--- /dev/null
+From 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Thu, 28 May 2009 14:34:36 -0700
+Subject: atmel_lcdfb: correct fifo size for some products
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 53b7479bbdaedcc7846c66fd608fe66f1b5aa35b upstream.
+
+Remove wrong fifo size definition for some AT91 products.
+
+Due to a misunderstanding of some AT91 datasheets, a fifo size of 2048
+(words) has been introduced by mistake. In fact, all products (AT91/AT32)
+are sharing the same fifo size of 512 words.
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Andrew Victor <avictor.za@gmail.com>
+Acked-by: Haavard Skinnemoen <hskinnemoen@atmel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/atmel_lcdfb.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/video/atmel_lcdfb.c
++++ b/drivers/video/atmel_lcdfb.c
+@@ -29,14 +29,8 @@
+
+ /* configurable parameters */
+ #define ATMEL_LCDC_CVAL_DEFAULT 0xc8
+-#define ATMEL_LCDC_DMA_BURST_LEN 8
+-
+-#if defined(CONFIG_ARCH_AT91SAM9263) || defined(CONFIG_ARCH_AT91CAP9) || \
+- defined(CONFIG_ARCH_AT91SAM9RL)
+-#define ATMEL_LCDC_FIFO_SIZE 2048
+-#else
+-#define ATMEL_LCDC_FIFO_SIZE 512
+-#endif
++#define ATMEL_LCDC_DMA_BURST_LEN 8 /* words */
++#define ATMEL_LCDC_FIFO_SIZE 512 /* words */
+
+ #if defined(CONFIG_ARCH_AT91)
+ #define ATMEL_LCDFB_FBINFO_DEFAULT (FBINFO_DEFAULT \
--- /dev/null
+From b09a48a3f84cc28dea31822db22fcbcd14e68aef Mon Sep 17 00:00:00 2001
+From: Stephen Hemminger <shemminger@vyatta.com>
+Date: Thu, 11 Jun 2009 05:46:04 -0700
+Subject: bonding: fix multiple module load problem
+
+From: Stephen Hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 130aa61a77b8518f1ea618e1b7d214d60b405f10 ]
+
+Some users still load bond module multiple times to create bonding
+devices. This accidentally was broken by a later patch about
+the time sysfs was fixed. According to Jay, it was broken
+by:
+ commit b8a9787eddb0e4665f31dd1d64584732b2b5d051
+ Author: Jay Vosburgh <fubar@us.ibm.com>
+ Date: Fri Jun 13 18:12:04 2008 -0700
+
+ bonding: Allow setting max_bonds to zero
+
+Note: sysfs and procfs still produce WARN() messages when this is done
+so the sysfs method is the recommended API.
+
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/bonding/bond_sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -1464,6 +1464,7 @@ int bond_create_sysfs(void)
+ printk(KERN_ERR
+ "network device named %s already exists in sysfs",
+ class_attr_bonding_masters.attr.name);
++ ret = 0;
+ }
+
+ return ret;
--- /dev/null
+From a90b037583d5f1ae3e54e9c687c79df82d1d34a4 Mon Sep 17 00:00:00 2001
+From: Dirk Eibach <eibach@gdsys.de>
+Date: Thu, 18 Jun 2009 16:49:15 -0700
+Subject: char: moxa, prevent opening unavailable ports
+
+From: Dirk Eibach <eibach@gdsys.de>
+
+commit a90b037583d5f1ae3e54e9c687c79df82d1d34a4 upstream.
+
+In moxa.c there are 32 minor numbers reserved for each device. The number
+of ports actually available per device is stored in
+moxa_board_conf->numPorts. This number is not considered in moxa_open().
+Opening a port that is not available results in a kernel oops. This patch
+adds a test to moxa_open() that prevents opening unavailable ports.
+
+[akpm@linux-foundation.org: avoid multiple returns]
+Signed-off-by: Dirk Eibach <eibach@gdsys.de>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/moxa.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/moxa.c
++++ b/drivers/char/moxa.c
+@@ -1158,6 +1158,11 @@ static int moxa_open(struct tty_struct *
+ return -ENODEV;
+ }
+
++ if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
++ retval = -ENODEV;
++ goto out_unlock;
++ }
++
+ ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
+ ch->port.count++;
+ tty->driver_data = ch;
+@@ -1182,8 +1187,8 @@ static int moxa_open(struct tty_struct *
+ moxa_close_port(ch);
+ } else
+ ch->port.flags |= ASYNC_NORMAL_ACTIVE;
++out_unlock:
+ mutex_unlock(&moxa_openlock);
+-
+ return retval;
+ }
+
--- /dev/null
+From 96050dfb25966612008dcea7d342e91fa01e993c Mon Sep 17 00:00:00 2001
+From: Peter Botha <peterb@goldcircle.co.za>
+Date: Tue, 9 Jun 2009 17:16:32 -0700
+Subject: char: mxser, fix ISA board lookup
+
+From: Peter Botha <peterb@goldcircle.co.za>
+
+commit 96050dfb25966612008dcea7d342e91fa01e993c upstream.
+
+There's a bug in the mxser kernel module that still appears in the
+2.6.29.4 kernel.
+
+mxser_get_ISA_conf takes a ioaddress as its first argument, by passing the
+not of the ioaddr, you're effectively passing 0 which means it won't be
+able to talk to an ISA card. I have tested this, and removing the !
+fixes the problem.
+
+Cc: "Peter Botha" <peterb@goldcircle.co.za>
+Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
+Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/mxser.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/mxser.c
++++ b/drivers/char/mxser.c
+@@ -2790,7 +2790,7 @@ static int __init mxser_module_init(void
+ continue;
+
+ brd = &mxser_boards[m];
+- retval = mxser_get_ISA_conf(!ioaddr[b], brd);
++ retval = mxser_get_ISA_conf(ioaddr[b], brd);
+ if (retval <= 0) {
+ brd->info = NULL;
+ continue;
--- /dev/null
+From 3b0fde0fac19c180317eb0601b3504083f4b9bf5 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Tue, 16 Jun 2009 15:31:16 -0700
+Subject: firmware_map: fix hang with x86/32bit
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 3b0fde0fac19c180317eb0601b3504083f4b9bf5 upstream.
+
+Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13484
+
+Peer reported:
+| The bug is introduced from kernel 2.6.27, if E820 table reserve the memory
+| above 4G in 32bit OS(BIOS-e820: 00000000fff80000 - 0000000120000000
+| (reserved)), system will report Int 6 error and hang up. The bug is caused by
+| the following code in drivers/firmware/memmap.c, the resource_size_t is 32bit
+| variable in 32bit OS, the BUG_ON() will be invoked to result in the Int 6
+| error. I try the latest 32bit Ubuntu and Fedora distributions, all hit this
+| bug.
+|======
+|static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
+| const char *type,
+| struct firmware_map_entry *entry)
+
+and it only happen with CONFIG_PHYS_ADDR_T_64BIT is not set.
+
+it turns out we need to pass u64 instead of resource_size_t for that.
+
+[akpm@linux-foundation.org: add comment]
+Reported-and-tested-by: Peer Chen <pchen@nvidia.com>
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+Acked-by: H. Peter Anvin <hpa@zytor.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/firmware/memmap.c | 16 +++++++++-------
+ include/linux/firmware-map.h | 12 ++++--------
+ 2 files changed, 13 insertions(+), 15 deletions(-)
+
+--- a/drivers/firmware/memmap.c
++++ b/drivers/firmware/memmap.c
+@@ -31,8 +31,12 @@
+ * information is necessary as for the resource tree.
+ */
+ struct firmware_map_entry {
+- resource_size_t start; /* start of the memory range */
+- resource_size_t end; /* end of the memory range (incl.) */
++ /*
++ * start and end must be u64 rather than resource_size_t, because e820
++ * resources can lie at addresses above 4G.
++ */
++ u64 start; /* start of the memory range */
++ u64 end; /* end of the memory range (incl.) */
+ const char *type; /* type of the memory range */
+ struct list_head list; /* entry for the linked list */
+ struct kobject kobj; /* kobject for each entry */
+@@ -101,7 +105,7 @@ static LIST_HEAD(map_entries);
+ * Common implementation of firmware_map_add() and firmware_map_add_early()
+ * which expects a pre-allocated struct firmware_map_entry.
+ **/
+-static int firmware_map_add_entry(resource_size_t start, resource_size_t end,
++static int firmware_map_add_entry(u64 start, u64 end,
+ const char *type,
+ struct firmware_map_entry *entry)
+ {
+@@ -132,8 +136,7 @@ static int firmware_map_add_entry(resour
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+@@ -157,8 +160,7 @@ int firmware_map_add(resource_size_t sta
+ *
+ * Returns 0 on success, or -ENOMEM if no memory could be allocated.
+ **/
+-int __init firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type)
++int __init firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ struct firmware_map_entry *entry;
+
+--- a/include/linux/firmware-map.h
++++ b/include/linux/firmware-map.h
+@@ -24,21 +24,17 @@
+ */
+ #ifdef CONFIG_FIRMWARE_MEMMAP
+
+-int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type);
+-int firmware_map_add_early(resource_size_t start, resource_size_t end,
+- const char *type);
++int firmware_map_add(u64 start, u64 end, const char *type);
++int firmware_map_add_early(u64 start, u64 end, const char *type);
+
+ #else /* CONFIG_FIRMWARE_MEMMAP */
+
+-static inline int firmware_map_add(resource_size_t start, resource_size_t end,
+- const char *type)
++static inline int firmware_map_add(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
+
+-static inline int firmware_map_add_early(resource_size_t start,
+- resource_size_t end, const char *type)
++static inline int firmware_map_add_early(u64 start, u64 end, const char *type)
+ {
+ return 0;
+ }
--- /dev/null
+From a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 9 Jun 2009 16:26:26 -0700
+Subject: jbd: fix race in buffer processing in commit code
+
+From: Jan Kara <jack@suse.cz>
+
+commit a61d90d75d0f9e86432c45b496b4b0fbf0fd03dc upstream.
+
+In commit code, we scan buffers attached to a transaction. During this
+scan, we sometimes have to drop j_list_lock and then we recheck whether
+the journal buffer head didn't get freed by journal_try_to_free_buffers().
+ But checking for buffer_jbd(bh) isn't enough because a new journal head
+could get attached to our buffer head. So add a check whether the journal
+head remained the same and whether it's still at the same transaction and
+list.
+
+This is a nasty bug and can cause problems like memory corruption (use after
+free) or trigger various assertions in JBD code (observed).
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: <linux-ext4@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/jbd/commit.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd/commit.c
++++ b/fs/jbd/commit.c
+@@ -238,7 +238,7 @@ write_out_data:
+ spin_lock(&journal->j_list_lock);
+ }
+ /* Someone already cleaned up the buffer? */
+- if (!buffer_jbd(bh)
++ if (!buffer_jbd(bh) || bh2jh(bh) != jh
+ || jh->b_transaction != commit_transaction
+ || jh->b_jlist != BJ_SyncData) {
+ jbd_unlock_bh_state(bh);
+@@ -463,7 +463,9 @@ void journal_commit_transaction(journal_
+ spin_lock(&journal->j_list_lock);
+ continue;
+ }
+- if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
++ if (buffer_jbd(bh) && bh2jh(bh) == jh &&
++ jh->b_transaction == commit_transaction &&
++ jh->b_jlist == BJ_Locked) {
+ __journal_unfile_buffer(jh);
+ jbd_unlock_bh_state(bh);
+ journal_remove_journal_head(bh);
--- /dev/null
+From 8e822df700694ca6850d1e0c122fd7004b2778d8 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shaohua.li@intel.com>
+Date: Mon, 8 Jun 2009 09:27:25 +0800
+Subject: PCI: disable ASPM on VIA root-port-under-bridge configurations
+
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 8e822df700694ca6850d1e0c122fd7004b2778d8 upstream.
+
+VIA has a strange chipset, it has root port under a bridge. Disable ASPM
+for such strange chipset.
+
+Tested-by: Wolfgang Denk <wd@denx.de>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aspm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -633,6 +633,10 @@ void pcie_aspm_init_link_state(struct pc
+ if (pdev->pcie_type != PCI_EXP_TYPE_ROOT_PORT &&
+ pdev->pcie_type != PCI_EXP_TYPE_DOWNSTREAM)
+ return;
++ /* VIA has a strange chipset, root port is under a bridge */
++ if (pdev->pcie_type == PCI_EXP_TYPE_ROOT_PORT &&
++ pdev->bus->self)
++ return;
+ down_read(&pci_bus_sem);
+ if (list_empty(&pdev->subordinate->devices))
+ goto out;
--- /dev/null
+From fdd7b4c3302c93f6833e338903ea77245eb510b4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Tue, 9 Jun 2009 04:01:02 -0700
+Subject: r8169: fix crash when large packets are received
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+commit fdd7b4c3302c93f6833e338903ea77245eb510b4 upstream.
+
+Michael Tokarev reported receiving a large packet could crash
+a machine with RTL8169 NIC.
+( original thread at http://lkml.org/lkml/2009/6/8/192 )
+
+Problem is this driver tells that NIC frames up to 16383 bytes
+can be received but provides skb to rx ring allocated with
+smaller sizes (1536 bytes in case standard 1500 bytes MTU is used)
+
+When a frame larger than what was allocated by driver is received,
+dma transfert can occurs past the end of buffer and corrupt
+kernel memory.
+
+Fix is to tell to NIC what is the maximum size a frame can be.
+
+This bug is very old, (before git introduction, linux-2.6.10), and
+should be backported to stable versions.
+
+Reported-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Tested-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/r8169.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/r8169.c
++++ b/drivers/net/r8169.c
+@@ -65,7 +65,6 @@ static const int multicast_filter_limit
+ #define RX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define TX_DMA_BURST 6 /* Maximum PCI burst, '6' is 1024 */
+ #define EarlyTxThld 0x3F /* 0x3F means NO early transmit */
+-#define RxPacketMaxSize 0x3FE8 /* 16K - 1 - ETH_HLEN - VLAN - CRC... */
+ #define SafeMtu 0x1c20 /* ... actually life sucks beyond ~7k */
+ #define InterFrameGap 0x03 /* 3 means InterFrameGap = the shortest one */
+
+@@ -1976,10 +1975,10 @@ static u16 rtl_rw_cpluscmd(void __iomem
+ return cmd;
+ }
+
+-static void rtl_set_rx_max_size(void __iomem *ioaddr)
++static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
+ {
+ /* Low hurts. Let's disable the filtering. */
+- RTL_W16(RxMaxSize, 16383);
++ RTL_W16(RxMaxSize, rx_buf_sz);
+ }
+
+ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
+@@ -2026,7 +2025,7 @@ static void rtl_hw_start_8169(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ if ((tp->mac_version == RTL_GIGA_MAC_VER_01) ||
+ (tp->mac_version == RTL_GIGA_MAC_VER_02) ||
+@@ -2090,7 +2089,7 @@ static void rtl_hw_start_8168(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ rtl_set_rx_tx_config_registers(tp);
+
+@@ -2142,7 +2141,7 @@ static void rtl_hw_start_8101(struct net
+
+ RTL_W8(EarlyTxThres, EarlyTxThld);
+
+- rtl_set_rx_max_size(ioaddr);
++ rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
+
+ tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
+
parport-netmos-9845-9855-1p4s-fixes.patch
+atmel_lcdfb-correct-fifo-size-for-some-products.patch
+bonding-fix-multiple-module-load-problem.patch
+char-moxa-prevent-opening-unavailable-ports.patch
+char-mxser-fix-isa-board-lookup.patch
+firmware_map-fix-hang-with-x86-32bit.patch
+jbd-fix-race-in-buffer-processing-in-commit-code.patch
+pci-disable-aspm-on-via-root-port-under-bridge-configurations.patch
+r8169-fix-crash-when-large-packets-are-received.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
