From: Greg Kroah-Hartman Date: Mon, 30 Oct 2006 22:34:33 +0000 (-0800) Subject: more patches queued X-Git-Tag: v2.6.18.2~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2ff9a53b3cf178ed136700ae7cfd43a4a8ef72cc;p=thirdparty%2Fkernel%2Fstable-queue.git more patches queued --- diff --git a/queue-2.6.18/__div64_32-for-31-bit.patch b/queue-2.6.18/__div64_32-for-31-bit.patch new file mode 100644 index 00000000000..b5cb1db6aad --- /dev/null +++ b/queue-2.6.18/__div64_32-for-31-bit.patch @@ -0,0 +1,260 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 05:42:07 2006 +From: Martin Schwidefsky +To: greg@kroah.com +Date: Thu, 12 Oct 2006 14:41:07 +0200 +Message-Id: <1160656867.15287.11.camel@localhost> +Mime-Version: 1.0 +Cc: stable@kernel.org +Subject: [S390] __div64_32 for 31 bit. +Content-Type: text/plain; charset="us-ascii" + +From: Martin Schwidefsky + +The clocksource infrastructure introduced with commit +ad596171ed635c51a9eef829187af100cbf8dcf7 broke 31 bit s390. +The reason is that the do_div() primitive for 31 bit always +had a restriction: it could only divide an unsigned 64 bit +integer by an unsigned 31 bit integer. The clocksource code +now uses do_div() with a base value that has the most +significant bit set. The result is that clock->cycle_interval +has a funny value which causes the linux time to jump around +like mad. +The solution is "obvious": implement a proper __div64_32 +function for 31 bit s390. + +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/Kconfig | 4 + + arch/s390/lib/Makefile | 1 + arch/s390/lib/div64.c | 151 +++++++++++++++++++++++++++++++++++++++++++++++ + include/asm-s390/div64.h | 48 -------------- + 4 files changed, 156 insertions(+), 48 deletions(-) + +--- linux-2.6.18.1.orig/arch/s390/Kconfig ++++ linux-2.6.18.1/arch/s390/Kconfig +@@ -51,6 +51,10 @@ config 64BIT + Select this option if you have a 64 bit IBM zSeries machine + and want to use the 64 bit addressing mode. + ++config 32BIT ++ bool ++ default y if !64BIT ++ + config SMP + bool "Symmetric multi-processing support" + ---help--- +--- linux-2.6.18.1.orig/arch/s390/lib/Makefile ++++ linux-2.6.18.1/arch/s390/lib/Makefile +@@ -7,3 +7,4 @@ EXTRA_AFLAGS := -traditional + lib-y += delay.o string.o + lib-y += $(if $(CONFIG_64BIT),uaccess64.o,uaccess.o) + lib-$(CONFIG_SMP) += spinlock.o ++lib-$(CONFIG_32BIT) += div64.o +--- /dev/null ++++ linux-2.6.18.1/arch/s390/lib/div64.c +@@ -0,0 +1,151 @@ ++/* ++ * arch/s390/lib/div64.c ++ * ++ * __div64_32 implementation for 31 bit. ++ * ++ * Copyright (C) IBM Corp. 2006 ++ * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com), ++ */ ++ ++#include ++#include ++ ++#ifdef CONFIG_MARCH_G5 ++ ++/* ++ * Function to divide an unsigned 64 bit integer by an unsigned ++ * 31 bit integer using signed 64/32 bit division. ++ */ ++static uint32_t __div64_31(uint64_t *n, uint32_t base) ++{ ++ register uint32_t reg2 asm("2"); ++ register uint32_t reg3 asm("3"); ++ uint32_t *words = (uint32_t *) n; ++ uint32_t tmp; ++ ++ /* Special case base==1, remainder = 0, quotient = n */ ++ if (base == 1) ++ return 0; ++ /* ++ * Special case base==0 will cause a fixed point divide exception ++ * on the dr instruction and may not happen anyway. For the ++ * following calculation we can assume base > 1. The first ++ * signed 64 / 32 bit division with an upper half of 0 will ++ * give the correct upper half of the 64 bit quotient. ++ */ ++ reg2 = 0UL; ++ reg3 = words[0]; ++ asm volatile( ++ " dr %0,%2\n" ++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" ); ++ words[0] = reg3; ++ reg3 = words[1]; ++ /* ++ * To get the lower half of the 64 bit quotient and the 32 bit ++ * remainder we have to use a little trick. Since we only have ++ * a signed division the quotient can get too big. To avoid this ++ * the 64 bit dividend is halved, then the signed division will ++ * work. Afterwards the quotient and the remainder are doubled. ++ * If the last bit of the dividend has been one the remainder ++ * is increased by one then checked against the base. If the ++ * remainder has overflown subtract base and increase the ++ * quotient. Simple, no ? ++ */ ++ asm volatile( ++ " nr %2,%1\n" ++ " srdl %0,1\n" ++ " dr %0,%3\n" ++ " alr %0,%0\n" ++ " alr %1,%1\n" ++ " alr %0,%2\n" ++ " clr %0,%3\n" ++ " jl 0f\n" ++ " slr %0,%3\n" ++ " alr %1,%2\n" ++ "0:\n" ++ : "+d" (reg2), "+d" (reg3), "=d" (tmp) ++ : "d" (base), "2" (1UL) : "cc" ); ++ words[1] = reg3; ++ return reg2; ++} ++ ++/* ++ * Function to divide an unsigned 64 bit integer by an unsigned ++ * 32 bit integer using the unsigned 64/31 bit division. ++ */ ++uint32_t __div64_32(uint64_t *n, uint32_t base) ++{ ++ uint32_t r; ++ ++ /* ++ * If the most significant bit of base is set, divide n by ++ * (base/2). That allows to use 64/31 bit division and gives a ++ * good approximation of the result: n = (base/2)*q + r. The ++ * result needs to be corrected with two simple transformations. ++ * If base is already < 2^31-1 __div64_31 can be used directly. ++ */ ++ r = __div64_31(n, ((signed) base < 0) ? (base/2) : base); ++ if ((signed) base < 0) { ++ uint64_t q = *n; ++ /* ++ * First transformation: ++ * n = (base/2)*q + r ++ * = ((base/2)*2)*(q/2) + ((q&1) ? (base/2) : 0) + r ++ * Since r < (base/2), r + (base/2) < base. ++ * With q1 = (q/2) and r1 = r + ((q&1) ? (base/2) : 0) ++ * n = ((base/2)*2)*q1 + r1 with r1 < base. ++ */ ++ if (q & 1) ++ r += base/2; ++ q >>= 1; ++ /* ++ * Second transformation. ((base/2)*2) could have lost the ++ * last bit. ++ * n = ((base/2)*2)*q1 + r1 ++ * = base*q1 - ((base&1) ? q1 : 0) + r1 ++ */ ++ if (base & 1) { ++ int64_t rx = r - q; ++ /* ++ * base is >= 2^31. The worst case for the while ++ * loop is n=2^64-1 base=2^31+1. That gives a ++ * maximum for q=(2^64-1)/2^31 = 0x1ffffffff. Since ++ * base >= 2^31 the loop is finished after a maximum ++ * of three iterations. ++ */ ++ while (rx < 0) { ++ rx += base; ++ q--; ++ } ++ r = rx; ++ } ++ *n = q; ++ } ++ return r; ++} ++ ++#else /* MARCH_G5 */ ++ ++uint32_t __div64_32(uint64_t *n, uint32_t base) ++{ ++ register uint32_t reg2 asm("2"); ++ register uint32_t reg3 asm("3"); ++ uint32_t *words = (uint32_t *) n; ++ ++ reg2 = 0UL; ++ reg3 = words[0]; ++ asm volatile( ++ " dlr %0,%2\n" ++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" ); ++ words[0] = reg3; ++ reg3 = words[1]; ++ asm volatile( ++ " dlr %0,%2\n" ++ : "+d" (reg2), "+d" (reg3) : "d" (base) : "cc" ); ++ words[1] = reg3; ++ return reg2; ++} ++ ++#endif /* MARCH_G5 */ ++ ++EXPORT_SYMBOL(__div64_32); +--- linux-2.6.18.1.orig/include/asm-s390/div64.h ++++ linux-2.6.18.1/include/asm-s390/div64.h +@@ -1,49 +1 @@ +-#ifndef __S390_DIV64 +-#define __S390_DIV64 +- +-#ifndef __s390x__ +- +-/* for do_div "base" needs to be smaller than 2^31-1 */ +-#define do_div(n, base) ({ \ +- unsigned long long __n = (n); \ +- unsigned long __r; \ +- \ +- asm (" slr 0,0\n" \ +- " l 1,%1\n" \ +- " srdl 0,1\n" \ +- " dr 0,%2\n" \ +- " alr 1,1\n" \ +- " alr 0,0\n" \ +- " lhi 2,1\n" \ +- " n 2,%1\n" \ +- " alr 0,2\n" \ +- " clr 0,%2\n" \ +- " jl 0f\n" \ +- " slr 0,%2\n" \ +- " ahi 1,1\n" \ +- "0: st 1,%1\n" \ +- " l 1,4+%1\n" \ +- " srdl 0,1\n" \ +- " dr 0,%2\n" \ +- " alr 1,1\n" \ +- " alr 0,0\n" \ +- " lhi 2,1\n" \ +- " n 2,4+%1\n" \ +- " alr 0,2\n" \ +- " clr 0,%2\n" \ +- " jl 1f\n" \ +- " slr 0,%2\n" \ +- " ahi 1,1\n" \ +- "1: st 1,4+%1\n" \ +- " lr %0,0" \ +- : "=d" (__r), "=m" (__n) \ +- : "d" (base), "m" (__n) : "0", "1", "2", "cc" ); \ +- (n) = (__n); \ +- __r; \ +-}) +- +-#else /* __s390x__ */ + #include +-#endif /* __s390x__ */ +- +-#endif diff --git a/queue-2.6.18/alsa-dereference-after-free-in-snd_hwdep_release.patch b/queue-2.6.18/alsa-dereference-after-free-in-snd_hwdep_release.patch new file mode 100644 index 00000000000..10230f0b688 --- /dev/null +++ b/queue-2.6.18/alsa-dereference-after-free-in-snd_hwdep_release.patch @@ -0,0 +1,49 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:44:24 2006 +Date: Mon, 16 Oct 2006 14:43:43 +0200 +Message-ID: +From: Florin Malita +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: Dereference after free in snd_hwdep_release() +Content-Type: text/plain; charset="us-ascii" + +From: Florin Malita + +[PATCH] ALSA: Dereference after free in snd_hwdep_release() + +snd_card_file_remove() may free hw->card so we can't dereference +hw->card->module after that. + +Coverity ID 1420. + +This bug actually causes an Oops at usb-disconnection, especially +with CONFIG_PREEMPT. + +From: Florin Malita +Signed-off-by: Florin Malita +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/hwdep.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/sound/core/hwdep.c ++++ linux-2.6.18.1/sound/core/hwdep.c +@@ -158,6 +158,7 @@ static int snd_hwdep_release(struct inod + { + int err = -ENXIO; + struct snd_hwdep *hw = file->private_data; ++ struct module *mod = hw->card->module; + mutex_lock(&hw->open_mutex); + if (hw->ops.release) { + err = hw->ops.release(hw, file); +@@ -167,7 +168,7 @@ static int snd_hwdep_release(struct inod + hw->used--; + snd_card_file_remove(hw->card, file); + mutex_unlock(&hw->open_mutex); +- module_put(hw->card->module); ++ module_put(mod); + return err; + } + diff --git a/queue-2.6.18/alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch b/queue-2.6.18/alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch new file mode 100644 index 00000000000..c422f35524d --- /dev/null +++ b/queue-2.6.18/alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch @@ -0,0 +1,38 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:37:02 2006 +Date: Mon, 16 Oct 2006 14:35:57 +0200 +Message-ID: +From: Arnaud Patard +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs() +Content-Type: text/plain; charset="us-ascii" + +From: Arnaud Patard + +[PATCH] ALSA: emu10k1: Fix outl() in snd_emu10k1_resume_regs() + +The emu10k1 driver saves the A_IOCFG and HCFG register on suspend and restores +it on resumes. Unfortunately, this doesn't work as the arguments to outl() are +reversed. + +From: Arnaud Patard +Signed-off-by: Arnaud Patard +Signed-off-by: Takashi Iwai + +--- + sound/pci/emu10k1/emu10k1_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.1.orig/sound/pci/emu10k1/emu10k1_main.c ++++ linux-2.6.18.1/sound/pci/emu10k1/emu10k1_main.c +@@ -1460,8 +1460,8 @@ void snd_emu10k1_resume_regs(struct snd_ + + /* resore for spdif */ + if (emu->audigy) +- outl(emu->port + A_IOCFG, emu->saved_a_iocfg); +- outl(emu->port + HCFG, emu->saved_hcfg); ++ outl(emu->saved_a_iocfg, emu->port + A_IOCFG); ++ outl(emu->saved_hcfg, emu->port + HCFG); + + val = emu->saved_ptr; + for (reg = saved_regs; *reg != 0xff; reg++) diff --git a/queue-2.6.18/alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch b/queue-2.6.18/alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch new file mode 100644 index 00000000000..d9030b5c148 --- /dev/null +++ b/queue-2.6.18/alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:45:49 2006 +Date: Mon, 16 Oct 2006 14:45:14 +0200 +Message-ID: +From: Karsten Wiese +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check() +Content-Type: text/plain; charset="us-ascii" + +From: Karsten Wiese + +[PATCH] ALSA: Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check() + +Fix bug in snd-usb-usx2y's usX2Y_pcms_lock_check() + +substream can be NULL...... +in mainline, bug was introduced by: +2006-06-22 [ALSA] Add O_APPEND flag support to PCM + +From: Karsten Wiese +Signed-off-by: Karsten Wiese +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usx2y/usx2yhwdeppcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c ++++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c +@@ -632,7 +632,7 @@ static int usX2Y_pcms_lock_check(struct + for (s = 0; s < 2; ++s) { + struct snd_pcm_substream *substream; + substream = pcm->streams[s].substream; +- if (SUBSTREAM_BUSY(substream)) ++ if (substream && SUBSTREAM_BUSY(substream)) + err = -EBUSY; + } + } diff --git a/queue-2.6.18/alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch b/queue-2.6.18/alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch new file mode 100644 index 00000000000..238ce671739 --- /dev/null +++ b/queue-2.6.18/alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch @@ -0,0 +1,35 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:38:07 2006 +Date: Mon, 16 Oct 2006 14:37:31 +0200 +Message-ID: +From: Takashi Iwai +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: powermac - Fix Oops when conflicting with aoa driver +Content-Type: text/plain; charset="us-ascii" + +From: Takashi Iwai + +[PATCH] ALSA: powermac - Fix Oops when conflicting with aoa driver + +Fixed Oops when conflictin with aoa driver due to lack of +i2c initialization. + +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/ppc/keywest.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- linux-2.6.18.1.orig/sound/ppc/keywest.c ++++ linux-2.6.18.1/sound/ppc/keywest.c +@@ -117,6 +117,9 @@ int __init snd_pmac_tumbler_post_init(vo + { + int err; + ++ if (!keywest_ctx || !keywest_ctx->client) ++ return -ENXIO; ++ + if ((err = keywest_ctx->init_client(keywest_ctx)) < 0) { + snd_printk(KERN_ERR "tumbler: %i :cannot initialize the MCS\n", err); + return err; diff --git a/queue-2.6.18/alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch b/queue-2.6.18/alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch new file mode 100644 index 00000000000..5a2afe247b0 --- /dev/null +++ b/queue-2.6.18/alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch @@ -0,0 +1,120 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:47:27 2006 +Date: Mon, 16 Oct 2006 14:46:53 +0200 +Message-ID: +From: Karsten Wiese +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: ALSA: Repair snd-usb-usx2y for usb 2.6.18 +Content-Type: text/plain; charset="us-ascii" + +From: Karsten Wiese + +ALSA: Repair snd-usb-usx2y for usb 2.6.18 + +urb->start_frame rolls over beyond MAX_INT now. +This is for stable kernel and stable alsa. + +From: Karsten Wiese +Signed-off-by: Karsten Wiese +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usx2y/usbusx2yaudio.c | 18 ++++++------------ + sound/usb/usx2y/usx2yhwdeppcm.c | 15 +++++---------- + 2 files changed, 11 insertions(+), 22 deletions(-) + +--- linux-2.6.18.1.orig/sound/usb/usx2y/usbusx2yaudio.c ++++ linux-2.6.18.1/sound/usb/usx2y/usbusx2yaudio.c +@@ -322,7 +322,7 @@ static void i_usX2Y_urb_complete(struct + usX2Y_error_urb_status(usX2Y, subs, urb); + return; + } +- if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame)) ++ if (likely(urb->start_frame == usX2Y->wait_iso_frame)) + subs->completed_urb = urb; + else { + usX2Y_error_sequence(usX2Y, subs, urb); +@@ -335,13 +335,9 @@ static void i_usX2Y_urb_complete(struct + atomic_read(&capsubs->state) >= state_PREPARED && + (playbacksubs->completed_urb || + atomic_read(&playbacksubs->state) < state_PREPARED)) { +- if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame)) { +- if (nr_of_packs() <= urb->start_frame && +- urb->start_frame <= (2 * nr_of_packs() - 1)) // uhci and ohci +- usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs(); +- else +- usX2Y->wait_iso_frame += nr_of_packs(); +- } else { ++ if (!usX2Y_usbframe_complete(capsubs, playbacksubs, urb->start_frame)) ++ usX2Y->wait_iso_frame += nr_of_packs(); ++ else { + snd_printdd("\n"); + usX2Y_clients_stop(usX2Y); + } +@@ -495,7 +491,6 @@ static int usX2Y_urbs_start(struct snd_u + if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED) + goto start; + } +- usX2Y->wait_iso_frame = -1; + + start: + usX2Y_subs_startup(subs); +@@ -516,10 +511,9 @@ static int usX2Y_urbs_start(struct snd_u + snd_printk (KERN_ERR "cannot submit datapipe for urb %d, err = %d\n", i, err); + err = -EPIPE; + goto cleanup; +- } else { +- if (0 > usX2Y->wait_iso_frame) ++ } else ++ if (i == 0) + usX2Y->wait_iso_frame = urb->start_frame; +- } + urb->transfer_flags = 0; + } else { + atomic_set(&subs->state, state_STARTING1); +--- linux-2.6.18.1.orig/sound/usb/usx2y/usx2yhwdeppcm.c ++++ linux-2.6.18.1/sound/usb/usx2y/usx2yhwdeppcm.c +@@ -243,7 +243,7 @@ static void i_usX2Y_usbpcm_urb_complete( + usX2Y_error_urb_status(usX2Y, subs, urb); + return; + } +- if (likely((0xFFFF & urb->start_frame) == usX2Y->wait_iso_frame)) ++ if (likely(urb->start_frame == usX2Y->wait_iso_frame)) + subs->completed_urb = urb; + else { + usX2Y_error_sequence(usX2Y, subs, urb); +@@ -256,13 +256,9 @@ static void i_usX2Y_usbpcm_urb_complete( + if (capsubs->completed_urb && atomic_read(&capsubs->state) >= state_PREPARED && + (NULL == capsubs2 || capsubs2->completed_urb) && + (playbacksubs->completed_urb || atomic_read(&playbacksubs->state) < state_PREPARED)) { +- if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame)) { +- if (nr_of_packs() <= urb->start_frame && +- urb->start_frame <= (2 * nr_of_packs() - 1)) // uhci and ohci +- usX2Y->wait_iso_frame = urb->start_frame - nr_of_packs(); +- else +- usX2Y->wait_iso_frame += nr_of_packs(); +- } else { ++ if (!usX2Y_usbpcm_usbframe_complete(capsubs, capsubs2, playbacksubs, urb->start_frame)) ++ usX2Y->wait_iso_frame += nr_of_packs(); ++ else { + snd_printdd("\n"); + usX2Y_clients_stop(usX2Y); + } +@@ -433,7 +429,6 @@ static int usX2Y_usbpcm_urbs_start(struc + if (subs != NULL && atomic_read(&subs->state) >= state_PREPARED) + goto start; + } +- usX2Y->wait_iso_frame = -1; + + start: + usX2Y_usbpcm_subs_startup(subs); +@@ -459,7 +454,7 @@ static int usX2Y_usbpcm_urbs_start(struc + goto cleanup; + } else { + snd_printdd("%i\n", urb->start_frame); +- if (0 > usX2Y->wait_iso_frame) ++ if (u == 0) + usX2Y->wait_iso_frame = urb->start_frame; + } + urb->transfer_flags = 0; diff --git a/queue-2.6.18/bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch b/queue-2.6.18/bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch new file mode 100644 index 00000000000..1366971409a --- /dev/null +++ b/queue-2.6.18/bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 04:50:35 2006 +Date: Mon, 16 Oct 2006 15:59:28 GMT +Message-Id: <200610161559.k9GFxSnJ005249@hera.kernel.org> +From: Marcel Holtmann +MIME-Version: 1.0 +Subject: Bluetooth: Check if DLC is still attached to the TTY +Content-Type: text/plain; charset="us-ascii" + +From: Marcel Holtmann + +[Bluetooth] Check if DLC is still attached to the TTY + +If the DLC device is no longer attached to the TTY device, then it +makes no sense to go through with changing the termios settings. + +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/rfcomm/tty.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- linux-2.6.18.1.orig/net/bluetooth/rfcomm/tty.c ++++ linux-2.6.18.1/net/bluetooth/rfcomm/tty.c +@@ -748,6 +748,9 @@ static void rfcomm_tty_set_termios(struc + + BT_DBG("tty %p termios %p", tty, old); + ++ if (!dev) ++ return; ++ + /* Handle turning off CRTSCTS */ + if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) + BT_DBG("Turning off CRTSCTS unsupported"); diff --git a/queue-2.6.18/fix-sfuzz-hanging-on-2.6.18.patch b/queue-2.6.18/fix-sfuzz-hanging-on-2.6.18.patch new file mode 100644 index 00000000000..0a8e7f859ff --- /dev/null +++ b/queue-2.6.18/fix-sfuzz-hanging-on-2.6.18.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 01:50:48 2006 +Date: Thu, 12 Oct 2006 01:49:38 -0700 (PDT) +Message-Id: <20061012.014938.71090955.davem@davemloft.net> +To: stable@kernel.org +From: Patrick McHardy +Mime-Version: 1.0 +Subject: [DECNET]: Fix sfuzz hanging on 2.6.18 +Content-Type: text/plain; charset="us-ascii" + +From: Patrick McHardy + +Dave Jones wrote: +> sfuzz D 724EF62A 2828 28717 28691 (NOTLB) +> cd69fe98 00000082 0000012d 724ef62a 0001971a 00000010 00000007 df6d22b0 +> dfd81080 725bbc5e 0001971a 000cc634 00000001 df6d23bc c140e260 00000202 +> de1d5ba0 cd69fea0 de1d5ba0 00000000 00000000 de1d5b60 de1d5b8c de1d5ba0 +> Call Trace: +> [] lock_sock+0x75/0xa6 +> [] dn_getname+0x18/0x5f [decnet] +> [] sys_getsockname+0x5c/0xb0 +> [] sys_socketcall+0xef/0x261 +> [] syscall_call+0x7/0xb +> DWARF2 unwinder stuck at syscall_call+0x7/0xb +> +> I wonder if the plethora of lockdep related changes inadvertantly broke something? + +Looks like unbalanced locking. + +Signed-off-by: Patrick McHardy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/decnet/af_decnet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/net/decnet/af_decnet.c ++++ linux-2.6.18.1/net/decnet/af_decnet.c +@@ -1177,8 +1177,10 @@ static int dn_getname(struct socket *soc + if (peer) { + if ((sock->state != SS_CONNECTED && + sock->state != SS_CONNECTING) && +- scp->accept_mode == ACC_IMMED) ++ scp->accept_mode == ACC_IMMED) { ++ release_sock(sk); + return -ENOTCONN; ++ } + + memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn)); + } else { diff --git a/queue-2.6.18/fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch b/queue-2.6.18/fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch new file mode 100644 index 00000000000..7794a415e44 --- /dev/null +++ b/queue-2.6.18/fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 04:11:12 2006 +Date: Fri, 29 Sep 2006 17:01:11 GMT +Message-Id: <200609291701.k8TH1BPN029946@hera.kernel.org> +From: David Woodhouse +MIME-Version: 1.0 +Subject: Fix uninitialised spinlock in via-pmu-backlight code. +Content-Type: text/plain; charset="us-ascii" + +From: David Woodhouse + +[PATCH] Fix uninitialised spinlock in via-pmu-backlight code. + +The uninitialised pmu_backlight_lock causes the current Fedora test kernel +(which has spinlock debugging enabled) to panic on suspend. + +This is suboptimal, so I fixed it. + +Signed-off-by: David Woodhouse +Acked-by: Benjamin Herrenschmidt +Acked-by: Michael Hanselmann +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/macintosh/via-pmu-backlight.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/drivers/macintosh/via-pmu-backlight.c ++++ linux-2.6.18.1/drivers/macintosh/via-pmu-backlight.c +@@ -16,7 +16,7 @@ + #define MAX_PMU_LEVEL 0xFF + + static struct backlight_properties pmu_backlight_data; +-static spinlock_t pmu_backlight_lock; ++static DEFINE_SPINLOCK(pmu_backlight_lock); + static int sleeping; + static u8 bl_curve[FB_BACKLIGHT_LEVELS]; + diff --git a/queue-2.6.18/mm-fix-a-race-condition-under-smc-cow.patch b/queue-2.6.18/mm-fix-a-race-condition-under-smc-cow.patch new file mode 100644 index 00000000000..c0bce2e03cf --- /dev/null +++ b/queue-2.6.18/mm-fix-a-race-condition-under-smc-cow.patch @@ -0,0 +1,75 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 09:14:50 2006 +Date: Thu, 12 Oct 2006 09:14:05 -0700 +From: Suresh Siddha +To: stable@kernel.org +Message-Id: <20061012091405.e4bb1f55.akpm@osdl.org> +Mime-Version: 1.0 +Subject: mm: fix a race condition under SMC + COW +Content-Type: text/plain; charset="us-ascii" + +From: Suresh Siddha + +Failing context is a multi threaded process context and the failing +sequence is as follows. + +One thread T0 doing self modifying code on page X on processor P0 and +another thread T1 doing COW (breaking the COW setup as part of just +happened fork() in another thread T2) on the same page X on processor P1. +T0 doing SMC can endup modifying the new page Y (allocated by the T1 doing +COW on P1) but because of different I/D TLB's, P0 ITLB will not see the new +mapping till the flush TLB IPI from P1 is received. During this interval, +if T0 executes the code created by SMC it can result in an app error (as +ITLB still points to old page X and endup executing the content in page X +rather than using the content in page Y). + +Fix this issue by first clearing the PTE and flushing it, before updating +it with new entry. + +Hugh sayeth: + + I was a bit sceptical, in the habit of thinking that Self Modifying Code + must look such issues itself: but I guess there's nothing it can do to avoid + this one. + + Fair enough, what you're changing it to is pretty much what powerpc and + s390 were already doing, and is a more robust way of proceeding, consistent + with how ptes are set everywhere else. + + The ptep_clear_flush is a bit heavy-handed (it's anxious to return the pte + that was atomically cleared), but we'd have to wander through lots of arches + to get the right minimal behaviour. It'd also be nice to eliminate + ptep_establish completely, now only used to define other macros/inlines: it + always seemed obfuscation to me, what you've got there now is clearer. + Let's put those cleanups on a TODO list. + +Signed-off-by: Suresh Siddha +Acked-by: "David S. Miller" +Acked-by: Hugh Dickins +Cc: Nick Piggin +Cc: Peter Zijlstra +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/mm/memory.c ++++ linux-2.6.18.1/mm/memory.c +@@ -1551,7 +1551,14 @@ gotten: + entry = mk_pte(new_page, vma->vm_page_prot); + entry = maybe_mkwrite(pte_mkdirty(entry), vma); + lazy_mmu_prot_update(entry); +- ptep_establish(vma, address, page_table, entry); ++ /* ++ * Clear the pte entry and flush it first, before updating the ++ * pte with the new entry. This will avoid a race condition ++ * seen in the presence of one thread doing SMC and another ++ * thread doing COW. ++ */ ++ ptep_clear_flush(vma, address, page_table); ++ set_pte_at(mm, address, page_table, entry); + update_mmu_cache(vma, address, entry); + lru_cache_add_active(new_page); + page_add_new_anon_rmap(new_page, vma, address); diff --git a/queue-2.6.18/scsi-dac960-pci-id-table-fixup.patch b/queue-2.6.18/scsi-dac960-pci-id-table-fixup.patch new file mode 100644 index 00000000000..7edd16b935a --- /dev/null +++ b/queue-2.6.18/scsi-dac960-pci-id-table-fixup.patch @@ -0,0 +1,36 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 04:10:47 2006 +Date: Sun, 24 Sep 2006 03:59:49 GMT +Message-Id: <200609240359.k8O3xnOl023638@hera.kernel.org> +From: Brian King +MIME-Version: 1.0 +Subject: SCSI: DAC960: PCI id table fixup +Content-Type: text/plain; charset="us-ascii" + +From: Brian King + +[SCSI] DAC960: PCI id table fixup + +The PCI ID table in the DAC960 driver conflicts with some devices +that use the ipr driver. All ipr adapters that use this chip +have an IBM subvendor ID and all DAC960 adapters that use this +chip have a Mylex subvendor id. + +Signed-off-by: Brian King +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/DAC960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/drivers/block/DAC960.c ++++ linux-2.6.18.1/drivers/block/DAC960.c +@@ -7115,7 +7115,7 @@ static struct pci_device_id DAC960_id_ta + { + .vendor = PCI_VENDOR_ID_MYLEX, + .device = PCI_DEVICE_ID_MYLEX_DAC960_GEM, +- .subvendor = PCI_ANY_ID, ++ .subvendor = PCI_VENDOR_ID_MYLEX, + .subdevice = PCI_ANY_ID, + .driver_data = (unsigned long) &DAC960_GEM_privdata, + }, diff --git a/queue-2.6.18/serial-fix-oops-when-removing-suspended-serial-port.patch b/queue-2.6.18/serial-fix-oops-when-removing-suspended-serial-port.patch new file mode 100644 index 00000000000..31e9608cd4a --- /dev/null +++ b/queue-2.6.18/serial-fix-oops-when-removing-suspended-serial-port.patch @@ -0,0 +1,79 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 04:27:39 2006 +Date: Tue, 17 Oct 2006 13:26:34 +0200 +From: Russell King +To: stable@kernel.org +Message-ID: <20061017112634.GD24505@nancy> +MIME-Version: 1.0 +Content-Disposition: inline +Subject: SERIAL: Fix oops when removing suspended serial port +Content-Type: text/plain; charset="us-ascii" + +From: Russell King + +[SERIAL] Fix oops when removing suspended serial port + +A serial card might have been removed when the system is resumed. +This results in a suspended port being shut down, which results in +the ports shutdown method being called twice in a row. This causes +BUGs. Avoid this by tracking the suspended state separately from +the initialised state. + +Signed-off-by: Russell King +Signed-off-by: maximilian attems +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/serial_core.c | 9 +++++++-- + include/linux/serial_core.h | 1 + + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- linux-2.6.18.1.orig/drivers/serial/serial_core.c ++++ linux-2.6.18.1/drivers/serial/serial_core.c +@@ -1932,6 +1932,9 @@ int uart_suspend_port(struct uart_driver + if (state->info && state->info->flags & UIF_INITIALIZED) { + const struct uart_ops *ops = port->ops; + ++ state->info->flags = (state->info->flags & ~UIF_INITIALIZED) ++ | UIF_SUSPENDED; ++ + spin_lock_irq(&port->lock); + ops->stop_tx(port); + ops->set_mctrl(port, 0); +@@ -1991,7 +1994,7 @@ int uart_resume_port(struct uart_driver + console_start(port->cons); + } + +- if (state->info && state->info->flags & UIF_INITIALIZED) { ++ if (state->info && state->info->flags & UIF_SUSPENDED) { + const struct uart_ops *ops = port->ops; + int ret; + +@@ -2003,15 +2006,17 @@ int uart_resume_port(struct uart_driver + ops->set_mctrl(port, port->mctrl); + ops->start_tx(port); + spin_unlock_irq(&port->lock); ++ state->info->flags |= UIF_INITIALIZED; + } else { + /* + * Failed to resume - maybe hardware went away? + * Clear the "initialized" flag so we won't try + * to call the low level drivers shutdown method. + */ +- state->info->flags &= ~UIF_INITIALIZED; + uart_shutdown(state); + } ++ ++ state->info->flags &= ~UIF_SUSPENDED; + } + + mutex_unlock(&state->mutex); +--- linux-2.6.18.1.orig/include/linux/serial_core.h ++++ linux-2.6.18.1/include/linux/serial_core.h +@@ -319,6 +319,7 @@ struct uart_info { + #define UIF_CTS_FLOW ((__force uif_t) (1 << 26)) + #define UIF_NORMAL_ACTIVE ((__force uif_t) (1 << 29)) + #define UIF_INITIALIZED ((__force uif_t) (1 << 31)) ++#define UIF_SUSPENDED ((__force uif_t) (1 << 30)) + + int blocked_open; + diff --git a/queue-2.6.18/serial-fix-resume-handling-bug.patch b/queue-2.6.18/serial-fix-resume-handling-bug.patch new file mode 100644 index 00000000000..e811d4d5a48 --- /dev/null +++ b/queue-2.6.18/serial-fix-resume-handling-bug.patch @@ -0,0 +1,49 @@ +From stable-bounces@linux.kernel.org Tue Oct 17 04:20:54 2006 +Date: Tue, 17 Oct 2006 13:19:40 +0200 +From: Russell King +To: stable@kernel.org +Message-ID: <20061017111940.GC24505@nancy> +MIME-Version: 1.0 +Content-Disposition: inline +Cc: Russell King , David Woodhouse +Subject: SERIAL: Fix resume handling bug +Content-Type: text/plain; charset="us-ascii" + +From: Russell King + +Unfortunately, pcmcia_dev_present() returns false when a device is +suspended, so checking this on resume does not work too well. Omit +this test. + +the backported patch below is already in fedora tree. -maks + +Signed-off-by: Russell King +Signed-off-by: maximilian attems +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/serial_cs.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +--- linux-2.6.18.1.orig/drivers/serial/serial_cs.c ++++ linux-2.6.18.1/drivers/serial/serial_cs.c +@@ -185,14 +185,12 @@ static int serial_suspend(struct pcmcia_ + + static int serial_resume(struct pcmcia_device *link) + { +- if (pcmcia_dev_present(link)) { +- struct serial_info *info = link->priv; +- int i; ++ struct serial_info *info = link->priv; ++ int i; + +- for (i = 0; i < info->ndev; i++) +- serial8250_resume_port(info->line[i]); +- wakeup_card(info); +- } ++ for (i = 0; i < info->ndev; i++) ++ serial8250_resume_port(info->line[i]); ++ wakeup_card(info); + + return 0; + } diff --git a/queue-2.6.18/series b/queue-2.6.18/series new file mode 100644 index 00000000000..26236b6fb7c --- /dev/null +++ b/queue-2.6.18/series @@ -0,0 +1,21 @@ +fix-sfuzz-hanging-on-2.6.18.patch +splice-fix-pipe_to_file-prepare_write-error-path.patch +__div64_32-for-31-bit.patch +mm-fix-a-race-condition-under-smc-cow.patch +sky2-msi-test-race-and-message.patch +sky2-pause-parameter-adjustment.patch +sky2-turn-off-phy-irq-on-shutdown.patch +alsa-emu10k1-fix-outl-in-snd_emu10k1_resume_regs.patch +alsa-powermac-fix-oops-when-conflicting-with-aoa-driver.patch +sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch +alsa-dereference-after-free-in-snd_hwdep_release.patch +alsa-fix-bug-in-snd-usb-usx2y-s-usx2y_pcms_lock_check.patch +alsa-repair-snd-usb-usx2y-for-usb-2.6.18.patch +sky2-accept-multicast-pause-frames.patch +sky2-gmac-pause-frame.patch +uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch +scsi-dac960-pci-id-table-fixup.patch +fix-uninitialised-spinlock-in-via-pmu-backlight-code.patch +serial-fix-resume-handling-bug.patch +serial-fix-oops-when-removing-suspended-serial-port.patch +bluetooth-check-if-dlc-is-still-attached-to-the-tty.patch diff --git a/queue-2.6.18/sky2-accept-multicast-pause-frames.patch b/queue-2.6.18/sky2-accept-multicast-pause-frames.patch new file mode 100644 index 00000000000..6cc271630a4 --- /dev/null +++ b/queue-2.6.18/sky2-accept-multicast-pause-frames.patch @@ -0,0 +1,70 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 15:29:40 2006 +Date: Mon, 16 Oct 2006 14:08:56 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061016140856.2f8b3907@freekitty> +Mime-Version: 1.0 +Subject: sky2: accept multicast pause frames +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +When using flow control, the PHY needs to accept multicast pause frames. +Without this fix, these frames were getting discarded by the PHY before +doing any flow control. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.c ++++ linux-2.6.18.1/drivers/net/sky2.c +@@ -2745,6 +2745,14 @@ static int sky2_set_mac_address(struct n + return 0; + } + ++static void inline sky2_add_filter(u8 filter[8], const u8 *addr) ++{ ++ u32 bit; ++ ++ bit = ether_crc(ETH_ALEN, addr) & 63; ++ filter[bit >> 3] |= 1 << (bit & 7); ++} ++ + static void sky2_set_multicast(struct net_device *dev) + { + struct sky2_port *sky2 = netdev_priv(dev); +@@ -2753,6 +2761,7 @@ static void sky2_set_multicast(struct ne + struct dev_mc_list *list = dev->mc_list; + u16 reg; + u8 filter[8]; ++ static const u8 pause_mc_addr[ETH_ALEN] = { 0x1, 0x80, 0xc2, 0x0, 0x0, 0x1 }; + + memset(filter, 0, sizeof(filter)); + +@@ -2763,16 +2772,17 @@ static void sky2_set_multicast(struct ne + reg &= ~(GM_RXCR_UCF_ENA | GM_RXCR_MCF_ENA); + else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > 16) /* all multicast */ + memset(filter, 0xff, sizeof(filter)); +- else if (dev->mc_count == 0) /* no multicast */ ++ else if (dev->mc_count == 0 && !sky2->rx_pause) + reg &= ~GM_RXCR_MCF_ENA; + else { + int i; + reg |= GM_RXCR_MCF_ENA; + +- for (i = 0; list && i < dev->mc_count; i++, list = list->next) { +- u32 bit = ether_crc(ETH_ALEN, list->dmi_addr) & 0x3f; +- filter[bit / 8] |= 1 << (bit % 8); +- } ++ if (sky2->rx_pause) ++ sky2_add_filter(filter, pause_mc_addr); ++ ++ for (i = 0; list && i < dev->mc_count; i++, list = list->next) ++ sky2_add_filter(filter, list->dmi_addr); + } + + gma_write16(hw, port, GM_MC_ADDR_H1, diff --git a/queue-2.6.18/sky2-gmac-pause-frame.patch b/queue-2.6.18/sky2-gmac-pause-frame.patch new file mode 100644 index 00000000000..fd543fc1da2 --- /dev/null +++ b/queue-2.6.18/sky2-gmac-pause-frame.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 15:29:40 2006 +Date: Mon, 16 Oct 2006 14:10:16 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061016141016.62d39650@freekitty> +Mime-Version: 1.0 +Subject: sky2: GMAC pause frame +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +This reverts earlier change that attempted to fix flow control. +Device needs to discard pause frames, otherwise it passes pause frames up +the stack. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/sky2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.h ++++ linux-2.6.18.1/drivers/net/sky2.h +@@ -1566,7 +1566,7 @@ enum { + + GMR_FS_ANY_ERR = GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR | + GMR_FS_FRAGMENT | GMR_FS_LONG_ERR | +- GMR_FS_MII_ERR | GMR_FS_BAD_FC | ++ GMR_FS_MII_ERR | GMR_FS_GOOD_FC | GMR_FS_BAD_FC | + GMR_FS_UN_SIZE | GMR_FS_JABBER, + }; + diff --git a/queue-2.6.18/sky2-msi-test-race-and-message.patch b/queue-2.6.18/sky2-msi-test-race-and-message.patch new file mode 100644 index 00000000000..4e592080f42 --- /dev/null +++ b/queue-2.6.18/sky2-msi-test-race-and-message.patch @@ -0,0 +1,64 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 15:38:46 2006 +Date: Thu, 12 Oct 2006 15:38:11 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061012153811.09790730@freekitty> +Mime-Version: 1.0 +Subject: sky2: MSI test race and message +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +Make sure and do PCI reads after writes in the MSI test setup code. + +Some motherboards don't implement MSI correctly. The driver handles this +but the warning is too verbose and overly cautious. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.c ++++ linux-2.6.18.1/drivers/net/sky2.c +@@ -3208,6 +3208,8 @@ static int __devinit sky2_test_msi(struc + struct pci_dev *pdev = hw->pdev; + int err; + ++ init_waitqueue_head (&hw->msi_wait); ++ + sky2_write32(hw, B0_IMSK, Y2_IS_IRQ_SW); + + err = request_irq(pdev->irq, sky2_test_intr, IRQF_SHARED, DRV_NAME, hw); +@@ -3217,18 +3219,15 @@ static int __devinit sky2_test_msi(struc + return err; + } + +- init_waitqueue_head (&hw->msi_wait); +- + sky2_write8(hw, B0_CTST, CS_ST_SW_IRQ); +- wmb(); ++ sky2_read8(hw, B0_CTST); + + wait_event_timeout(hw->msi_wait, hw->msi_detected, HZ/10); + + if (!hw->msi_detected) { + /* MSI test failed, go back to INTx mode */ +- printk(KERN_WARNING PFX "%s: No interrupt was generated using MSI, " +- "switching to INTx mode. Please report this failure to " +- "the PCI maintainer and include system chipset information.\n", ++ printk(KERN_INFO PFX "%s: No interrupt generated using MSI, " ++ "switching to INTx mode.\n", + pci_name(pdev)); + + err = -EOPNOTSUPP; +@@ -3236,6 +3235,7 @@ static int __devinit sky2_test_msi(struc + } + + sky2_write32(hw, B0_IMSK, 0); ++ sky2_read32(hw, B0_IMSK); + + free_irq(pdev->irq, hw); + diff --git a/queue-2.6.18/sky2-pause-parameter-adjustment.patch b/queue-2.6.18/sky2-pause-parameter-adjustment.patch new file mode 100644 index 00000000000..a1f04aedf4f --- /dev/null +++ b/queue-2.6.18/sky2-pause-parameter-adjustment.patch @@ -0,0 +1,33 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 15:38:57 2006 +Date: Thu, 12 Oct 2006 15:34:24 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061012153424.1271db55@freekitty> +Mime-Version: 1.0 +Subject: sky2: pause parameter adjustment +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +The lower pause threshold set by the driver is too large and causes FIFO overruns. +Especially on laptops running at slower clock rates. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/sky2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.c ++++ linux-2.6.18.1/drivers/net/sky2.c +@@ -678,7 +678,7 @@ static void sky2_mac_init(struct sky2_hw + sky2_write16(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_OPER_ON); + + if (hw->chip_id == CHIP_ID_YUKON_EC_U) { +- sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8); ++ sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 512/8); + sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8); + if (hw->dev[port]->mtu > ETH_DATA_LEN) { + /* set Tx GMAC FIFO Almost Empty Threshold */ diff --git a/queue-2.6.18/sky2-turn-off-phy-irq-on-shutdown.patch b/queue-2.6.18/sky2-turn-off-phy-irq-on-shutdown.patch new file mode 100644 index 00000000000..68adba2976a --- /dev/null +++ b/queue-2.6.18/sky2-turn-off-phy-irq-on-shutdown.patch @@ -0,0 +1,65 @@ +From stable-bounces@linux.kernel.org Thu Oct 12 15:38:57 2006 +Date: Thu, 12 Oct 2006 15:32:42 -0700 +From: Stephen Hemminger +To: stable@kernel.org +Message-ID: <20061012153242.43fb9c38@freekitty> +Mime-Version: 1.0 +Subject: sky2: turn off PHY IRQ on shutdown +Content-Type: text/plain; charset="us-ascii" + +From: Stephen Hemminger + +When PHY is turned off on shutdown, it can causes the IRQ to get stuck on. +Make sure and disable the IRQ first, and if IRQ occurs when device +is not running, don't access PHY because that can hang. + +Signed-off-by: Stephen Hemminger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/sky2.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- linux-2.6.18.1.orig/drivers/net/sky2.c ++++ linux-2.6.18.1/drivers/net/sky2.c +@@ -1429,6 +1429,11 @@ static int sky2_down(struct net_device * + /* Stop more packets from being queued */ + netif_stop_queue(dev); + ++ /* Disable port IRQ */ ++ imask = sky2_read32(hw, B0_IMSK); ++ imask &= ~portirq_msk[port]; ++ sky2_write32(hw, B0_IMSK, imask); ++ + sky2_phy_reset(hw, port); + + /* Stop transmitter */ +@@ -1472,11 +1477,6 @@ static int sky2_down(struct net_device * + sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET); + sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET); + +- /* Disable port IRQ */ +- imask = sky2_read32(hw, B0_IMSK); +- imask &= ~portirq_msk[port]; +- sky2_write32(hw, B0_IMSK, imask); +- + /* turn off LED's */ + sky2_write16(hw, B0_Y2LED, LED_STAT_OFF); + +@@ -1687,13 +1687,13 @@ static void sky2_phy_intr(struct sky2_hw + struct sky2_port *sky2 = netdev_priv(dev); + u16 istatus, phystat; + ++ if (!netif_running(dev)) ++ return; ++ + spin_lock(&sky2->phy_lock); + istatus = gm_phy_read(hw, port, PHY_MARV_INT_STAT); + phystat = gm_phy_read(hw, port, PHY_MARV_PHY_STAT); + +- if (!netif_running(dev)) +- goto out; +- + if (netif_msg_intr(sky2)) + printk(KERN_INFO PFX "%s: phy interrupt status 0x%x 0x%x\n", + sky2->netdev->name, istatus, phystat); diff --git a/queue-2.6.18/sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch b/queue-2.6.18/sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch new file mode 100644 index 00000000000..2868a932cdd --- /dev/null +++ b/queue-2.6.18/sound-pci-au88x0-au88x0.c-ioremap-balanced-with-iounmap.patch @@ -0,0 +1,32 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 05:39:43 2006 +Date: Mon, 16 Oct 2006 14:39:03 +0200 +Message-ID: +From: Amol Lad +To: stable@kernel.org +MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") +Subject: sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap +Content-Type: text/plain; charset="us-ascii" + +From: Amol Lad + +[PATCH] sound/pci/au88x0/au88x0.c: ioremap balanced with iounmap + +From: Amol Lad +Signed-off-by: Amol Lad +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/au88x0/au88x0.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.1.orig/sound/pci/au88x0/au88x0.c ++++ linux-2.6.18.1/sound/pci/au88x0/au88x0.c +@@ -128,6 +128,7 @@ static int snd_vortex_dev_free(struct sn + // Take down PCI interface. + synchronize_irq(vortex->irq); + free_irq(vortex->irq, vortex); ++ iounmap(vortex->mmio); + pci_release_regions(vortex->pci_dev); + pci_disable_device(vortex->pci_dev); + kfree(vortex); diff --git a/queue-2.6.18/splice-fix-pipe_to_file-prepare_write-error-path.patch b/queue-2.6.18/splice-fix-pipe_to_file-prepare_write-error-path.patch new file mode 100644 index 00000000000..3138d051ca1 --- /dev/null +++ b/queue-2.6.18/splice-fix-pipe_to_file-prepare_write-error-path.patch @@ -0,0 +1,50 @@ +From stable-bounces@linux.kernel.org Wed Oct 11 23:00:27 2006 +Date: Thu, 12 Oct 2006 07:59:47 +0200 +From: Jens Axboe +To: stable@kernel.org +Message-ID: <20061012055946.GU6515@kernel.dk> +Mime-Version: 1.0 +Content-Disposition: inline +Subject: splice: fix pipe_to_file() ->prepare_write() error path +Content-Type: text/plain; charset="us-ascii" + +From: Jens Axboe + +Don't jump to the unlock+release path, we already did that. + +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/splice.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- linux-2.6.18.1.orig/fs/splice.c ++++ linux-2.6.18.1/fs/splice.c +@@ -607,7 +607,7 @@ find_page: + ret = -ENOMEM; + page = page_cache_alloc_cold(mapping); + if (unlikely(!page)) +- goto out_nomem; ++ goto out_ret; + + /* + * This will also lock the page +@@ -666,7 +666,7 @@ find_page: + if (sd->pos + this_len > isize) + vmtruncate(mapping->host, isize); + +- goto out; ++ goto out_ret; + } + + if (buf->page != page) { +@@ -698,7 +698,7 @@ find_page: + out: + page_cache_release(page); + unlock_page(page); +-out_nomem: ++out_ret: + return ret; + } + diff --git a/queue-2.6.18/uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch b/queue-2.6.18/uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch new file mode 100644 index 00000000000..48fde1397c1 --- /dev/null +++ b/queue-2.6.18/uml-fix-processor-selection-to-exclude-unsupported-processors-and-features.patch @@ -0,0 +1,47 @@ +From stable-bounces@linux.kernel.org Mon Oct 16 14:10:02 2006 +From: "Paolo 'Blaisorblade' Giarrusso" +To: stable@kernel.org +Date: Sun, 15 Oct 2006 21:43:29 +0200 +Message-Id: <11609414093462-git-send-email-blaisorblade@yahoo.it> +Cc: Jeff Dike , "Paolo 'Blaisorblade' Giarrusso" +Subject: uml: fix processor selection to exclude unsupported processors and features +MIME-Version: 1.0 +Content-Type: text/plain; charset="us-ascii" + +From: "Paolo 'Blaisorblade' Giarrusso" + +Makes UML compile on any possible processor choice. The two problems were: + +*) x86 code, when 386 is selected, checks at runtime boot_cpuflags, which we do + not have. +*) 3Dnow support for memcpy() et al. does not compile currently and fixing this + is not trivial, so simply disable it; with this change, if one selects MK7 + UML compiles (while it did not). +Merged upstream. + +Signed-off-by: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Greg Kroah-Hartman + +--- + arch/i386/Kconfig.cpu | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- linux-2.6.18.1.orig/arch/i386/Kconfig.cpu ++++ linux-2.6.18.1/arch/i386/Kconfig.cpu +@@ -7,6 +7,7 @@ choice + + config M386 + bool "386" ++ depends on !UML + ---help--- + This is the processor type of your CPU. This information is used for + optimizing purposes. In order to compile a kernel that can run on +@@ -301,7 +302,7 @@ config X86_USE_PPRO_CHECKSUM + + config X86_USE_3DNOW + bool +- depends on MCYRIXIII || MK7 || MGEODE_LX ++ depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML + default y + + config X86_OOSTORE