To: jeff@garzik.org, torvalds@osdl.org, stable@kernel.org
+Message-Id: <20061106165712.BAA253FFEA@ahkok-mobl.jf.intel.com>
+Date: Mon, 6 Nov 2006 08:57:12 -0800 (PST)
+Cc: akpm@osdl.org, auke-jan.h.kok@intel.com, nhorman@redhat.com, cluebot@fedorafaq.org, laurent.riffard@free.fr, toralf.foerster@gmx.de, bruce.w.allan@intel.com, jesse.brandeburg@intel.com, rajesh.shah@intel.com, rjw@sisk.pl, e1000-list <e1000-devel@lists.sourceforge.net>, "Ronciak, John" <john.ronciak@intel.com>, pavel@ucw.cz, davej@redhat.com, notting@redhat.com, bunk@stusta.de, "John W. Linville" <linville@tuxdriver.com>
+Subject: e1000: Fix regression: garbled stats and irq allocation during swsusp
+
+e1000: Fix suspend/resume powerup and irq allocation
+
+From: Auke Kok <auke-jan.h.kok@intel.com>
+
+After 7.0.33/2.6.16, e1000 suspend/resume left the user with an enabled
+device showing garbled statistics and undetermined irq allocation state,
+where `ifconfig eth0 down` would display `trying to free already freed irq`.
+
+Explicitly free and allocate irq as well as powerup the PHY during resume
+fixes when needed.
+
+Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
+[chrisw: trivial 2.6.18 backport s/err/ret_val/]
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ drivers/net/e1000/e1000_main.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- linux-2.6.18.2.orig/drivers/net/e1000/e1000_main.c
++++ linux-2.6.18.2/drivers/net/e1000/e1000_main.c
+@@ -4683,6 +4683,9 @@ e1000_suspend(struct pci_dev *pdev, pm_m
+ if (adapter->hw.phy_type == e1000_phy_igp_3)
+ e1000_phy_powerdown_workaround(&adapter->hw);
+
++ if (netif_running(netdev))
++ e1000_free_irq(adapter);
++
+ /* Release control of h/w to f/w. If f/w is AMT enabled, this
+ * would have already happened in close and is redundant. */
+ e1000_release_hw_control(adapter);
+@@ -4710,6 +4713,10 @@ e1000_resume(struct pci_dev *pdev)
+ pci_enable_wake(pdev, PCI_D3hot, 0);
+ pci_enable_wake(pdev, PCI_D3cold, 0);
+
++ if (netif_running(netdev) && (ret_val = e1000_request_irq(adapter)))
++ return ret_val;
++
++ e1000_power_up_phy(adapter);
+ e1000_reset(adapter);
+ E1000_WRITE_REG(&adapter->hw, WUS, ~0);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Nov 14 02:07:33 2006
+Message-Id: <200611141003.kAEA3PMt029231@shell0.pdx.osdl.net>
+To: torvalds@osdl.org
+From: akpm@osdl.org
+Date: Tue, 14 Nov 2006 02:03:25 -0800
+Cc: akpm@osdl.org, monkey20181@gmx.net, daniel.ritz-ml@swissonline.ch, daniel.ritz@gmx.ch, bunk@susta.de, stable@kernel.org
+Subject: fix via586 irq routing for pirq 5
+
+From: Daniel Ritz <daniel.ritz-ml@swissonline.ch>
+
+Fix interrupt routing for via 586 bridges. pirq can be 5 which needs to be
+mapped to INTD. But currently the access functions can handle only pirq
+1-4. this is similar to the other via chipsets where pirq 4 and 5 are both
+mapped to INTD. Fixes bugzilla #7490
+
+Cc: Daniel Paschka <monkey20181@gmx.net>
+Cc: Adrian Bunk <bunk@susta.de>
+Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+ arch/i386/pci/irq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.2.orig/arch/i386/pci/irq.c
++++ linux-2.6.18.2/arch/i386/pci/irq.c
+@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *
+ */
+ static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
+ {
+- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
++ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
+ return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
+ }
+
+ static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
+ {
+- static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
++ static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
+ write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
+ return 1;
+ }
--- /dev/null
+From chrisw@hera.kernel.org Tue Nov 7 09:26:01 2006
+From: Sergey Vlasov <vsu@altlinux.ru>
+To: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 7 Nov 2006 20:02:36 +0300
+Message-Id: <11629189562984-git-send-email-vsu@altlinux.ru>
+Cc: linux-input@atrey.karlin.mff.cuni.cz, Sergey Vlasov <vsu@altlinux.ru>
+Subject: Input: psmouse - fix attribute access on 64-bit systems
+
+psmouse_show_int_attr() and psmouse_set_int_attr() were accessing
+unsigned int fields as unsigned long, which gave garbage on x86_64.
+
+Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/input/mouse/psmouse-base.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+ The problem was found in 2.6.18.2; the same patch applies to the
+ current tree.
+
+--- linux-2.6.18.2.orig/drivers/input/mouse/psmouse-base.c
++++ linux-2.6.18.2/drivers/input/mouse/psmouse-base.c
+@@ -1332,20 +1332,22 @@ ssize_t psmouse_attr_set_helper(struct d
+
+ static ssize_t psmouse_show_int_attr(struct psmouse *psmouse, void *offset, char *buf)
+ {
+- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
++ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
+
+- return sprintf(buf, "%lu\n", *field);
++ return sprintf(buf, "%u\n", *field);
+ }
+
+ static ssize_t psmouse_set_int_attr(struct psmouse *psmouse, void *offset, const char *buf, size_t count)
+ {
+- unsigned long *field = (unsigned long *)((char *)psmouse + (size_t)offset);
++ unsigned int *field = (unsigned int *)((char *)psmouse + (size_t)offset);
+ unsigned long value;
+ char *rest;
+
+ value = simple_strtoul(buf, &rest, 10);
+ if (*rest)
+ return -EINVAL;
++ if ((unsigned int)value != value)
++ return -EINVAL;
+
+ *field = value;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Nov 6 15:10:47 2006
+Date: Mon, 06 Nov 2006 15:07:16 -0800 (PST)
+Message-Id: <20061106.150716.102770484.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Cc: bunk@stusta.de
+Subject: NET: __alloc_pages() failures reported due to fragmentation
+
+We have seen a couple of __alloc_pages() failures due to
+fragmentation, there is plenty of free memory but no large order pages
+available. I think the problem is in sock_alloc_send_pskb(), the
+gfp_mask includes __GFP_REPEAT but its never used/passed to the page
+allocator. Shouldnt the gfp_mask be passed to alloc_skb() ?
+
+Signed-off-by: Larry Woodman <lwoodman@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+---
+ net/core/sock.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.2.orig/net/core/sock.c
++++ linux-2.6.18.2/net/core/sock.c
+@@ -1164,7 +1164,7 @@ static struct sk_buff *sock_alloc_send_p
+ goto failure;
+
+ if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
+- skb = alloc_skb(header_len, sk->sk_allocation);
++ skb = alloc_skb(header_len, gfp_mask);
+ if (skb) {
+ int npages;
+ int i;
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Nov 8 22:37:31 2006
+Date: Wed, 08 Nov 2006 22:33:56 -0800 (PST)
+Message-Id: <20061108.223356.07020910.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Cc: bunk@stusta.de
+Subject: NET: Set truesize in pskb_copy
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+Since pskb_copy tacks on the non-linear bits from the original
+skb, it needs to count them in the truesize field of the new skb.
+
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+---
+ net/core/skbuff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.2.orig/net/core/skbuff.c
++++ linux-2.6.18.2/net/core/skbuff.c
+@@ -638,6 +638,7 @@ struct sk_buff *pskb_copy(struct sk_buff
+ n->csum = skb->csum;
+ n->ip_summed = skb->ip_summed;
+
++ n->truesize += skb->data_len;
+ n->data_len = skb->data_len;
+ n->len = skb->len;
+
--- /dev/null
+From bunk@stusta.de Wed Nov 15 08:05:24 2006
+Date: Wed, 15 Nov 2006 17:01:46 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: Chris Wright <chrisw@sous-sol.org>, Michael Halcrow <mhalcrow@us.ibm.com>
+Cc: stable@kernel.org
+Subject: security/seclvl.c: fix time wrap (CVE-2005-4352)
+Message-ID: <20061115160146.GD5824@stusta.de>
+
+initlvl=2 in seclvl gives the guarantee
+"Cannot decrement the system time".
+
+But it was possible to set the time to the maximum unixtime value
+(19 Jan 2038) resulting in a wrap to the minimum value.
+
+This patch fixes this by disallowing setting the time to any date
+after 2031 with initlvl=2.
+
+This patch does not apply to kernel 2.6.19 since the seclvl module was
+already removed in this kernel.
+
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+
+---
+ security/seclvl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.18.2.orig/security/seclvl.c
++++ linux-2.6.18.2/security/seclvl.c
+@@ -370,6 +370,8 @@ static int seclvl_settime(struct timespe
+ current->group_leader->pid);
+ return -EPERM;
+ } /* if attempt to decrement time */
++ if (tv->tv_sec > 1924988400) /* disallow dates after 2030) */
++ return -EPERM; /* CVE-2005-4352 */
+ } /* if seclvl > 1 */
+ return 0;
+ }
init_reap_node-initialization-fix.patch
usb-failure-in-usblp-s-error-path.patch
usbtouchscreen-use-endpoint-address-from-endpoint-descriptor.patch
+e1000-fix-regression-garbled-stats-and-irq-allocation-during-swsusp.patch
+net-__alloc_pages-failures-reported-due-to-fragmentation.patch
+input-psmouse-fix-attribute-access-on-64-bit-systems.patch
+x86_64-fix-fpu-corruption.patch
+correct-keymapping-on-powerbook-built-in-usb-iso-keyboards.patch
+tcp-don-t-use-highmem-in-tcp-hash-size-calculation.patch
+net-set-truesize-in-pskb_copy.patch
+fix-via586-irq-routing-for-pirq-5.patch
+security-seclvl.c-fix-time-wrap.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Wed Nov 8 22:34:54 2006
+Date: Wed, 08 Nov 2006 22:31:14 -0800 (PST)
+Message-Id: <20061108.223114.77059148.davem@davemloft.net>
+To: stable@kernel.org
+From: David Miller <davem@davemloft.net>
+Cc: bunk@stusta.de
+Subject: TCP: Don't use highmem in tcp hash size calculation.
+
+From: John Heffner <jheffner@psc.edu>
+
+This patch removes consideration of high memory when determining TCP
+hash table sizes. Taking into account high memory results in tcp_mem
+values that are too large.
+
+Signed-off-by: John Heffner <jheffner@psc.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.2.orig/net/ipv4/tcp.c
++++ linux-2.6.18.2/net/ipv4/tcp.c
+@@ -2269,7 +2269,7 @@ void __init tcp_init(void)
+ thash_entries,
+ (num_physpages >= 128 * 1024) ?
+ 13 : 15,
+- HASH_HIGHMEM,
++ 0,
+ &tcp_hashinfo.ehash_size,
+ NULL,
+ 0);
+@@ -2285,7 +2285,7 @@ void __init tcp_init(void)
+ tcp_hashinfo.ehash_size,
+ (num_physpages >= 128 * 1024) ?
+ 13 : 15,
+- HASH_HIGHMEM,
++ 0,
+ &tcp_hashinfo.bhash_size,
+ NULL,
+ 64 * 1024);
--- /dev/null
+From ak@suse.de Fri Nov 10 19:20:02 2006
+From: Andi Kleen <ak@suse.de>
+To: stable@kernel.org
+Subject: x86_64: Fix FPU corruption
+Date: Sat, 11 Nov 2006 04:16:36 +0100
+Message-Id: <200611110416.36837.ak@suse.de>
+
+This reverts an earlier patch that was found to cause FPU
+state corruption. I think the corruption happens because
+unlazy_fpu() can cause FPU exceptions and when it happens
+after the current switch some processing would affect
+the state in the wrong process.
+
+Thanks to Douglas Crosher and Tom Hughes for testing.
+
+Cc: jbeulich@novell.com
+Signed-off-by: Andi Kleen <ak@suse.de>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ arch/x86_64/kernel/process.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- linux-2.6.18.2.orig/arch/x86_64/kernel/process.c
++++ linux-2.6.18.2/arch/x86_64/kernel/process.c
+@@ -571,6 +571,9 @@ __switch_to(struct task_struct *prev_p,
+ prev->gsindex = gsindex;
+ }
+
++ /* Must be after DS reload */
++ unlazy_fpu(prev_p);
++
+ /*
+ * Switch the PDA and FPU contexts.
+ */
+@@ -578,10 +581,6 @@ __switch_to(struct task_struct *prev_p,
+ write_pda(oldrsp, next->userrsp);
+ write_pda(pcurrent, next_p);
+
+- /* This must be here to ensure both math_state_restore() and
+- kernel_fpu_begin() work consistently.
+- And the AMD workaround requires it to be after DS reload. */
+- unlazy_fpu(prev_p);
+ write_pda(kernelstack,
+ task_stack_page(next_p) + THREAD_SIZE - PDA_STACKOFFSET);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
